Re: [Uta] Depreciation (was Re: Adoption of draft-rsalz-use-san)

[Hubert Kario <[e-mail]>]

On Friday, 19 March 2021 15:12:25 CET, Eliot Lear (elear) wrote:
>
>> On 19 Mar 2021, at 12:20, Hubert Kario <[e-mail]> wrote:
>> 
>> it's also a place that needs to keep on moving forward as new attacks and
>> more powerful computers come into light every year
>
> Sure.  That’s why I support the draft.
>
>> 
>>>> which nothing short of
>>>> MUST NOT seems to get across.
>>> 
>>> Why would you think that in this case?  The IEEE has been 
>>> remarkably good at tracking our work, as have a  great many 
>>> other organizations, but for uses you’ve never considered.  
>>> That’s why code like OpenSSL is deployed in places you’ve 
>>> never heard of.  And while you’re right, we’re not the 
>>> protocol police, it’s bad when we give developers advice they 
>>> simply cannot follow because they live in the real world.
>> 
>> they also need to accept the reality that their use-case is a niche use
>> case for the whole ecosystem, so not all things will align nicely and not
>> all advice will be applicable to them
>
> Is it?  There are hundreds of millions of devices that cover 
> this use case, and that number is accelerating.

and how it's a good thing that the number of devices that can't have their
software updated is accelerating?

>> 
>> so maybe, we should give them a little bit of credit and 
>> assume that they are
>> able to differentiate stuff that makes sense in their context from stuff
>> that's applicable to the web in general
>
> And herein lies the problem: either this document is intended 
> for the “web” or it is intended to be general.  The two are not 
> the same.  I like scoping this document broadly, though, to mark 
> what is currently a best practice.  And THEN you can give those 
> people credit for doing the right thing, because they largely 
> have in the past.
>
> To be clear: this is a bit of a juggernaut.  The idea that a 
> device identity survives through the entire lifetime of a device 
> very much depends on what that lifetime is.  Toys and IT 
> equipment have 3-5 year lifetimes.  Some sensors have six week 
> lifetimes.  Some stuff in the ground has 40-50 year lifetimes, 
> and some mechanical tools like presses have 120 year lifetimes.
>
> So sure.  802.1AR is going to need to evolve around these 
> concepts.  But let’s please just recognize the reality we face, 
> that the currently deployed systems are going to be around for 
> quite a while, they will continue to verify as they do, and 
> their certs won’t change, at least for onboarding purposes.

the whole point of it is to say: this is how you this TLS stuff,
if you don't do it like this, you really should have a good excuse

but it's not IETF job to find those excuses, and it's not IETF job to
ensure that you're able to use IETF protocols, unchanged, for 50
years

now, just because you have an excuse, doesn't mean you don't have a
liability, just like the people that run lathes or presses using
Windows 95 PCs
-- 
Regards,
Hubert Kario
Senior Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 115, 612 00  Brno, Czech Republic