Subject: [Ietf-krb-wg] I-D Action: draft-ietf-krb-wg-des-die-die-die-02.txt

From: [email-masked]
Date: Thu, 09 Feb 2012 20:10:15 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Kerberos Working Group of the IETF.

	Title           : Deprecate DES support for Kerberos
	Author(s)       : Love Hornquist Astrand
                          Tom Yu
	Filename        : draft-ietf-krb-wg-des-die-die-die-02.txt
	Pages           : 6
	Date            : 2012-02-09

   The Kerberos 5 network authentication protocol, originally specified
   in RFC1510, can use the Data Encryption Standard (DES) for
   encryption.  Almost 30 years after first publishing DES, the National
   Institute of Standards and Technology (NIST) finally withdrew the
   standard in 2005, reflecting a long-established consensus that DES is
   insufficiently secure.  By 2008, commercial hardware costing less
   than USD 15,000 could break DES keys in less than a day on average.
   DES is long past its sell-by date.  Accordingly, this document
   updates RFC1964, RFC4120, and RFC4121 to deprecate the use of DES in
   Kerberos.  Because RFC1510 (obsoleted by RFC4120) supports only DES,
   this document reclassifies RFC1510 as Historic.  This document also
   deprecates the weak "export strength" RC4 enctype of RFC4757.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-krb-wg-des-die-die-die-02.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

This Internet-Draft can be retrieved at:
ftp://ftp.ietf.org/internet-drafts/draft-ietf-krb-wg-des-die-die-die-02.txt

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Tom Yu <[email-masked]>
Date: Thu, 09 Feb 2012 23:27:07 -0500

Changes since -01:

Deprecate "export strength" RC4-HMAC-EXP.  This requires a normative
downref to RFC 4757 (though a trivial one because its purpose is to
deprecate part of the downref).

Add RFC 3961 back to Normative References because some of the
deprecated enctypes aren't actually in RFC 4120.

ARCFOUR -> RC4
RSA-MD4-MAC-K -> RSA-MD4-DES-K

More minor editorial improvements.

At this point, there might be enough substantive changes that a brief
WGLC might be justified, although I hope, given the dicussion so far,
that it won't be very contentious.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Simon Josefsson <[email-masked]>
Date: Fri, 10 Feb 2012 15:36:56 +0100

> deprecate part of the downref).

To me, deprecating RC4-HMAC-EXP but not RC4-HMAC implies that we regard
non-export strength RC4-HMAC as secure.  I think this is unfortunate.

I'd prefer that we deprecated both RC4-HMAC and RC4-HMAC-EXP.  Second to
that, that we say nothing at all about RFC 4757 and let readers pass
their own judgement on it.

/Simon

---

From: Tom Yu <[email-masked]>
Date: Fri, 10 Feb 2012 10:39:56 -0500

> non-export strength RC4-HMAC as secure.  I think this is unfortunate.

We already address RC4-HMAC in the Security Considerations.

Is RC4-HMAC (non-export) weaker than AES128-CTS-HMAC-SHA1-96?
Probably.  Is there anything that makes it insecure on the level of
single-DES, though?  Keep in mind that RFC 4757 is Informational, so a
standards-conforming implementation isn't required to do anything with
it anyway.

> their own judgement on it.

There's been text in the Security Considerations about RC4-HMAC since
before my edits.  The document simply neglected to cite RFC 4757
previously.  Are you suggesting that we remove the preexisting text
from the Security Considerations?  Also, RFC 4757 itself recommends
not using RC4-HMAC if stronger enctypes are available.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Russ Allbery <[email-masked]>
Date: Fri, 10 Feb 2012 12:41:40 -0800

> their own judgement on it.

Note that RC4-HMAC is the only non-DES enctype available if one needs
interoperability with Windows XP systems, which is still an issue for a
lot of sites.  By contrast, there's much less operational need for either
DES or RC4-HMAC-EXP these days.

Sites that move from DES to RC4-HMAC are almost certainly much better off,
so I would be hesitant to give both of those enctypes the same status as
long as Windows XP is still a significant going concern.

-- 
Russ Allbery ([email-masked])             <http://www.eyrie.org/~eagle/>
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Nico Williams <[email-masked]>
Date: Fri, 10 Feb 2012 14:56:46 -0600

> long as Windows XP is still a significant going concern.

