Re: [saag] AD review of draft-iab-crypto-alg-agility-06

[Stephen Farrell <[e-mail]>]

Viktor,

(Here we are back at this argument again:-)

On 25/08/15 17:06, Viktor Dukhovni wrote:
> In any case, whether it is RC4 now, or some other deprecated
> ciphersuite in the futre, with opportunistic security one needs to
> pay more attention to what interoperates than what is unequivocally
> strong.  The goal is as much security as can be realistically had,
> not "all or nothing".  I like to make an analogy with vaccination,
> we're protecting the infrastructure as a whole, rather guaranteed
> security for a particular flow.

Do you agree though that there are at least two points in time
involved when considering weakened or suspect ciphers?

There is the time you're discussing of when the bad algorithm
can be turned off without damaging interop of ciphertext form
packets.

But there is also the time after which one considers that all
such ciphertext will in a short while be almost the same as
plaintext for a capable attacker.

And the latter can happen before the former.

My argument (for which I still think I'm in the rough) is that
when we get to that 2nd point in time, one ought no longer use
a cipher even in OS mode.

Yes, that's a trade off, as are all OS arguments. For me the
continued use of a cipher that is that weakened is worse overall,
as that cipher is liable to be used in more environments that just
one. And yes, that does mean that some packets will be sent in
clear that would otherwise not be, but it also means that some
software will be updated sooner and hence other packets will be
sent as better ciphertext.

(And btw: In the specific case of RC4 the IETF does have consensus
to deprecate that already [1], even if the mail community let that
go by while pretending it wasn't happening:-)

Cheers,
S.

[1] https://tools.ietf.org/html/rfc7465