Re: [saag] Additions to RFC 3631?

[Mouse <[e-mail]>]

>> If the point of a mandatory-to-implement mechanism is
>> interoperability, allowing it to be disabled is a bad idea; it has
>> pretty much the same effect on interoperability as not having it
>> there in the first place: peers cannot count on its availability
>> when speaking with peers they have no particular knowledge of.
> How would you propose to handle the situation where an MTI algorithm
> is found to be vulnerable?

Disable it.

That is to say, I would scrap the mandatory-to-implement part, not the
allow-disabling part.  Besides, after technology has marched on for
five - or ten, or twenty - years, today's best is likely to look
utterly ludicrous.  Time was, crypt(1) - a one-rotor Enigma machine,
basically - actually provided a useful level of security.  Today, it's
what Schneier calls `kid sister' crypto, at best.  Mandatory-to-offer
algorithms lead to forcing people to choose between ignoring the spec
and running grossly insecure algorithms, while allowing disabling of
mandatory-to-implement algorithms breaks most of the point of
mandatory-to-implement.

/~\ The ASCII				  Mouse
\ / Ribbon Campaign
 X  Against HTML		[e-mail]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B