Re: [Curdle] I-D Action: draft-ietf-curdle-des-des-des-die-die-die-02.txt

[Michiko Short <[e-mail]>]

Also why do we only call out Windows. Perhaps the better option is to list all which of our versions support AES? For example:

Windows has supported AES since 2007 with the release of Windows Vista & 2008 with the release of Windows Server 2008, therefore numbers of Windows which required RC4 should be low. MIT has... Heimdal has..

-----Original Message-----
From: Daniel Migault [mailto:[e-mail]] 
Sent: Monday, June 5, 2017 2:50 PM
To: [e-mail]
Cc: [e-mail]; [e-mail]
Subject: RE: [Curdle] I-D Action: draft-ietf-curdle-des-des-des-die-die-die-02.txt

Hi, 

Thanks for updating the draft. I have found some small nits, but overall the draft seems ready to me to be sent to the IESG. I have prepared the shepherd write-up [1]. I believe 03 will be sent it to the IESG. 

If anyone has additional comments, please let us know as soon as possible.

Yours,
Daniel

[1] https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-ietf-curdle-des-des-des-die-die-die%2Fshepherdwriteup%2F&data=02%7C01%7Cmichikos%40microsoft.com%7Cbcc759a2ac824a5e026608d4ac5cddff%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636322962250114126&sdata=kjynmx5IEKqTpLmmzE5AftZdS4PxJ12uSKn%2B%2F3Ay7b8%3D&reserved=0

COMMENT A)
"""
 However, both Windows XP and Windows Server 2003 are already out of
   their official support periods.  It is now believed that all machines
   that might be broken by disabling RC4 are unsupported, and concerns
   about breaking them will be reduced.  That should facilitate the
   removal of RC4 from common use.
"""

Maybe that is my English and I might misinterpret the text, but it do not find appropriated to mention we are not concerned by breaking some systems. I also feel that the text can be interpreted as a commercial argument to "buy the new release". Maybe it might be more appropriated to say that as unsupported, their numbers is expected to be quite low, then that such machines are unlikely to operate on managed networks where Kerberos is deployed.  If that is the case, it is the responsibility of the network administrator to address appropriately this issue. But I am fine with the conclusion: That should facilitate the removal of RC4 from common use.


COMMENT B)
Maybe some references could be provided for the cited Kerberos implementations.  

MIT Kerberos; https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fweb.mit.edu%2Fkerberos%2F&data=02%7C01%7Cmichikos%40microsoft.com%7Cbcc759a2ac824a5e026608d4ac5cddff%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636322962250114126&sdata=uXgb5iakspN%2FI%2Bj9yqfrkKbcXbKHkaRwM5oDWJU7PuU%3D&reserved=0
Heimdal Kerberos: https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.h5l.org%2F&data=02%7C01%7Cmichikos%40microsoft.com%7Cbcc759a2ac824a5e026608d4ac5cddff%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636322962250124134&sdata=zCRCdJ24R93jirCIwfNT2ifgPG28%2FQlfoHjIQfKreBs%3D&reserved=0

COMMENT C) 

The URL does not appear in the references. 
[MS-NLMP]  Microsoft Corporation, "[MS-NLMP]: NT LAN Manager (NTLM)
              Authentication Protocol", May 2014.
[IANA-KRB]
              Internet Assigned Numbers Authority, "IANA Kerberos
              Parameters Registry", March 2017.

I suppose this is an issue in the xml, and maybe the following syntax could solve this issue:

OLD: 
<reference anchor="MS-NLMP">
    <front>
        <title abbrev="NTLM Authentication Protocol">[MS-NLMP]: NT LAN Manager (NTLM) Authentication Protocol</title>
        <author>
            <organization>Microsoft Corporation</organization>
        </author>
		<date year="2014" month="May"/>
    </front>
    <format type="HTML" target="https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmsdn.microsoft.com%2Fen-us%2Flibrary%2Fcc236621.aspx&data=02%7C01%7Cmichikos%40microsoft.com%7Cbcc759a2ac824a5e026608d4ac5cddff%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636322962250124134&sdata=QiK%2FpC9fJXh5fQEt2IjugLsuTPkd6%2Bv4qEymkUOHPVs%3D&reserved=0"/>
</reference>

<reference anchor="IANA-KRB">
    <front>
	    <title>IANA Kerberos Parameters Registry</title>
		<author>
		    <organization>Internet Assigned Numbers Authority</organization>
			</author><date year="2017" month="March"/>
	</front>
	<format type="HTML" target="https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.iana.org%2Fassignments%2Fkerberos-parameters%2Fkerberos-parameters.xhtml&data=02%7C01%7Cmichikos%40microsoft.com%7Cbcc759a2ac824a5e026608d4ac5cddff%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636322962250124134&sdata=vGEHkoMc%2F00ptdCgXR2A0kPN90aFKcyo%2Bzlb86IcgRQ%3D&reserved=0"/>
	</reference>
NEW:
<reference anchor="MS-NLMP" target="https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmsdn.microsoft.com%2Fen-us%2Flibrary%2Fcc236621.aspx&data=02%7C01%7Cmichikos%40microsoft.com%7Cbcc759a2ac824a5e026608d4ac5cddff%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636322962250124134&sdata=QiK%2FpC9fJXh5fQEt2IjugLsuTPkd6%2Bv4qEymkUOHPVs%3D&reserved=0">
    <front>
        <title abbrev="NTLM Authentication Protocol">[MS-NLMP]: NT LAN Manager (NTLM) Authentication Protocol</title>
        <author>
            <organization>Microsoft Corporation</organization>
        </author>
		<date year="2014" month="May"/>
    </front>
</reference>

<reference anchor="IANA-KRB" target="https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.iana.org%2Fassignments%2Fkerberos-parameters%2Fkerberos-parameters.xhtml&data=02%7C01%7Cmichikos%40microsoft.com%7Cbcc759a2ac824a5e026608d4ac5cddff%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636322962250124134&sdata=vGEHkoMc%2F00ptdCgXR2A0kPN90aFKcyo%2Bzlb86IcgRQ%3D&reserved=0">
    <front>
	    <title>IANA Kerberos Parameters Registry</title>
		<author>
		    <organization>Internet Assigned Numbers Authority</organization>
			</author><date year="2017" month="March"/>
	</front>
</reference>	

COMMENT D) 

The RFC6150 is informational and is listed in the normative section. I believe it should be in the informational reference section. 

