Re: [kitten] [Curdle] I-D Action: draft-ietf-curdle-des-des-des-die-die-die-03.txt

[Jeffrey Altman <[e-mail]>]

I will confirm the Heimdal dates.

AES was added to Heimdal's source tree on Jul 23 13:00:42 2003 and
support for the krb5 AES OIDs were added on Apr 26 21:08:01 2004.  The
0.7 release is the first tagged release to include the AES OIDs.  The
tag was applied on Jun 16 16:23:19 2005.

Jeffrey Altman



On 6/16/2017 12:07 AM, Benjamin Kaduk wrote:
> Hi everyone,
> 
> As far as I know, this version is ready to be sent to the IESG for
> approval.
> 
> The -03 adds this text (including known typo):
> 
>    Fortuntately, modern (i.e., supported) Kerberos implementations
>    support a secure alternative to RC4, in the form of AES.  Windows has
>    supported AES since 2007-2008 with the release of Windows Vista and
>    Server 2008, respectively; MIT Kerberos [MITKRB5] has fully supported
>    AES (including the GSSAPI mechanism) since 2004 with the release of
>    version 1.3.2; Heimdal [HEIMDAL] has fully supported AES since 2005
>    with the release of version 0.7.  Though there may still be issues
>    running ten-year-old unsupported software in mixed environments with
>    new software, issues of that sort seem unlikely to be unique to
>    Kerberos, and the aministrators of such environments are expected to
>    be capable of devising workarounds.
> 
> It would be good to get independent confirmation of those
> dates/release numbers; the windows ones I took from Michiko's email
> and the Heimdal one from Chaskiel's mail.  (I did the MIT research
> myself, and picked 1.3.2 to include the GSSAPI mechanism instead of
> 1.3 which had the bare enctype.)
> 
> Thanks,
> 
> Ben
> 
> 
> 
> On Thu, Jun 15, 2017 at 09:01:48PM -0700, [e-mail] wrote:
>>
>> A New Internet-Draft is available from the on-line Internet-Drafts directories.
>> This draft is a work item of the CURves, Deprecating and a Little more Encryption of the IETF.
>>
>>         Title           : Deprecate 3DES and RC4 in Kerberos
>>         Authors         : Benjamin Kaduk
>>                           Michiko Short
>> 	Filename        : draft-ietf-curdle-des-des-des-die-die-die-03.txt
>> 	Pages           : 9
>> 	Date            : 2017-06-15
>>
>> Abstract:
>>    The 3DES and RC4 encryption types are steadily weakening in
>>    cryptographic strength, and the deprecation process should be begun
>>    for their use in Kerberos.  Accordingly, RFC 4757 is moved to
>>    Obsolete status, as none of the encryption types it specifies should
>>    be used, and RFC 3961 is updated to note the deprecation of the
>>    triple-DES encryption types.
>>
>>
>> The IETF datatracker status page for this draft is:
>> https://datatracker.ietf.org/doc/draft-ietf-curdle-des-des-des-die-die-die/
>>
>> There are also htmlized versions available at:
>> https://tools.ietf.org/html/draft-ietf-curdle-des-des-des-die-die-die-03
>> https://datatracker.ietf.org/doc/html/draft-ietf-curdle-des-des-des-die-die-die-03
>>
>> A diff from the previous version is available at:
>> https://www.ietf.org/rfcdiff?url2=draft-ietf-curdle-des-des-des-die-die-die-03
>>
>>
>> Please note that it may take a couple of minutes from the time of submission
>> until the htmlized version and diff are available at tools.ietf.org.
>>
>> Internet-Drafts are also available by anonymous FTP at:
>> ftp://ftp.ietf.org/internet-drafts/
>>
>> _______________________________________________
>> Curdle mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/curdle
> 
> _______________________________________________
> Kitten mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/kitten
>