Re: [saag] AD review of draft-iab-crypto-alg-agility-06

[Viktor Dukhovni <[e-mail]>]

On Tue, Aug 25, 2015 at 11:13:44AM -0700, Martin Thomson wrote:

> However, if we expect software to be updated in order to get
> opportunistic security, then I don't think it unreasonable to also
> expect it to be maintained on an ongoing basis.

And SMTP servers are updated from time to time, but the refresh
cycles are fairly long and the incentives to care about encryption
are not great.

If we want people to encrypt for the common good, despite lack of
apparent benefit to them, we must not erect barriers to adoption
in the form of interoperability problems.  Obsoleting mainstream
ciphers has a major interoperability impact and takes time,
(especially RC4 which was rumoured better than CBC after CRIME and
BEAST, was the best cipher in Windows 2003, and outperformed the
alternatives in the absense of hardware support).

What RFC 7435 says is that OS systems can be more tolerant of
deprecated algorithms when interoperability considerations trump
the security analysis.  Such tolerance is not forever.

> If you accept that software that is updated once can be continuously
> maintained thereafter, then it's not a stretch to conclude that
> deploying good ciphers is equally feasible.

Deployment of good ciphers is taking place, slowly.  In the mean-time,
there's email to be delivered, and users who rightly expect OS to
not get in the way.  Encryption is a nice-to-have.

    * Deliver the email
    * Encrypt if possible (RFC 3207, 7435)
    * Authenticate when requested by the peer
      (RFC 7435, SMTP DANE draft).

In practice, OS is working quite well, Google's outbound mail (which
is much less dominated by bulk mail ads than their inbound mail)
is now ~81+% encrypted, up from ~77% a year ago:

    https://www.google.com/transparencyreport/saferemail/

-- 
	Viktor.