Re: [TLS] I-D Action: draft-ietf-tls-prohibiting-rc4-01.txt

[Paul Lambert <[e-mail]>]

]Before RC4 becomes MUST NOT, it needs to first become a low priority
]algorithm that is used when nothing better is available.

We are over thinking the presumed interoperability concerns.

There are no RFC police to enforce SHOULD versus MUST. There
will not be a red-flag day when RC4 is apparently turned off 
with a "MUST NOT" in a document from this group. 

A 'SHOULD NOT' recommendation is readily ignored. There is no
clear guidance, only a suggestion.  Guidance on industry practice
for such a feature is very important to help determine diligence
of an implementation to follow recommended industry practice.

A 'MUST NOT', could be ignored, but installations that are audited
for compliance to "recommended industry practice" would be dinged.
This introduces potential liability and financial risks that would
encourage the removal of RC4.

'SHOULD NOT' carries no incentive for change.
'MUST NOT' provides clear guidance and incentive that will still 
take many years to be adopted fully.


Paul