Re: [Curdle] FW: I-D Action: draft-ietf-curdle-rc4-die-die-die-03.txt

[Benjamin Kaduk <[e-mail]>]

On Sun, Dec 10, 2017 at 03:37:20PM -0600, Benjamin Kaduk wrote:
> On Sun, Dec 10, 2017 at 08:42:51PM +0000, Salz, Rich wrote:
> > The security AD’s just got back to us.  Apologies from the AD’s and Chairs for letting this fall through the cracks.
> > 
> > A general “deprecate in all protocols” document is not appropriate for CURDLE.  This means that Section 4 (IMAP->EXTRA), Section 6 (DIAMETER->DIME) and Section 7 are out of scope for this WG. This is quoting Eric, one of the co-Directors.
> > 
> > On a personal level, I think Section 3 should be handled by UTA. And Section 5 has KITTEN
> 
> I think section 5 is roughly equivalent to
> draft-ietf-curdle-des-des-des-die-die-die (of which I am coauthor),
> which is currently waiting for the IESG to decide whether it is more
> appropriate to move RFC 4757 to Historic or make it Obsolete.
> So I'm surpirsed that this draft did not refer to "RFC xxxx" in
> section 5 but did refer to it in other places :)
> 
> > Even if the WG disagrees with me about 3 and 5, there is a question about if it’s worth still having this as a WG document.  Please post your reply to the list; we will call for consensus to move this forward or abandon it early in January.
> 
> I think it is worth having this WG do the work it can do in this
> space within its charter (which is probably the bits in this
> document minus sections 3 and 5).  It feels a little strange to me

A little bird points out that sections 3 and 5 are what Rich was
uncertain of, but it is sections 4, 6, and 7 that Ekr did not think
were appropriate, which is perhaps more authoritative.

> to do it all in a single document, as this does, but I wouldn't let
> that stop us from doing it.

And all in all, the mentioned sections are basically the entire
document.  So, I have to revise my opinion to "this document as-is
doesn't make much sense, but we might consider separate
document(s) for the one or two sections that may still remain".

-Ben

> > On 12/9/17, 3:22 PM, "[e-mail]" <[e-mail]> wrote:
> > 
> >      
> >     A New Internet-Draft is available from the on-line Internet-Drafts directories.
> >     This draft is a work item of the CURves, Deprecating and a Little more Encryption WG of the IETF.
> >     
> >             Title           : Depreciating RC4 in all IETF Protocols
> >             Author          : Luis Camara
> >     	Filename        : draft-ietf-curdle-rc4-die-die-die-03.txt
> >     	Pages           : 8
> >     	Date            : 2017-12-09
> >     
> >     Abstract:
> >        RC4 is extremely weak as shown by RFC 6649 and RFC 7457, is
> >        prohibited in TLS by RFC 7465, is prohibited in Kerberos by RFC xxxx
> >        and it needs to be prohibited in all IETF protocols. This document
> >        obsoletes RFC 4345 "Improved Arcfour Modes for the Secure Shell (SSH)
> >        Transport Layer Protocol" (note Arcfour and RC4 are synonymous).
> >        RFC 3501, RFC 4253, RFC 6649 and RFC 6733 are updated to note the
> >        deprecation of RC4 in all IETF protocols.
> >     
> >     
> >     The IETF datatracker status page for this draft is:
> >     https://datatracker.ietf.org/doc/draft-ietf-curdle-rc4-die-die-die/
> >     
> >     There are also htmlized versions available at:
> >     https://tools.ietf.org/html/draft-ietf-curdle-rc4-die-die-die-03
> >     https://datatracker.ietf.org/doc/html/draft-ietf-curdle-rc4-die-die-die-03
> >     
> >     A diff from the previous version is available at:
> >     https://www.ietf.org/rfcdiff?url2=draft-ietf-curdle-rc4-die-die-die-03
> >     
> >     
> >     Please note that it may take a couple of minutes from the time of submission
> >     until the htmlized version and diff are available at tools.ietf.org.
> >     
> >     Internet-Drafts are also available by anonymous FTP at:
> >     ftp://ftp.ietf.org/internet-drafts/
> >     
> >     _______________________________________________
> >     Curdle mailing list
> >     [e-mail]
> >     https://www.ietf.org/mailman/listinfo/curdle
> >     
> > 
> > _______________________________________________
> > Curdle mailing list
> > [e-mail]
> > https://www.ietf.org/mailman/listinfo/curdle
> 
> _______________________________________________
> Curdle mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/curdle