Re: [Curdle] draft-ietf-curdle-rc4-die-die-die-06 review

[Daniel Migault <[e-mail]>]

Hi,

I think that should be fine now - I can see that we both of us has approved
the link. Thanks for updating the document! Let us know if you encounter
any issues!

Yours,
Daniel

On Thu, Aug 9, 2018 at 7:06 AM, Loganaden Velvindron <[e-mail]>
wrote:

> Please find attached the revised xml file for rev 07, with the
> feedback received.
>
> I'm going to upload once the chairs clear this:
> https://datatracker.ietf.org/submit/status/97172/
>
>
>
> On Tue, Jul 17, 2018 at 9:58 PM, Daniel Migault
> <[e-mail]> wrote:
> > Hi,
> >
> > We would like to thank Loganaden Velvindron for volunteering to co-author
> > and move the draft forward.
> >
> > Yours,
> > Daniel
> >
> > On Fri, Jul 6, 2018 at 5:13 PM, Daniel Migault <
> [e-mail]>
> > wrote:
> >>
> >> Hi,
> >>
> >> We would like to move the draft to the IESG, however, the draft has not
> >> been updated to address the comments received on the mailing list. We
> have
> >> privately contacted the author 3 times with the email address provided
> to
> >> the draft, but we did not receive any response. The purpose of this
> email is
> >> to first try to contact the author of draft via another channel and
> >> understand if he has any plan to move the draft forward. In addition, we
> >> would also like to see if there is any interest by some members of the
> group
> >> to co-author the draft and move the draft forward. For those interested
> in
> >> co-authoring the draft, please contact us privately.
> >>
> >> Our goal is to have all drafts - that is the two remaining drafts in
> WGLC
> >> - submitted by end of august.
> >>
> >> Yours,
> >> Rich and Daniel
> >>
> >> On Tue, May 15, 2018 at 1:00 PM, Daniel Migault
> >> <[e-mail]> wrote:
> >>>
> >>> Hi,
> >>>
> >>> Please find my review for draft-ietf-curdle-rc4-die-die-die-06 [1]. I
> >>> have also proposed text, so please comment the review in the mail. I am
> >>> willing to start a WGLC as soon as the draft is being updated.
> >>>
> >>> Yours,
> >>> Daniel
> >>>
> >>>
> >>> [1] https://tools.ietf.org/html/draft-ietf-curdle-rc4-die-die-die-06
> >>>
> >>>
> >>> RFC-Editor:
> >>>
> >>> I personally find the ton of the sentence a bit aggressive, thus I
> would
> >>> remove it or just leave the RFC reference.
> >>>
> >>> """
> >>> Non-ASCII characters are allowed in RFCs as per RFC 7997.
> >>> """
> >>>
> >>> I see deprecation and move to historic status as very similar to
> >>> draft-ietf-curdle-des-des-des-die-die-die-05 and I assume that is
> correct.
> >>>
> >>> Abstract:
> >>>
> >>> The sentence below is a bit hard to parse.
> >>> ""
> >>> and formally obsoletes and moves to
> >>>    Historic RFC 4345.
> >>> ""
> >>>
> >>> I would propose instead:
> >>>
> >>> """
> >>> This document deprecates RC4 in Secure Shell (SSH).  Therefore, this
> >>>    document updates RFC 4253, and moves to Historic RFC 4345.
> >>> """
> >>>
> >>> 1. Introduction
> >>>
> >>>
> >>> """
> >>> RC4 is broken""
> >>> """
> >>>
> >>> Although English is not my main language, it sounds a bit abrupt to me
> >>> and it might be preferred to sue something around the lines of
> >>> draft-ietf-curdle-des-des-des-die-die-die-05:
> >>>
> >>> RC4 encryption is steadily weakening in cryptographic strength, and the
> >>> deprecation process should be begun for their use in SSH.
> >>>
> >>>
> >>> It seems to me that sections 1, 2 3 could be merged. I would propose
> the
> >>> following text. I am providing comments in <mglt></mglt>.
> >>>
> >>>
> >>>
> >>> 1. Introduction
> >>>
> >>>
> >>> The usage of RC4 suites ( also designated as arcfour ) for SSH are
> >>> specified in RFC 4253 and RFC 4345. RFC 4253 specifies the allocation
> of the
> >>> "arcfour" cipher for SSH. RFC 4345 specifies and allocates the the
> >>> "arcfour-128" and "arcfour-256" ciphers for SSH.
> >>>
> >>> RC4 encryption is steadily weakening in cryptographic strength
> >>> [RFC7457][draft-ietf-curdle-des-des-des-die-die-die-05], and the
> deprecation
> >>> process should be begun for their use in Secure Shell (SSH) [RFC4253].
> >>> Accordingly, RFC 4253 is updated to note the deprecation of the RC4
> ciphers
> >>> and RFC 4345 is moved to Historic as all ciphers it specifies MUST NOT
> be
> >>> used.
> >>>
> >>> <mglt>I believe that this document is very closed to
> >>> [draft-ietf-curdle-des-des-des-die-die-die-05] and as such a
> reference to it
> >>> should be mentioned. </mglt>
> >>>
> >>>
> >>> 2.  Requirements Notation
> >>>
> >>>  The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
> >>> "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
> >>> document are to be interpreted as described in BCP 14 [RFC2119,
> RFC8174]
> >>> when, and only when, they appear in all capitals, as shown here.
> >>>
> >>> 3. Updates to RFC 4253
> >>>
> >>> RFC 4253 is updated to prohibit arcfour's use in SSH.
> >>>
> >>> <mglt>
> >>> """
> >>> The last sentence of the paragraph on RC4 (called "arcfour"
> >>>    in [RFC4253]) in Section 6.3 of [RFC4253]
> >>> """
> >>>
> >>> I believe that it might be clearer to quote the text as it is not easy
> to
> >>> locate it. I would propose the text below. </mglt>
> >>>
> >>> RFC 4253 allocate the "arcfour" cipher in Section 6.3 by defining a
> list
> >>> of defined ciphers where the "arcfour" cipher appears as optional as
> >>> mentioned below:
> >>>
> >>> """
> >>>       arcfour          OPTIONAL          the ARCFOUR stream cipher
> >>>                                          with a 128-bit key
> >>> """
> >>>
> >>> The current document updates the status of the "arcfour" ciphers in the
> >>> list of RFC 4253 Section 6.3 by moving it from OPTIONAL to MUST NOT.
> >>>
> >>> """
> >>>       arcfour          MUST NOT          the ARCFOUR stream cipher
> >>>                                          with a 128-bit key
> >>> """
> >>>
> >>> RFC 4253 defines the "arcfour" ciphers with the text mentioned below:
> >>> """
> >>>    The "arcfour" cipher is the Arcfour stream cipher with 128-bit keys.
> >>>    The Arcfour cipher is believed to be compatible with the RC4 cipher
> >>>    [SCHNEIER].  Arcfour (and RC4) has problems with weak keys, and
> >>>    should be used with caution.
> >>> """
> >>>
> >>> The current document updates RFC 4253 Section 6.3 by replacing th etext
> >>> above with the following text:
> >>>
> >>> """
> >>>    The "arcfour" cipher is the Arcfour stream cipher with 128-bit keys.
> >>>    The Arcfour cipher is believed to be compatible with the RC4 cipher
> >>>    [SCHNEIER].  Arcfour (and RC4) is steadily weakening in
> cryptographic
> >>> strength [RFC7457][draft-ietf-curdle-des-des-des-die-die-die-05], and
> >>>    MUST NOT be used.
> >>> """
> >>>
> >>> 4. IANA Considerations
> >>>
> >>> <mglt>There is a reference to 3DES i think should be removed. In
> >>> addition, IANA cannot be required to update RFCs. IANA is assigned to
> update
> >>> the SSH registries. With [IANA] being an informational reference to
> >>> https://www.iana.org/assignments/ssh-parameters/ssh-parameters.xhtml,
> I
> >>> would propose the following text :</mglt>
> >>>
> >>> The IANA is requested to update the Encryption Algorithm Name  Registry
> >>> of the Secure Shell (SSH) Protocol Parameters [IANA]. The Registration
> >>> procedure is IETF Review which is achieved by this document. The
> registry
> >>> should be updated as follows:
> >>>
> >>> Encryption Algorithm Name     Reference     Note
> >>> arcfour                          [RFC-TBD]
> >>> arcfour128                     [RFC-TBD]
> >>> arcfour256                     [RFC-TBD]
> >>>
> >>>
> >>> Where TBD is the RFC number assigned to the document.
> >>>
> >>>
> >>>
> >>
> >
> >
> > _______________________________________________
> > Curdle mailing list
> > [e-mail]
> > https://www.ietf.org/mailman/listinfo/curdle
> >
>
> _______________________________________________
> Curdle mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/curdle
>
>