[RFC6150]  Turner, S. and L. Chen, "MD4 to Historic Status",
              RFC 6150, DOI 10.17487/RFC6150, March 2011,
              <https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.rfc-editor.org%2Finfo%2Frfc6150&data=02%7C01%7Cmichikos%40microsoft.com%7Cbcc759a2ac824a5e026608d4ac5cddff%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636322962250124134&sdata=%2BhSjbFbDOKRbzJxM3QiDDGtqnPV6BPfxPdysNFvW9pQ%3D&reserved=0>.

COMMENT E) 

s/Similarly, IANA Is requested/ Similarly, IANA is requested


-----Original Message-----
From: Curdle [mailto:[e-mail]] On Behalf Of Benjamin Kaduk
Sent: Sunday, June 04, 2017 10:51 PM
To: [e-mail]
Subject: Re: [Curdle] I-D Action: draft-ietf-curdle-des-des-des-die-die-die-02.txt

This just updates the reference for the IANA registries to have the actual URL for the registry on the web, instead of referencing the RFC that created the registries.

-Ben

On Sun, Jun 04, 2017 at 07:49:57PM -0700, [e-mail] wrote:
> 
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> This draft is a work item of the CURves, Deprecating and a Little more Encryption of the IETF.
> 
>         Title           : Deprecate 3DES and RC4 in Kerberos
>         Authors         : Benjamin Kaduk
>                           Michiko Short
> 	Filename        : draft-ietf-curdle-des-des-des-die-die-die-02.txt
> 	Pages           : 9
> 	Date            : 2017-06-04
> 
> Abstract:
>    The 3DES and RC4 encryption types are steadily weakening in
>    cryptographic strength, and the deprecation process should be begun
>    for their use in Kerberos.  Accordingly, RFC 4757 is moved to
>    Obsolete status, as none of the encryption types it specifies should
>    be used, and RFC 3961 is updated to note the deprecation of the
>    triple-DES encryption types.
> 
> 
> The IETF datatracker status page for this draft is:
> https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatat
> racker.ietf.org%2Fdoc%2Fdraft-ietf-curdle-des-des-des-die-die&data=02%
> 7C01%7Cmichikos%40microsoft.com%7Cbcc759a2ac824a5e026608d4ac5cddff%7C7
> 2f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636322962250124134&sdata=W9D
> 1cNitX3lTbDk82Viu4VSSxX%2FlZxH9RCk%2BUS56jM8%3D&reserved=0
> -die/
> 
> There are also htmlized versions available at:
> https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftools
> .ietf.org%2Fhtml%2Fdraft-ietf-curdle-des-des-des-die-die-die-&data=02%
> 7C01%7Cmichikos%40microsoft.com%7Cbcc759a2ac824a5e026608d4ac5cddff%7C7
> 2f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636322962250124134&sdata=gJQ
> NwHRax8r5cRudXHHHRFK9aS0hLSfD6HNf6vBkwFg%3D&reserved=0
> 02
> https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatat
> racker.ietf.org%2Fdoc%2Fhtml%2Fdraft-ietf-curdle-des-des-des-die-die-d
> ie-02&data=02%7C01%7Cmichikos%40microsoft.com%7Cbcc759a2ac824a5e026608
> d4ac5cddff%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C63632296225012
> 4134&sdata=wcJm7JdAsBBznGfPi3c5WRJ1Jgt5jdBQIDhC5EkM4Gk%3D&reserved=0
> 
> A diff from the previous version is available at:
> https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.i
> etf.org%2Frfcdiff%3Furl2%3Ddraft-ietf-curdle-des-des-des-die-di&data=0
> 2%7C01%7Cmichikos%40microsoft.com%7Cbcc759a2ac824a5e026608d4ac5cddff%7
> C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636322962250124134&sdata=E
> hrVb769fbxn41qg7kVeBZIMk2jycmQRFJ26yil%2BO1c%3D&reserved=0
> e-die-02
> 
> 
> Please note that it may take a couple of minutes from the time of 
> submission until the htmlized version and diff are available at tools.ietf.org.
> 
> Internet-Drafts are also available by anonymous FTP at:
> ftp://ftp.ietf.org/internet-drafts/
> 
> _______________________________________________
> Curdle mailing list
> [e-mail]
> https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.i
> etf.org%2Fmailman%2Flistinfo%2Fcurdle&data=02%7C01%7Cmichikos%40micros
> oft.com%7Cbcc759a2ac824a5e026608d4ac5cddff%7C72f988bf86f141af91ab2d7cd
> 011db47%7C1%7C0%7C636322962250124134&sdata=DcfGyzuZ89ur3shrhsefQ6N0fIM
> %2Fw%2BiVBvl%2FC0CD3%2FQ%3D&reserved=0

_______________________________________________
Curdle mailing list
[e-mail]
https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fcurdle&data=02%7C01%7Cmichikos%40microsoft.com%7Cbcc759a2ac824a5e026608d4ac5cddff%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636322962250134142&sdata=0K2JfDATGftlKs81oowUfCPupD%2B8YavdBrxhxTblpCc%3D&reserved=0