Re: [saag] Section 2.9: was Re: AD review of draft-iab-crypto-alg-agility-06

Sent from my iPhone

On Sep 1, 2015, at 8:26 PM, Sam Hartman <hartmans-ietf@mit.edu> wrote:

>>>>>> "Russ" == Russ Housley <housley@vigilsec.com> writes:
> 
>>> I still think that the focus on just the weak(er) algorithms in
>>> OS is unfortunate.  Rather agility and OS work hand-in-hand to
>>> improve communications to the extent possible.  As new algorithms
>>> are deployed, opportunistic peers will autmatically start to use
>>> stronger cryptography.
>>> 
>>> Once new algorithms have largely displaced legacy algorithms, one
>>> can begin considering retirement of algorithms that used to be
>>> required for interoperability.  This process is likely to take
>>> longer for OS protocols/applications because interoperability
>>> carries greater weight when security is not a hard requirement
>>> and the alternative is cleartext.
>>> 
>>> So I'd like to see text that first emphasises the good news (over
>>> time agility improves the security of OS protocols).  Then the
>>> bad news (retirement of legacy crypto takes longer).  And finally
>>> notes that OS is not carte-blanche for weak crypto, new OS
>>> applications need to start with non-deprecated crypto, and legacy
>>> crypto needs to still be retired once no longer needed.
> 
>    Russ> The whole point of the document is to make it easy to migrate
>    Russ> from one algorithm suite to another more desirable one.
>    Russ> However, sometimes we want to keep an algorithm around that
>    Russ> would otherwise have been discarded to achieve opportunistic
>    Russ> security.  You seem to be trying to pull the points from the
>    Russ> rest of the document into this paragraph.
> 
> Russ, like Viktor, when I read the proposed text for section 2.9 I hear
> emphasis on supporting weak crypto for OS.  The text doesn't quite come
> out and say any of the following, but I find myself trying to come up
> with justifications for why I'd prefer weak crypto for OS.  Is it
> faster?  Is it more exportable?  By the time I get to the sentence that
> says stronger is still preferable, I'm so lost that it hardly registers.
> 
> I find the quoted paragraph sounds like it's trying to be more divergent
> with the rest of the document rather than complimentary.
> So, while perhaps literally doing what Viktor proposes and including all
> those points in 2.9 would be redundant, perhaps we can strive for
> something more consistent with his approach.
> 
> What the proposed text says is all consistent, it just reads wrong and
> at least to me and apparently Viktor implies things that I don't think
> we really mean.

I think the proposed text is a lot better than what was there and I think there is consensus around it.  Once you get more specific, then you are moving away from what was agreed upon in the OS draft.  Doing that would require quite a bit more discussion.

The proposed text reads well to me and keeps us more consistent - use of weaker crypto for OS is limited to legacy deployments and is not okay for authenticated and encrypted sessions for OS, just unauthenticated.  If you have a proposal for text that keeps within the space where I think we have consensus, then I'm okay with change otherwise I'm not.  It might take reading through this draft and the OS RFC, once that has been done, this text makes sense... Reading big through the discussion on this over the past week or so may help as well.

Thanks,
Kathleen 

> 
> I'm sorry I can't be more helpful.  I'm not trying to raise anything
> blocking, just hoping to help you better understand the explanation.
> 
> _______________________________________________
> saag mailing list
> saag@ietf.org
> https://www.ietf.org/mailman/listinfo/saag