Re: [saag] Possible backdoor in RFC 5114

[Tero Kivinen <[e-mail]>]

Watson Ladd writes:
> The IANA registry cites 5903, not 5114, for these groups, so
> historifying 5114 would have no effect. I'm not entirely sure what
> historifying does to registries in terms of marking DO NOT USE: maybe
> a separate draft is required.

Moving document to historic does not change anything in the IANA
registries. To make changes to the IANA registries, you need separate
document, IESG action, or designated expert agreeing on change,
depending on the registry. And the IANA registries do not give
recommendations whether algorithm is good to use be used or not, and
adding such thing to IANA registries would be bad idea.

The IANA IKEv2 registry still includes algorithms like 768-bit MODP
Group, and single DES. It does not mean that you are fine using those. 

IANA registries are not saying that you should or should not implement
certiain algorithms, they provide mappings between numbers,
identifiers and specifications. 

> I am not a process expert. Furthermore in at least some cases the
> IKE registries get used by people hunting for DH parameters. Do we
> need a draft here? What should that look like?

IKE registries are supposed to be used for protocols related to IKE.
If other people use them for other reasons, there is nothing we can do
for that.

> It's not SHOULD NOT. It's "using these groups even outside of IKE will
> result in pwnage". Do you agree we need a stronger warning about known
> bad cryptographic constructions? What do you think that should look
> like?

In IPsec we do publish warnings and recommendations in the separate
documents (rfc4307bis and rfc7321bis, work in progress). And
rfc4307bis do contain SHOULD NOT for those groups, and gives reason
for that.

If you think wider warning is really need, you can write document
saying rfc5114-die-die-die, and get that published. That will not
still remove RFC5114, at best it could be moved to historic if other
people agree with you, but that still does not affect the fact that
people still might use that rfc5114 as reference.

Regardless what we do we cannot protect people from making mistakes.
If they want to make weak crypto, there is nothing we can do. I am
pretty sure that even if they use RFC5114 groups, those groups are not
the weakest point in their protocol. 

Btw, can you point me the reference which says that those groups are
really backdoored? What I have seen is people saying that as those
might be backdoored, they must been backdoored, and I myself do not
find that very convincing argument. On the other hand as there is no
seed etc published on how those groups are generated, they might be
backdoored, and I think that is good reason for SHOULD NOT for IPsec.
-- 
[e-mail]