Subject: Re: [Ietf-krb-wg] I-D Action:draft-lha-des-die-die-die-00.txt

From: Simon Josefsson <[email-masked]>
Date: Fri, 31 Jul 2009 17:12:36 +0200

I support this document.  Quick review:

It would help to list the DES encryption types by names.  The types
specified in RFC 3961 are DES-CBC-CRC, DES-CBC-MD4, and DES-CBC-MD5.

The document only deprecates the encryption types.  What about the
checksum types?  RFC 3961 defines several historicy checksum types:

   CRC32                            1               4           6.1.3
   rsa-md4                          2              16           6.1.2
   rsa-md4-des                      3              24           6.2.5
   des-mac                          4              16           6.2.7
   des-mac-k                        5               8           6.2.8
   rsa-md4-des-k                    6              16           6.2.6
   rsa-md5                          7              16           6.1.1
   rsa-md5-des                      8              24           6.2.4

The document needs to Update: 4120 because RFC 4120 specify
mandatory-to-implement types that includes DES:

      Encryption: AES128-CTS-HMAC-SHA1-96, DES-CBC-MD5, DES3-CBC-SHA1-KD
      Checksums: DES-MD5, HMAC-SHA1-DES3-KD, HMAC-SHA1-96-AES128

I don't think it makes sense to deprecate the DES encryption types and
leaving the DES-MD5 checksum type a mandatory-to-implement type, but I
may be missing something.

Preferably the document should also Update: 3961 to make RFC 3961
readers aware of the historic status of the DES ciphers (and possibly
checksum types).

/Simon

[email-masked] writes:

> 	Title           : Move DES to Historic Status for Kerberos
> 	Author(s)       : L. Astrand
> 	Filename        : draft-lha-des-die-die-die-00.txt
> 	Pages           : 9
> 	Date            : 2009-07-31
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Fri, 31 Jul 2009 12:57:32 -0400

> checksum types?  RFC 3961 defines several historicy checksum types:

While not strictly within the scope of this document, I'd support moving 
RSA-MD4, RSA-MD4-DES, DES-MAC, and DES-MAC-K to historic, along with 
DES-CBC-MD4, even if we were _not_ killing DES altogether.  In fact, in 
retrospect I'm moderately surprised we didn't do so in RFC4120.

RSA-MD5 is a bit trickier, as I seem to recall there are implementations 
which actually use this unkeyed cksumtype in places where an authenticated 
checksum is not strictly required.  What I don't know is whether any of 
these continue this behavior when DES3-CBC-SHA1 or one of the AES enctypes 
is used.

I don't recall whether CRC32 is actually in use for anything or not.

> readers aware of the historic status of the DES ciphers (and possibly

If it's going to change the status of enctypes defined in RFC3961, then 
yes, it needs to Update that document.  And you're right; if we're going to 
move DES-CBC-MD5 to historic we need to update the mandatory-to-implement 
enctypes in Kerberos.

BTW, what you quoted also seems to contain an error - there is no "DES-MD5" 
cksumtype.  Unfortunately, I can't remmber whether the one we intended to 
mandate was RSA-MD5 (unkeyed) or RDS-MD5-DES.

-- Jeff