IETF Logo Mail Archive

Re: [saag] AD review of draft-iab-crypto-alg-agility-06

Viktor Dukhovni <ietf-dane@dukhovni.org> Mon, 24 August 2015 21:56 UTC

Return-Path: <ietf-dane@dukhovni.org>
X-Original-To: saag@ietfa.amsl.com
Delivered-To: saag@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0A1B61B32BE for <saag@ietfa.amsl.com>; Mon, 24 Aug 2015 14:56:31 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.6
X-Spam-Level:
X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_LOW=-0.7] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8jca3KXwyjs7 for <saag@ietfa.amsl.com>; Mon, 24 Aug 2015 14:56:29 -0700 (PDT)
Received: from mournblade.imrryr.org (mournblade.imrryr.org [38.117.134.19]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B336C1B32BB for <saag@ietf.org>; Mon, 24 Aug 2015 14:56:29 -0700 (PDT)
Received: by mournblade.imrryr.org (Postfix, from userid 1034) id 9BFF8284D64; Mon, 24 Aug 2015 21:56:28 +0000 (UTC)
Date: Mon, 24 Aug 2015 21:56:28 +0000
From: Viktor Dukhovni <ietf-dane@dukhovni.org>
To: saag@ietf.org
Message-ID: <20150824215628.GP9021@mournblade.imrryr.org>
References: <20150727194020.GD15860@localhost> <55B6D36C.70105@iang.org> <20150728013020.GO4347@mournblade.imrryr.org> <DM2PR0301MB0655CF099FA7C56E9B9D24A9A88D0@DM2PR0301MB0655.namprd03.prod.outlook.com> <20150728053035.GR4347@mournblade.imrryr.org> <CAHbuEH7B3_G9vAhw=U2tuz-Uh8mKMUfL6s=H+BOG96FDZaACig@mail.gmail.com> <20150824212907.GN9021@mournblade.imrryr.org> <619ffebb05ba4e2a9af03a6dcc768d6e@ustx2ex-dag1mb2.msg.corp.akamai.com> <846AD897-C38F-4528-849D-B98B2D87798B@gmail.com> <b27927b4fb7d41b28a9bb7695971501f@ustx2ex-dag1mb2.msg.corp.akamai.com>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <b27927b4fb7d41b28a9bb7695971501f@ustx2ex-dag1mb2.msg.corp.akamai.com>
User-Agent: Mutt/1.5.23 (2014-03-12)
Archived-At: <http://mailarchive.ietf.org/arch/msg/saag/I8x4SrDxqdKiFhKfByhiqjHbvVw>
Subject: Re: [saag] AD review of draft-iab-crypto-alg-agility-06
X-BeenThere: saag@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
Reply-To: saag@ietf.org
List-Id: Security Area Advisory Group <saag.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/saag>, <mailto:saag-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/saag/>
List-Post: <mailto:saag@ietf.org>
List-Help: <mailto:saag-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/saag>, <mailto:saag-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 24 Aug 2015 21:56:31 -0000

On Mon, Aug 24, 2015 at 09:40:22PM +0000, Salz, Rich wrote:

> > I agree this is the problem/poster child for this discussion.  I'd rather phrase it
> > that in some cases, deprecated crypto will be used when libraries/software
> > can't be updated rather than saying it's okay because it falls into OS.  But this
> > may just be me.
> 
> It's not just you. :)

Actually, both OS and legacy are necessary conditions.

If it is not OS, and is supposed to deliver strong rather than
best-effort security, then legacy or not, deprecated algorithms
need to be phased out rapidly.

If it is OS, and not legacy, then again no deprecated algorithms.
However OS + legacy (which implies impracticality of fast Internet-wide
upgrade) then obsolete algorithms linger-on for a while, but
eventually disappear from OS too, once hardware refresh cycles take
care of the laggards.

We've eliminated EXPORT crypto, DES, SSL 2.0 and SSL 3.0 for OS
for SMTP.  We've not yet eliminated RC4-SHA, but will I think in
a couple of years.

-- 
	Viktor.

v2.23.0 | Report a Bug | By Email