Re: [lamps] Request for review of revised RFC 5759

[Stephen Farrell <[e-mail]>]

Hiya,

I commented on making the suite-b profiles historic on the IETF
discuss list. (Probably better to keep that discussion on that
list and not here - thread is at [1], but briefly I suggested we
not do another suite-b-like exercise within the IETF.)

Russ asked me to take a peek at this draft as part of some
offlist discussion about that.

Generally the content of the draft seems reasonable. If it is the
case that the choices in this profile are widely implemented (and
I'm guessing they are), then I would support a profile with such
content being processed as a BCP (and hence coming under IETF change
control).

If there is a real need to retain change control and keep this as
a national profile, then see my opinion on [1], I'm not supportive
of that. (But in this case, as the content seems to not involve
any "innovative" or odd choices, and if done via the ISE, I'm only
very very mildly opposed - almost neutral:-)

I'd encourage the authors to consider if they need an RFC that is
not under IETF change control for this content. I can't see how
that'd be beneficial tbh but maybe I'm missing something. And if
the content had IETF consensus, then I'd guess that'd help in terms
of getting implementations that match the profile more quickly.

If there are other documents to come, that do make "innovative"
choices (e.g. algs or params that are not widely implemented),
then I think even a national profile for that published via the
ISE is a bad idea, (but again, discussion of that via [1] is
better).

Cheers,
S

[1] https://www.ietf.org/mail-archive/web/ietf/current/msg106634.html

On 31/01/18 20:59, Michael Jenkins wrote:
> The US National Security Agency (NSA) has begun the process of updating
> the "Suite B for..." RFCs to define requirements for implementing and
> configuring IETF protocols in compliance with the 2016 revision of
> CNSSP-15 (the Commercial National Security Algorithm, or CNSA, suite).
> These RFCs are intended for use by commercial product vendors who wish
> their products to be used in US National Security Systems, over which
> NSA has oversight.
> 
> As part of this process, the older RFCs will be moved to Historical
> status, and we plan to publish new RFCs via the ISE. We are seeking
> review and comment of the drafts prior to publication, and so will be
> announcing the drafts on appropriate mail-lists as we produce them.
> 
> The first draft updates RFC 5759, and addresses requirements for RFC
> 5280 compliant public-key certificates and CRLs that contain or
> reference algorithms in the CNSA suite. It is available at
> <https://www.ietf.org/internet-drafts/draft-jenkins-cnsa-cert-crl-profile-01.txt>.
> We would appreciate any comments you might have regarding the draft,
> either via the mail-list or via direct reply.
> 
> 
> Mike Jenkins <[e-mail]>
> Lydia Zieglar <[e-mail]>
> NSA
> 
> 
> 
> _______________________________________________
> Spasm mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/spasm
>