Re: [saag] Section 2.9: was Re: AD review of draft-iab-crypto-alg-agility-06

[Viktor Dukhovni <[e-mail]>]

On Tue, Sep 01, 2015 at 11:09:23PM -0400, Kathleen Moriarty wrote:

> I think the proposed text is a lot better than what was there and I think
> there is consensus around it.  Once you get more specific, then you are
> moving away from what was agreed upon in the OS draft.  Doing that would
> require quite a bit more discussion.
> 
> The proposed text reads well to me and keeps us more consistent - use of
> weaker crypto for OS is limited to legacy deployments and is not okay for
> authenticated and encrypted sessions for OS, just unauthenticated.  If
> you have a proposal for text that keeps within the space where I think we
> have consensus, then I'm okay with change otherwise I'm not.  It might
> take reading through this draft and the OS RFC, once that has been done,
> this text makes sense... Reading big through the discussion on this over
> the past week or so may help as well.

I am not saying the proposed text is wrong on its substance, rather
I am a somewhat concerned about what seems to be misplaced emphasis.
I think Sam agrees along essentially the same lines.

I've not suggested a specific remedy, just throwing ideas out there
and hoping they might be useful.

In part I don't think I should be the only one doing all the
explaining of OS, it is best if others can make additional
contributions to the formulation of a refined consensus in this
area.

It would I think be better to note that OS (when unauthenticated
and provies only passive protection) is not fundamentally about
use of weaker crypto.  Rather it is about doing as much better than
cleartext as one can, and agility is helpful, but more quickly on
the uptake of new algos than deprecation of legacy algos, because
interop considerations and avoiding cleartext trump the urgency of
deprecating weak crypto.

That said, that's just how I see it, and I don't want force my
formulation on everyone else, so if there are other ways to improve
the text (change of emphasis) that's fine.

-- 
	Viktor.