Re: [Curdle] FW: I-D Action: draft-ietf-curdle-rc4-die-die-die-03.txt

On Sun, Dec 10, 2017 at 08:42:51PM +0000, Salz, Rich wrote:
> The security AD’s just got back to us.  Apologies from the AD’s and Chairs for letting this fall through the cracks.
> 
> A general “deprecate in all protocols” document is not appropriate for CURDLE.  This means that Section 4 (IMAP->EXTRA), Section 6 (DIAMETER->DIME) and Section 7 are out of scope for this WG. This is quoting Eric, one of the co-Directors.
> 
> On a personal level, I think Section 3 should be handled by UTA. And Section 5 has KITTEN

I think section 5 is roughly equivalent to
draft-ietf-curdle-des-des-des-die-die-die (of which I am coauthor),
which is currently waiting for the IESG to decide whether it is more
appropriate to move RFC 4757 to Historic or make it Obsolete.
So I'm surpirsed that this draft did not refer to "RFC xxxx" in
section 5 but did refer to it in other places :)

> Even if the WG disagrees with me about 3 and 5, there is a question about if it’s worth still having this as a WG document.  Please post your reply to the list; we will call for consensus to move this forward or abandon it early in January.

I think it is worth having this WG do the work it can do in this
space within its charter (which is probably the bits in this
document minus sections 3 and 5).  It feels a little strange to me
to do it all in a single document, as this does, but I wouldn't let
that stop us from doing it.

-Ben

> On 12/9/17, 3:22 PM, "internet-drafts@ietf.org" <internet-drafts@ietf.org> wrote:
> 
>      
>     A New Internet-Draft is available from the on-line Internet-Drafts directories.
>     This draft is a work item of the CURves, Deprecating and a Little more Encryption WG of the IETF.
>     
>             Title           : Depreciating RC4 in all IETF Protocols
>             Author          : Luis Camara
>     	Filename        : draft-ietf-curdle-rc4-die-die-die-03.txt
>     	Pages           : 8
>     	Date            : 2017-12-09
>     
>     Abstract:
>        RC4 is extremely weak as shown by RFC 6649 and RFC 7457, is
>        prohibited in TLS by RFC 7465, is prohibited in Kerberos by RFC xxxx
>        and it needs to be prohibited in all IETF protocols. This document
>        obsoletes RFC 4345 "Improved Arcfour Modes for the Secure Shell (SSH)
>        Transport Layer Protocol" (note Arcfour and RC4 are synonymous).
>        RFC 3501, RFC 4253, RFC 6649 and RFC 6733 are updated to note the
>        deprecation of RC4 in all IETF protocols.
>     
>     
>     The IETF datatracker status page for this draft is:
>     https://datatracker.ietf.org/doc/draft-ietf-curdle-rc4-die-die-die/
>     
>     There are also htmlized versions available at:
>     https://tools.ietf.org/html/draft-ietf-curdle-rc4-die-die-die-03
>     https://datatracker.ietf.org/doc/html/draft-ietf-curdle-rc4-die-die-die-03
>     
>     A diff from the previous version is available at:
>     https://www.ietf.org/rfcdiff?url2=draft-ietf-curdle-rc4-die-die-die-03
>     
>     
>     Please note that it may take a couple of minutes from the time of submission
>     until the htmlized version and diff are available at tools.ietf.org.
>     
>     Internet-Drafts are also available by anonymous FTP at:
>     ftp://ftp.ietf.org/internet-drafts/
>     
>     _______________________________________________
>     Curdle mailing list
>     Curdle@ietf.org
>     https://www.ietf.org/mailman/listinfo/curdle
>     
> 
> _______________________________________________
> Curdle mailing list
> Curdle@ietf.org
> https://www.ietf.org/mailman/listinfo/curdle