Re: [Curdle] draft-ietf-curdle-rc4-die-die-die-06 review

[Loganaden Velvindron <[e-mail]>]

Please find attached the revised xml file for rev 07, with the
feedback received.

I'm going to upload once the chairs clear this:
https://datatracker.ietf.org/submit/status/97172/



On Tue, Jul 17, 2018 at 9:58 PM, Daniel Migault
<[e-mail]> wrote:
> Hi,
>
> We would like to thank Loganaden Velvindron for volunteering to co-author
> and move the draft forward.
>
> Yours,
> Daniel
>
> On Fri, Jul 6, 2018 at 5:13 PM, Daniel Migault <[e-mail]>
> wrote:
>>
>> Hi,
>>
>> We would like to move the draft to the IESG, however, the draft has not
>> been updated to address the comments received on the mailing list. We have
>> privately contacted the author 3 times with the email address provided to
>> the draft, but we did not receive any response. The purpose of this email is
>> to first try to contact the author of draft via another channel and
>> understand if he has any plan to move the draft forward. In addition, we
>> would also like to see if there is any interest by some members of the group
>> to co-author the draft and move the draft forward. For those interested in
>> co-authoring the draft, please contact us privately.
>>
>> Our goal is to have all drafts - that is the two remaining drafts in WGLC
>> - submitted by end of august.
>>
>> Yours,
>> Rich and Daniel
>>
>> On Tue, May 15, 2018 at 1:00 PM, Daniel Migault
>> <[e-mail]> wrote:
>>>
>>> Hi,
>>>
>>> Please find my review for draft-ietf-curdle-rc4-die-die-die-06 [1]. I
>>> have also proposed text, so please comment the review in the mail. I am
>>> willing to start a WGLC as soon as the draft is being updated.
>>>
>>> Yours,
>>> Daniel
>>>
>>>
>>> [1] https://tools.ietf.org/html/draft-ietf-curdle-rc4-die-die-die-06
>>>
>>>
>>> RFC-Editor:
>>>
>>> I personally find the ton of the sentence a bit aggressive, thus I would
>>> remove it or just leave the RFC reference.
>>>
>>> """
>>> Non-ASCII characters are allowed in RFCs as per RFC 7997.
>>> """
>>>
>>> I see deprecation and move to historic status as very similar to
>>> draft-ietf-curdle-des-des-des-die-die-die-05 and I assume that is correct.
>>>
>>> Abstract:
>>>
>>> The sentence below is a bit hard to parse.
>>> ""
>>> and formally obsoletes and moves to
>>>    Historic RFC 4345.
>>> ""
>>>
>>> I would propose instead:
>>>
>>> """
>>> This document deprecates RC4 in Secure Shell (SSH).  Therefore, this
>>>    document updates RFC 4253, and moves to Historic RFC 4345.
>>> """
>>>
>>> 1. Introduction
>>>
>>>
>>> """
>>> RC4 is broken""
>>> """
>>>
>>> Although English is not my main language, it sounds a bit abrupt to me
>>> and it might be preferred to sue something around the lines of
>>> draft-ietf-curdle-des-des-des-die-die-die-05:
>>>
>>> RC4 encryption is steadily weakening in cryptographic strength, and the
>>> deprecation process should be begun for their use in SSH.
>>>
>>>
>>> It seems to me that sections 1, 2 3 could be merged. I would propose the
>>> following text. I am providing comments in <mglt></mglt>.
>>>
>>>
>>>
>>> 1. Introduction
>>>
>>>
>>> The usage of RC4 suites ( also designated as arcfour ) for SSH are
>>> specified in RFC 4253 and RFC 4345. RFC 4253 specifies the allocation of the
>>> "arcfour" cipher for SSH. RFC 4345 specifies and allocates the the
>>> "arcfour-128" and "arcfour-256" ciphers for SSH.
>>>
>>> RC4 encryption is steadily weakening in cryptographic strength
>>> [RFC7457][draft-ietf-curdle-des-des-des-die-die-die-05], and the deprecation
