Re: [saag] AD review of draft-iab-crypto-alg-agility-06

[Viktor Dukhovni <[e-mail]>]

On Mon, Aug 24, 2015 at 04:31:16PM -0400, Kathleen Moriarty wrote:

> The first sentence in this section counters what Viktor is saying was
> intended in the OS RFC (per this thread), that this provision should
> only apply to legacy systems.  When protocols are designed,
> appropriate crypto should be specified.  Then it is better to use
> outdated rather than nothing later on in deployment cycles.  Others
> added in additional caveats to the general statement, so I don't think
> we really have consensus on this set of points.

Yes.  OS is supposed to enable a transparent "upgrade" from cleartext
to encryption (possibly with peer authentication).

With *legacy* protocols, when negotiating unauthenticated opportunistic
encryption, it is important to not exclude recently obsoleted
algorithms that are still needed for interoperability lest failing
to offer them cause communications failure or needless use of
cleartext.

When designing new protocols, it makes sense to set a realistic
floor that excludes already deprecated crypto, and then not supporting
the obsolete algorithms does not risk failure to communicate or
needless use of cleartext.

-- 
	Viktor.