Subject: CONCENSUS CALL: AES-128 vs. 256, *again*

From: Jeffrey Hutzelman <[email-masked]>
Date: Fri, 06 Aug 2004 16:15:54 -0700

On Thursday, July 22, 2004 16:50:44 -0500 Nicolas Williams 
<[email-masked]> wrote:

> We've had this discussion before.  Solaris will have AES-256 unbundled,
> and AES-128 instead.
>
> AES-128 is not even mentioned in
> draft-ietf-krb-wg-kerberos-clarifications-06.txt!
>
> I don't care if only AES-256 is required, but support for AES-128 must
> be recommended for interop.

It looks like there will be another revision of kerberos-clarifications, to 
resolve a few remaining IESG issues and deal with other minor changes we've 
accumulated since -06 was published.

We discussed the AES128 issue at the working group meeting, and the sense 
of the room was that we should add AES-128 as a RECOMMENDED enctype in 
kerberos-clarifications as part of this revision.

This will be the last revision of kerberos-clarifcations, and will be 
submitted early next week -- the editing work is already done.

Again, we need a working group concensus to support this change, so I am 
asking participants to please indicate support for or opposition to this 
addition.

Thanks...

-- Jeff

---

From: Nicolas Williams <[email-masked]>
Date: Fri, 6 Aug 2004 18:36:38 -0500

Wyllys and I are in favor of adding AES-128 to the list of RECOMMENDED
enctypes in clarifications.

Nico
--

---

From: Sam Hartman <[email-masked]>
Date: Fri, 06 Aug 2004 21:29:39 -0400

>>>>> "Jeffrey" == Jeffrey Hutzelman <[email-masked]> writes:

    Jeffrey> It looks like there will be another revision of
    Jeffrey> kerberos-clarifications, to resolve a few remaining IESG
    Jeffrey> issues and deal with other minor changes we've
    Jeffrey> accumulated since -06 was published.

    Jeffrey> We discussed the AES128 issue at the working group
    Jeffrey> meeting, and the sense of the room was that we should add
    Jeffrey> AES-128 as a RECOMMENDED enctype in
    Jeffrey> kerberos-clarifications as part of this revision.

This is an addition to the should support, not the must support set.
If so, I support this change.