Re: [Tcpcrypt] Initial questions

[Stephen Farrell <[e-mail]>]

Hiya,

On 24/06/14 21:22, Sandy Harris wrote:
>> > I can say that failure to accommodate alg agility will almost certainly
>> > cause the IESG to reject this as a standard, based on precedents
>> > for some time.
>
> OK, we need some agility, both because it is a good safety measure
> and because IESG will likely insist.

Planning for what to do on the basis of what the IESG might
conclude at this level of detail is not a great plan. For
example, by the time the spec reaches the IESG the relevant
folks may have changed (I'm one of 'em for now btw) and/or
opinions as to the desirable mechanisms for algorithm
agility could have changed somewhat.

> 
> BUT the fewer choices there are, the simpler the protocol can be.
> That has costs in "design, implementation, testing & auditing" &
> extra options may mean a risk of downgrade attacks.

There is a separate (sporadic) discussion on the saag list about
this. [1] Russ has written a draft trying to capture algorithm
agility in the form of a BCP. iang isn't keen but may so far be
in the rough. OTOH, we do have issues - its just dumb that there
are 300+ TLS ciphersuites, even with the combinatoric explosion,
and then there's vanity/national crypto as well that might also
be thought of differently here, or not, we'll see.

So basically, I'd say leave this one until the WG which I hope
will be formed very shortly gets to discussing its protocol
details. And at that point I hope we see an argument about what's
the right thing to do.

S.