Subject: [Ietf-krb-wg] orthogonalizing Camellia-CCM issues

From: Tom Yu <[email-masked]>
Date: Tue, 17 Aug 2010 18:12:10 -0400

I have tried to separate what I believe to be the mostly orthogonal
issues relating to the Camellia-CCM document.  Please comment if you
believe I've missed something.  I will follow up later on specific
issues.

* Assign enctype numbers or not? -- I believe there have been no
  objections to assigning enctype numbers.

* Should the Kerberos working group adopt the draft? -- Sam believes
  that the WG should only adopt the I-D if it will be Standards track.

* Standards track or Informational? -- Opinions vary, with some
  dependency on IPR issues.

* Mandatory to implement or not? -- I don't recall anyone pushing for
  making Camellia-CCM mandatory to implement.  Not everyone is
  treating this issue as independent from the Standards track vs
  Informational issue.  I believe they're mostly independent, in that
  it's possible to have a Standards track enctype without it being
  mandatory to implement.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Sam Hartman <[email-masked]>
Date: Wed, 18 Aug 2010 09:20:02 -0400

>>>>> "Tom" == Tom Yu <[email-masked]> writes:

    Tom> I have tried to separate what I believe to be the mostly
    Tom> orthogonal issues relating to the Camellia-CCM document.
    Tom> Please comment if you believe I've missed something.  I will
    Tom> follow up later on specific issues.

    Tom> * Assign enctype numbers or not? -- I believe there have been
    Tom> no objections to assigning enctype numbers.

Yes, although unless it's standards track I'm not entirely sure this is
a WG issue rather than a designated expert issue.  I.E. only one
person's opinion matters, so whether we've objected or not is
immeterial.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Sat, 21 Aug 2010 14:28:43 -0400

>   objections to assigning enctype numbers.

And as Sam points out, it's also not up to this WG.
That registry is managed by IANA; the allocation policy is Standards Track 
or Expert Review, with the latter still requiring a published 
specification.  In such cases, numbers are assigned during the publication 
process, after the document enters the RFC-Editor queue.  Of course, 
getting a jump on the expert review process is a fine idea, if the document 
ends up being informational.

> * Mandatory to implement or not?

This question is moot.  Such a requirement would apply only to things that 
claim to be compliant with whatever document contains the requirement.  So, 
for the document defining the Camellia-CCM enctype to say it is REQUIRED is 
meaningless, since the requirement to implement would apply only to people 
who are already implementing.

So, for a requirement to implement to be interesting, it would have to 
appear as part of the specification of something using that enctype, such 
as a new version of 4120 or 4121.  We certainly might update those 
documents at some point, and such an update will almost certainly include 
reexaminig the mandatory-to-implement enctypes, but that's not something 
we're working on at the moment.

>   dependency on IPR issues.

I believe there's been enough discussion on these questions to begin a 
consensus call.  I'd like to hear comments on either or both questions from 
WG participants, by 23:59 UTC on Friday, September 3.

Of course, if we do adopt, then the document must represent (rough) WG 
consensus before it can got to the IESG.  That means we will have the 
opportunity to discuss questions such as modes and checksum types.

If we do not adopt, the intended status question is not really relevant, 
since it won't be up to us.

-- Jeff

---

From: Sam Hartman <[email-masked]>
Date: Mon, 23 Aug 2010 05:38:44 -0400

I think hedging our bets against AES would be prudent.  I support krb-wg
adopting at least one standards-track cipher that is significantly
different than AES.  Such a cipher needs to be of sufficient quality
that we feel comfortable with it being on the standards track.  Such a
cipher needs to have wide enough applicability that people would feel
comfortable using it. So, a cipher used in one country would not really
count. This may mean Camellia is not a good choice, although as Thomas
points out it is or may have grown beyond the Japanese context.

I am unlikely to feel qualified to comment on whether this proposal
meets these requirements. Someone who has been active in this WG or CFRG
for a while positively asserting they had done enough review to
recommend camellia for this role would go a long way to convincing me we
should adopt.

In this message I'm giving reasons why we might adopt something as a
standards-track cipher. There may be other reasons for doing so.  That
is, this message may be an argument for adopting a particular cipher,
but it cannot really help come to the conclusion we should not adopt
some cipher.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg