Re: [dispatch] DISPATCH IETF 111 meeting

On Wed, Jul 28, 2021 at 1:32 PM Eric Rescorla <ekr@rtfm.com> wrote:

>
>
>> So if folks want to make a bigger, scarier warning label to put on SDES
>> to guide people away from it, sure, fine.  But it doesn’t seem like a
>> blaring red warning light is called for.  In terms of this document, the
>> content is probably mostly OK if we reframe it in that light.  Obsoleting
>> SDES and marking it Historic, though, is over the top; it will just create
>> unnecessary consternation.
>>
>
> I'm not really following your argument here. We all agree that (1) SDES is
> bad (2) We have better alternatives in the form of DTLS-SRTP and
> (eventually) MLS-SRTP. So, precisely what harm is it doing to tell people
> that and that they shouldn't use SDES in favor of that. "consternation" is
> not a real harm.
>

We agree with regard to the future.

What are operators of existing systems using SDES supposed to take away
from this?  This is not like say the SSLv3 deprecation where we had new
data (POODLE) that changed the posture of these systems.  Systems based on
SDES are as secure / insecure as they ever were.  So what I'm worried about
is (a) the IETF looking alarmist for marking a bunch of things insecure
that are actually fine, and (b) to the degree the deprecation is taken
seriously, creating a bunch of work to upgrade from SDES to a flavor of
DTLS-SRTP that is not enough better to merit the effort.

--Richard

>
> -Ekr
>
>
>> --Richard
>>
>> On Tue, Jul 27, 2021 at 7:08 PM John Mattsson <john.mattsson=
>> 40ericsson.com@dmarc.ietf.org> wrote:
>>
>>> westhawk thp@westhawk.co.uk wrote:
>>>
>>>
>>>
>>> >> On 26 Jul 2021, at 23:30, Kirsty P <Kirsty.p=40ncsc.gov.uk@dmarc.ietf.org> <&lt;Kirsty.p=40ncsc.gov.uk@dmarc.ietf.org&gt;> >wrote:
>>>
>>> >>
>>>
>>> >> SDP Security Descriptions is NOT RECOMMENDED and Historic: consensus was >sub-optimal. There was support for revisiting the space currently standardised >by SDP, but not on direction (whether to do a deprecation with/without >replacement). Future paths suggested included: mmusic, a new WG, more work >required for it to be ready, or a BoF (said in chat) to vet the idea further.
>>>
>>> >My sense is that there was a rough consensus around a goal to make it possible >to deprecate SDES - but the required steps were unclear.
>>>
>>>
>>>
>>> Yes, looking at the Jabber log there was quite strong support for the
>>> goal of deprecating SDES:
>>>
>>>
>>>
>>> Eric Rescorla: Let's all just agree that this (Mattson's SDES) draft is
>>> a good idea and promote it to full standard toda
>>> Martin Thomson: now that I see John presenting this, I have to wonder:
>>> why didn't this deprecation happen before?
>>> Sean Turner: When Dan Wing got up and said not to use SDES in Berlin - I
>>> assumed that was that ;)
>>> Pete Resnick: Why "NOT RECOMMENDED" instead of "MUST NOT"?
>>> Sean Turner: +1 to what ekr said
>>> Rich Salz: +1 also
>>>
>>>
>>>
>>>
>>>
>>> Regarding the next required steps I agree with Pete. Let’s charter.
>>>
>>>
>>>
>>> Ben Kaduk: So is this dispatch to BoF, or straight to WG?
>>>
>>> Pete Resnick: @ben: Sounds like this discussion has done the equivalent
>>> of BoFing. Charter.
>>>
>>>
>>>
>>> Cheers,
>>>
>>> John
>>> _______________________________________________
>>> dispatch mailing list
>>> dispatch@ietf.org
>>> https://www.ietf.org/mailman/listinfo/dispatch
>>>
>> _______________________________________________
>> dispatch mailing list
>> dispatch@ietf.org
>> https://www.ietf.org/mailman/listinfo/dispatch
>>
>

Re: [dispatch] DISPATCH IETF 111 meeting - preliminary outcomes and draft minutes