Re: [kitten] draft-kaduk-kitten-des-des-des-die-die-die-01.txt

[tom p. <[e-mail]>]

----- Original Message -----
From: "Benjamin Kaduk" <[e-mail]>
To: "tom p." <[e-mail]>
Cc: <[e-mail]>
Sent: Wednesday, April 05, 2017 4:53 PM
> On Wed, Apr 05, 2017 at 04:43:46PM +0100, tom p. wrote:
> > From the title, I was expecting an equivalent to RFC7465 but that is
not
> > what this is; I think it should be.  Which WG is best placed to do
this,
> > I am easy about.
>
> I'm not sure I understand the question.  You are interested in
> prohibiting triple-DES cipher suites from use in TLS?  That would
> best be done in the TLS WG.
>
> This draft was given its name as a homage to RFC 6649, which AFAIK
> was the first document to use that construction.

Ah, I am not as well informed as you.  I first came across the name of
that form with RFC7465 and assumed that that was the one you were
following.

Having read RFC6649, I still think that RFC7465 is the way to do it.
The Abstract of that RFC gives me very clear guidance as to what to do.
This I-D I find less clear
"The 3DES and RC4 encryption types are steadily weakening in
   cryptographic strength ..."
leaves me wondering; would a dose of iron or vitamins restore their
strength?  Well, no:-) but I want clear guidance, not the evidence from
which I have to work out my own conclusions.

RFC7465 - wisely - avoids the word 'deprecate'; it tells users what to
do, what the advice of those more expert in the field is.  I have seen
discussions on several lists as to what the word 'deprecate' means, with
no consensus, no definition.  We do now have a definition in
leiba-cotton- -5226bis and since you are proposing to update IANA, then
that is the definition you are going to get, like it or lump it, so if
that is what you mean, you should have that as a Normative Reference; if
not, then I think that you should avoid the word 'deprecate' as RFC7465
does.

Tom Petch

> -Ben