Re: [saag] Section 2.9: was Re: AD review of draft-iab-crypto-alg-agility-06

[Russ Housley <[e-mail]>]

Viktor:

> On Thu, Sep 03, 2015 at 04:08:59PM -0400, Russ Housley wrote:
> 
>>> It can be a sentence or two, just enough to not give the impression
>>> that weak crypto is preferred with OS.
>> 
>> The words in my current edit buffer are:
>> 
>>   Despite the guidance in Section 2.4, opportunistic security [RFC7435]
>>   also deserves consideration, especially at the time a protocol
>>   implementation is deployed and configured.  Using algorithms that are
>>   weak against advanced attackers but sufficient against others is one
>>   way to make pervasive surveillance significantly more difficult.  As
>>   a result, algorithms that would not be acceptable in many negotiated
>>   situations are acceptable for opportunistic security when legacy
>>   systems are in use for unauthenticated encrypted sessions as
>>   discussed in Section 3 of [RFC7435] as long as their use does not
>>   facilitate downgrade attacks.  Similarly, weaker algorithms and
>>   shorter key sizes are also acceptable for opportunistic security with
>>   the same constraints.  That said, the use of strong algorithms is
>>   always preferable.
>> 
>> Would it help to change "As a result" to "As a result, when communicating
>> parties do not have strong algorithms in common"?
> 
> You're heading in the right direction, but I think this is a sentence
> or so too late.  The sentence that starts with "Using algorithms
> that are weak ..." is troublesome.  How about:
> 
>    Using the strongest available encryption (even if not strong
>    enough for mandatory security) is one way ...
> 
> And then perhaps still make the additional change you're proposing.

Trying to pull the idea into the earlier part of the paragraph...

Current Text:

   Using algorithms that are weak against advanced attackers but
   sufficient against others is one way to make pervasive
   surveillance significantly more difficult.

Possible Alternative:

   Opportunistic security, like other reasons for encrypting traffic,
   needs to make use of the strongest encryption algorithms that are
   implemented and allowed by policy.  When communicating parties do
   not have strong algorithms in common, using algorithms that are
   weak against advanced attackers but sufficient against others is
   one way to make pervasive surveillance significantly more difficult.

Russ