Re: [saag] keys under doormats: is our doormat ok?

Eliot Lear <> Mon, 13 July 2015 16:20 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id 731B81A0370 for <>; Mon, 13 Jul 2015 09:20:13 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -14.511
X-Spam-Status: No, score=-14.511 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id J3bOgmzd1uno for <>; Mon, 13 Jul 2015 09:20:11 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id AF6241A00EC for <>; Mon, 13 Jul 2015 09:20:08 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple;;; l=2949; q=dns/txt; s=iport; t=1436804408; x=1438014008; h=message-id:date:from:mime-version:to:subject:references: in-reply-to; bh=GgiKeApX94CKH/EegG2Z5UYhICLYbEkenYbjSKUPdhw=; b=GmYyqYSUQMdWS6U/DHV2LSFhsIXZPeB0QmPftHuWFeKfOZW0BvuUf+e7 cgzmWYvddLdC6kCHssnYu66Ryad0qJjares+qBstLvK4+IdL1G9nCJ93+ XqLMKDevwjid1kstjsojUyDm3v7jfnQN1/wjK+vBSBJVVfIByZ04ne+iw 0=;
X-Files: signature.asc : 481
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-AV: E=Sophos;i="5.15,463,1432598400"; d="asc'?scan'208";a="558260665"
Received: from (HELO ([]) by with ESMTP; 13 Jul 2015 16:20:06 +0000
Received: from [] ( []) by (8.14.5/8.14.5) with ESMTP id t6DGK6Zp018683; Mon, 13 Jul 2015 16:20:06 GMT
Message-ID: <>
Date: Mon, 13 Jul 2015 18:20:05 +0200
From: Eliot Lear <>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:31.0) Gecko/20100101 Thunderbird/31.7.0
MIME-Version: 1.0
To: Stephen Farrell <>,, "" <>
References: <> <> <> <> <> <> <> <>
In-Reply-To: <>
Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="ELMKq7kUn7sViikLP28NC2aIBfO0HoNkc"
Archived-At: <>
Subject: Re: [saag] keys under doormats: is our doormat ok?
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Security Area Advisory Group <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Mon, 13 Jul 2015 16:20:13 -0000

Hi Stephen,

On 7/13/15 3:28 PM, Stephen Farrell wrote:
> Hiya,
> On 12/07/15 23:28, Dave Crocker wrote:
>> I will also suggest that we ought to have the IETF review of the draft
>> RFC for this include a segment at an IETF plenary. 
> Just as a point of information for those who're considering there
> may be external-to-the-IETF benefits in some form of renewal of
> the relevant content from RFC 1984...
> One reason I figured RFC 1984 is still ok is that the IAB have quite
> recently weighed in with an even stronger recommendation "that
> encryption be deployed throughout the protocol stack." [1] And while
> that's an IAB statement and hasn't been through the IETF consensus
> process, and while that doesn't directly touch on mandated-key-escrow-
> silliness, it does refer back to RFC 1984, as well as going further.

The reference to 1984 is in the IAB statement to demonstrate the
continuum of time that the IAB and IESG have considered this issue.  
There are some aspects of 1984 that could evolve.  Particularly the
rationale in the section entitled "PROTECTION OF THE EXISTING
INFRASTRUCTURE".  Encryption is required for there to be confidence in
the infrastructure.

> So I reckon that from a non-IETF perspective, [1] probably achieves
> as much as we'd achieve with any easy method of "renewing" RFC 1984.
> (I'm also not sure what "renewing" 1984 might mean exactly but I'm
> sure we could figure some mechanics that'd work and if it turns out
> I'm wrong above and folks do want some such thing, I'll of course
> try help get that done.)

I think Christian used the term "reaffirming".  Before we do that, we
people should really read through 1984 with a 2015 perspective.  The
document has held together well, even with a few issues.  But to
reaffirm would be to say that the 1996 world view is still applicable. 
I don't think it is.  I think we'd make a different statement today. 
Maybe this is what you mean by "renew".