>>> process should be begun for their use in Secure Shell (SSH) [RFC4253].
>>> Accordingly, RFC 4253 is updated to note the deprecation of the RC4 ciphers
>>> and RFC 4345 is moved to Historic as all ciphers it specifies MUST NOT be
>>> used.
>>>
>>> <mglt>I believe that this document is very closed to
>>> [draft-ietf-curdle-des-des-des-die-die-die-05] and as such a reference to it
>>> should be mentioned. </mglt>
>>>
>>>
>>> 2.  Requirements Notation
>>>
>>>  The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
>>> "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
>>> document are to be interpreted as described in BCP 14 [RFC2119, RFC8174]
>>> when, and only when, they appear in all capitals, as shown here.
>>>
>>> 3. Updates to RFC 4253
>>>
>>> RFC 4253 is updated to prohibit arcfour's use in SSH.
>>>
>>> <mglt>
>>> """
>>> The last sentence of the paragraph on RC4 (called "arcfour"
>>>    in [RFC4253]) in Section 6.3 of [RFC4253]
>>> """
>>>
>>> I believe that it might be clearer to quote the text as it is not easy to
>>> locate it. I would propose the text below. </mglt>
>>>
>>> RFC 4253 allocate the "arcfour" cipher in Section 6.3 by defining a list
>>> of defined ciphers where the "arcfour" cipher appears as optional as
>>> mentioned below:
>>>
>>> """
>>>       arcfour          OPTIONAL          the ARCFOUR stream cipher
>>>                                          with a 128-bit key
>>> """
>>>
>>> The current document updates the status of the "arcfour" ciphers in the
>>> list of RFC 4253 Section 6.3 by moving it from OPTIONAL to MUST NOT.
>>>
>>> """
>>>       arcfour          MUST NOT          the ARCFOUR stream cipher
>>>                                          with a 128-bit key
>>> """
>>>
>>> RFC 4253 defines the "arcfour" ciphers with the text mentioned below:
>>> """
>>>    The "arcfour" cipher is the Arcfour stream cipher with 128-bit keys.
>>>    The Arcfour cipher is believed to be compatible with the RC4 cipher
>>>    [SCHNEIER].  Arcfour (and RC4) has problems with weak keys, and
>>>    should be used with caution.
>>> """
>>>
>>> The current document updates RFC 4253 Section 6.3 by replacing th etext
>>> above with the following text:
>>>
>>> """
>>>    The "arcfour" cipher is the Arcfour stream cipher with 128-bit keys.
>>>    The Arcfour cipher is believed to be compatible with the RC4 cipher
>>>    [SCHNEIER].  Arcfour (and RC4) is steadily weakening in cryptographic
>>> strength [RFC7457][draft-ietf-curdle-des-des-des-die-die-die-05], and
>>>    MUST NOT be used.
>>> """
>>>
>>> 4. IANA Considerations
>>>
>>> <mglt>There is a reference to 3DES i think should be removed. In
>>> addition, IANA cannot be required to update RFCs. IANA is assigned to update
>>> the SSH registries. With [IANA] being an informational reference to
>>> https://www.iana.org/assignments/ssh-parameters/ssh-parameters.xhtml,  I
>>> would propose the following text :</mglt>
>>>
>>> The IANA is requested to update the Encryption Algorithm Name  Registry
>>> of the Secure Shell (SSH) Protocol Parameters [IANA]. The Registration
>>> procedure is IETF Review which is achieved by this document. The registry
>>> should be updated as follows:
>>>
>>> Encryption Algorithm Name     Reference     Note
>>> arcfour                          [RFC-TBD]
>>> arcfour128                     [RFC-TBD]
>>> arcfour256                     [RFC-TBD]
>>>
>>>
>>> Where TBD is the RFC number assigned to the document.
>>>
>>>
>>>
>>
>
>
> _______________________________________________
> Curdle mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/curdle
>