Re: [IPsec] Ben Campbell's Yes on draft-ietf-ipsecme-rfc7321bis-05: (with COMMENT)

[<[e-mail]>]

> On Jun 19, 2017, at 11:16 AM, Eric Rescorla <[e-mail]> wrote:
> 
> 
> 
> On Mon, Jun 19, 2017 at 7:45 AM, Paul Wouters <[e-mail]> wrote:
> 
> Paul Wouters writes:
> -3: I wonder why "... is not to be used..." is not "... MUST NOT be
> used...". But the section goes on to say if you do it anyway, you MUST
> NOT use certain cryptosuites. So, does "... is not to be used..." mean
> "SHOULD NOT"? Or is this one of those "MUST NOT BUT WE KNOW YOU WILL"
> sort of requirements?
> 
> It is indeed. I think a SHOULD NOT would actually be appropriate ?
> 
> We do not want to make the implementation of the manual keying MUST
> NOT, as it is still useful in testing and similar situations, but we
> do not want anybody using it in any real world use cases. As this
> document is mostly about the implementation and tries to stay out from
> the issues about what should be used (as explained in the 2nd
> paragraph of the section 1.3).

I still prefer MUST NOT.  

If we're goint to use SHOULD NOT, it needs to be accompanied by very explicit wording that directs test labs and authors of certification requirements documents that they are forbidden from having manual keying in their certification requirements.  We currently have the issue that some uninformed certification requirements documents do exactly this: force implementers to implement something we KNOW is wrong.  We end up writing stuff in the user manual along the lines of "NEVER use this option -- it exists only because of a certification requirement".  This is absurd, and it has to stop.


> ...
> NEW text:
> 
> 3.  Manual Keying
> 
> Manual Keying SHOULD NOT be used as it is inherently dangerous.
> Without any keying protocol, it does not offer Perfect Forward
> Secrecy ("PFS") protection. Without IKE, another entity needs to
> ensure refreshing of session keys, tracking SPI uniqueness and
> ensuring nonces or IVs are not used more then once. This document
> was written for deploying ESP/AH using IKE ([RFC7296]) and assumes
> that keying happens using IKE version 2 or higher.

That's ok so far as it goes, but I don't believe it is sufficient to correc the previous agency errors.

	paul