Last Call: <draft-ietf-krb-wg-des-die-die-die-04.txt> (Deprecate DES, RC4-HMAC-EXP, and other weak cryptographic algorithms in Kerberos) to Best Current Practice

The IESG <iesg-secretary@ietf.org> Sun, 25 March 2012 12:24 UTC

Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
From: The IESG <iesg-secretary@ietf.org>
To: IETF-Announce <ietf-announce@ietf.org>
Subject: Last Call: <draft-ietf-krb-wg-des-die-die-die-04.txt> (Deprecate DES, RC4-HMAC-EXP, and other weak cryptographic algorithms in Kerberos) to Best Current Practice
Message-ID: <20120325122420.28510.3967.idtracker@ietfa.amsl.com>
Date: Sun, 25 Mar 2012 05:24:20 -0700
Cc: ietf-krb-wg@lists.anl.gov
Precedence: list
Reply-To: ietf@ietf.org

This is a repeat last call, just to include the downref (omitted by a careless AD:-)

The IESG has received a request from the Kerberos WG (krb-wg) to consider
the following document:
- 'Deprecate DES, RC4-HMAC-EXP, and other weak cryptographic algorithms
   in Kerberos'
  <draft-ietf-krb-wg-des-die-die-die-04.txt> as a Best Current Practice

The IESG plans to make a decision in the next few weeks, and solicits
final comments on this action. Please send substantive comments to the
ietf@ietf.org mailing lists by 2012-04-08. Exceptionally, comments may be
sent to iesg@ietf.org instead. In either case, please retain the
beginning of the Subject line to allow automated sorting.

Abstract


   The Kerberos 5 network authentication protocol, originally specified
   in RFC1510, can use the Data Encryption Standard (DES) for
   encryption.  Almost 30 years after first publishing DES, the National
   Institute of Standards and Technology (NIST) finally withdrew the
   standard in 2005, reflecting a long-established consensus that DES is
   insufficiently secure.  By 2008, commercial hardware costing less
   than USD 15,000 could break DES keys in less than a day on average.
   DES is long past its sell-by date.  Accordingly, this document
   updates RFC1964, RFC4120, RFC4121, and RFC4757 to deprecate the use
   of DES, RC4-HMAC-EXP, and other weak cryptographic algorithms in
   Kerberos.  Because RFC1510 (obsoleted by RFC4120) supports only DES,
   this document reclassifies RFC1510 as Historic.

The file can be obtained via
http://datatracker.ietf.org/doc/draft-ietf-krb-wg-des-die-die-die/

IESG discussion can be tracked via
http://datatracker.ietf.org/doc/draft-ietf-krb-wg-des-die-die-die/ballot/


No IPR declarations have been submitted directly on this I-D.

   There is
   a downward reference to RFC 4757 in order to deprecate an algorithm
   specified in that RFC; this downward reference is appropriate
   because reclassifying RFC 4757 as standards track is not desired.

Last Call: <draft-ietf-krb-wg-des-die-die-die-04.… The IESG
Last Call: <draft-ietf-krb-wg-des-die-die-die-04.… The IESG