Re: [Curdle] Warren Kumari's No Objection on draft-ietf-curdle-des-des-des-die-die-die-04: (with COMMENT)

[Benjamin Kaduk <[e-mail]>]

Hi Warren,

On Mon, Sep 11, 2017 at 12:45:05PM -0700, Warren Kumari wrote:
> Warren Kumari has entered the following ballot position for
> draft-ietf-curdle-des-des-des-die-die-die-04: No Objection
> 
> The document, along with other ballot positions, can be found here:
> https://datatracker.ietf.org/doc/draft-ietf-curdle-des-des-des-die-die-die/
> 
> 
> 
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
> 
> Thanks to Joel for his OpsDir review.
> 
> I have a few comments / readability suggestions:
> 1: Section 5.1.  Statistical Biases
> "These attacks seem to rely on repeated encryptions of thousands of copies of
> the same plaintext; " -- for a document which deprecates rc4-hmac the "seem to
> rely on" feels very weak. I'd suggest s/seem// or "At least some of these
> attacks rely on..." or similar.

Sure, accepted.

> 2: Section 6.  3DES Weakness
> "Additionally, the 3DES encryption types were never implemented in all Kerberos
> implementations..." s/never/not/

Accepted.

> 3:  Section 6.3.  Interoperability
> "The triple-DES encryption types were implemented by MIT Kerberos
>    early in its development (ca. 1999) and present in the 1.2 release,
>    but encryption types 17 and 18 (AES) were implemented by 2003 and
>    present in the 1.3 release."
> I'm a bit confused by the "but" - should this be "and"? Otherwise it sounds
> like it it trying to contrast something.

The intent is more along the lines of "but they were superseded when",
so I'll make that change in my working copy.

Thanks for the suggestions!

-Ben