Re: [Curdle] draft-ietf-curdle-rc4-die-die-die-06 review

[Daniel Migault <[e-mail]>]

Hi,

We would like to thank Loganaden Velvindron for volunteering to co-author
and move the draft forward.

Yours,
Daniel

On Fri, Jul 6, 2018 at 5:13 PM, Daniel Migault <[e-mail]>
wrote:

> Hi,
>
> We would like to move the draft to the IESG, however, the draft has not
> been updated to address the comments received on the mailing list. We have
> privately contacted the author 3 times with the email address provided to
> the draft, but we did not receive any response. The purpose of this email
> is to first try to contact the author of draft via another channel and
> understand if he has any plan to move the draft forward. In addition, we
> would also like to see if there is any interest by some members of the
> group to co-author the draft and move the draft forward. For those
> interested in co-authoring the draft, please contact us privately.
>
> Our goal is to have all drafts - that is the two remaining drafts in WGLC
> - submitted by end of august.
>
> Yours,
> Rich and Daniel
>
> On Tue, May 15, 2018 at 1:00 PM, Daniel Migault <
> [e-mail]> wrote:
>
>> Hi,
>>
>> Please find my review for draft-ietf-curdle-rc4-die-die-die-06 [1]. I
>> have also proposed text, so please comment the review in the mail. I am
>> willing to start a WGLC as soon as the draft is being updated.
>>
>> Yours,
>> Daniel
>>
>>
>> [1] https://tools.ietf.org/html/draft-ietf-curdle-rc4-die-die-die-06
>>
>>
>> RFC-Editor:
>>
>> I personally find the ton of the sentence a bit aggressive, thus I would
>> remove it or just leave the RFC reference.
>>
>> """
>> Non-ASCII characters are allowed in RFCs as per RFC 7997.
>> """
>>
>> I see deprecation and move to historic status as very similar to
>> draft-ietf-curdle-des-des-des-die-die-die-05 and I assume that is
>> correct.
>>
>> Abstract:
>>
>> The sentence below is a bit hard to parse.
>> ""
>> and formally obsoletes and moves to
>>    Historic RFC 4345.
>> ""
>>
>> I would propose instead:
>>
>> """
>> This document deprecates RC4 in Secure Shell (SSH).  Therefore, this
>>    document updates RFC 4253, and moves to Historic RFC 4345.
>> """
>>
>> 1. Introduction
>>
>>
>> """
>> RC4 is broken""
>> """
>>
>> Although English is not my main language, it sounds a bit abrupt to me
>> and it might be preferred to sue something around the lines of
>> draft-ietf-curdle-des-des-des-die-die-die-05:
>>
>> RC4 encryption is steadily weakening in cryptographic strength, and the
>> deprecation process should be begun for their use in SSH.
>>
>>
>> It seems to me that sections 1, 2 3 could be merged. I would propose the
>> following text. I am providing comments in <mglt></mglt>.
>>
>>
>>
>> 1. Introduction
>>
>>
>> The usage of RC4 suites ( also designated as arcfour ) for SSH are
>> specified in RFC 4253 and RFC 4345. RFC 4253 specifies the allocation of
>> the "arcfour" cipher for SSH. RFC 4345 specifies and allocates the the
>> "arcfour-128" and "arcfour-256" ciphers for SSH.
>>
>> RC4 encryption is steadily weakening in cryptographic strength
>> [RFC7457][draft-ietf-curdle-des-des-des-die-die-die-05], and the
>> deprecation process should be begun for their use in Secure Shell (SSH)
>> [RFC4253]. Accordingly, RFC 4253 is updated to note the deprecation of the
>> RC4 ciphers and RFC 4345 is moved to Historic as all ciphers it specifies
>> MUST NOT be used.
>>
>> <mglt>I believe that this document is very closed to
>> [draft-ietf-curdle-des-des-des-die-die-die-05] and as such a reference
>> to it should be mentioned. </mglt>
>>
>>
>> 2.  Requirements Notation
>>
>>  The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
>> "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
>> document are to be interpreted as described in BCP 14 [RFC2119, RFC8174]
>> when, and only when, they appear in all capitals, as shown here.
>>
>> 3. Updates to RFC 4253
>>
>> RFC 4253 is updated to prohibit arcfour's use in SSH.
>>
>> <mglt>
>> """
>> The last sentence of the paragraph on RC4 (called "arcfour"
>>    in [RFC4253]) in Section 6.3 of [RFC4253]
>> """
>>
>> I believe that it might be clearer to quote the text as it is not easy to
>> locate it. I would propose the text below. </mglt>
>>
>> RFC 4253 allocate the "arcfour" cipher in Section 6.3 by defining a list
>> of defined ciphers where the "arcfour" cipher appears as optional as
>> mentioned below:
>>
>> """
>>       arcfour          OPTIONAL          the ARCFOUR stream cipher
>>                                          with a 128-bit key
>> """
>>
>> The current document updates the status of the "arcfour" ciphers in the
>> list of RFC 4253 Section 6.3 by moving it from OPTIONAL to MUST NOT.
>>
>> """
>>       arcfour          MUST NOT          the ARCFOUR stream cipher
>>                                          with a 128-bit key
>> """
>>
>> RFC 4253 defines the "arcfour" ciphers with the text mentioned below:
>> """
>>    The "arcfour" cipher is the Arcfour stream cipher with 128-bit keys.
>>    The Arcfour cipher is believed to be compatible with the RC4 cipher
>>    [SCHNEIER].  Arcfour (and RC4) has problems with weak keys, and
>>    should be used with caution.
>> """
>>
>> The current document updates RFC 4253 Section 6.3 by replacing th etext
>> above with the following text:
>>
>> """
>>    The "arcfour" cipher is the Arcfour stream cipher with 128-bit keys.
>>    The Arcfour cipher is believed to be compatible with the RC4 cipher
>>    [SCHNEIER].  Arcfour (and RC4) is steadily weakening in cryptographic
>> strength [RFC7457][draft-ietf-curdle-des-des-des-die-die-die-05], and
>>    MUST NOT be used.
>> """
>>
>> 4. IANA Considerations
>>
>> <mglt>There is a reference to 3DES i think should be removed. In
>> addition, IANA cannot be required to update RFCs. IANA is assigned to
>> update the SSH registries. With [IANA] being an informational reference to
>> https://www.iana.org/assignments/ssh-parameters/ssh-parameters.xhtml,  I
>> would propose the following text :</mglt>
>>
>> The IANA is requested to update the Encryption Algorithm Name  Registry
>> of the Secure Shell (SSH) Protocol Parameters [IANA]. The Registration
>> procedure is IETF Review which is achieved by this document. The registry
>> should be updated as follows:
>>
>> Encryption Algorithm Name     Reference     Note
>> arcfour                          [RFC-TBD]
>> arcfour128                     [RFC-TBD]
>> arcfour256                     [RFC-TBD]
>>
>>
>> Where TBD is the RFC number assigned to the document.
>>
>>
>>
>>
>