Re: [saag] AD review of draft-iab-crypto-alg-agility-06

[Viktor Dukhovni <[e-mail]>]

On Mon, Jul 27, 2015 at 08:54:50PM +0100, Stephen Farrell wrote:

> According to the above, 1DES and export ciphers would be completely
> out of the question. And rc4 is getting really really close.

The good news is that we don't need to agree on why they should no
longer be supported.  They are weak, and it is not supporting them
has no practical downside.  So they can go regardless of the
rationale.

I expect that by the time an algorithm supports practical
general-purpose offline plaintext recovery (which is a stronger
attack than the RC4 recovery of fixed plaintexts at fixed message
offsets sent millions of times) it will generally no longer be in
wide use, or will be in the process of rapid retirement.

So one way to put your argument is that if an algorithm goes from
safe to broken unexpectedly quickly and is not already in the
process of being phased out, it should be rapidly supplanted by a
better algorithm, allowing the broken algorithm to be rapidly phased
out, and as it is no longer needed for interop, it can be dropped
by OS clients.

So while we may disagree about what to do with RC4 in OS email
today, I agree that we'd let "export" and SSLv2 stick around longer
than necessary, and so in Postfix we've dropped these and 1-DES
and SSLv3, because we can and therefore should do so in a reasonably
timely manner.

-- 
	Viktor.