+1

But we could warn that we intend to deprecate RC4-HMAC next.

Nico

---

From: Sam Hartman <[email-masked]>
Date: Fri, 10 Feb 2012 16:26:20 -0500

>>>>> "Simon" == Simon Josefsson <[email-masked]> writes:

    Simon> Tom Yu <[email-masked]> writes:
    >> Changes since -01:
    >> 
    >> Deprecate "export strength" RC4-HMAC-EXP.  This requires a
    >> normative downref to RFC 4757 (though a trivial one because its
    >> purpose is to deprecate part of the downref).

    Simon> To me, deprecating RC4-HMAC-EXP but not RC4-HMAC implies that
    Simon> we regard non-export strength RC4-HMAC as secure.  I think
    Simon> this is unfortunate.

I do regard rc4-hmac as reasonably secure.
Am I missing something?

I do not support discouraging the use of rc4-hmac for the reasons Russ
cites.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Sam Hartman <[email-masked]>
Date: Fri, 10 Feb 2012 16:30:49 -0500

I just noticed that this is standards track.  That doesn't make sense to
me.  It could either be BCP or informational. However since it defines
no standard that can be tested for interoperability or advanced (and
since similar documents in other working groups are not typically
standards track), I think we need another status.

However I just talked to another chair (not of krb-wg) and perhaps I'm
confused.
I'll try to figure out what our options are for status.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Nico Williams <[email-masked]>
Date: Fri, 10 Feb 2012 15:34:53 -0600

> standards track), I think we need another status.

If the I-D updates a Standards-Track document (and it does purport to
update several of them) then it needs to be a Standards-Track
document.

Nico

---

From: Tom Yu <[email-masked]>
Date: Fri, 10 Feb 2012 16:50:36 -0500

> update several of them) then it needs to be a Standards-Track

I agree.  The main quirk here is that the I-D removes one RFC from the
Standards Track (RFC 1510), and updates one Informational RFC (RFC
4757) -- unless you want to add the interpretation that the "SHOULD
NOT RC4-HMAC-EXP" also updates the requirements of RFC 4120.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Simon Josefsson <[email-masked]>
Date: Mon, 13 Feb 2012 11:25:54 +0100

> We already address RC4-HMAC in the Security Considerations.

That section reads:

   RC4, used in RC4-HMAC, is considered weak; however, the use in
   Kerberos is vetted and considered secure for now.

Any references to this vetting?  Even RFC 4757 published 6 years ago
appears to me to say that the cipher SHOULD NOT be used for high-volume
connections, citing RC4 vulnerabilities as a reason.  To me, this new
document implies RC4-HMAC is stronger than we thought it was before,
which seems surprising.

> Keep in mind that RFC 4757 is Informational, so a standards-conforming
> implementation isn't required to do anything with it anyway.

That is why I propose that this document does not discuss RC4 at all.

> not using RC4-HMAC if stronger enctypes are available.

The document title currently is "Deprecate DES support for Kerberos", so
yes, I suggest to remove the deprecation of RC4 from the document.

/Simon

---

From: Simon Josefsson <[email-masked]>
Date: Mon, 13 Feb 2012 11:30:30 +0100

> But we could warn that we intend to deprecate RC4-HMAC next.

Removing the references to RC4-HMAC from the DES document seems simpler
to me.  RC4-HMAC is an informational document, and there is no IETF
standard that requires its use, therefor it seems unlikely that whatever
a new IETF standard says about it will modify deployments.  Especially
given Russ' comments about interop with Windows XP.

/Simon

---

From: Tom Yu <[email-masked]>
Date: Mon, 13 Feb 2012 07:55:56 -0500

> given Russ' comments about interop with Windows XP.

The logic behind deprecating RC4-HMAC-EXP is that it is of comparable
weakness to DES, having the same effective key size.  If we are
deprecating DES, it makes sense to also deprecate similarly weak
ciphers.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Tom Yu <[email-masked]>
Date: Mon, 13 Feb 2012 08:00:35 -0500

> document implies RC4-HMAC is stronger than we thought it was before,

I think RC4-HMAC is not stronger than we thought it was, and we should
make sure this document doesn't make it seem that we are saying that.
Perhaps if we say anything about RC4-HMAC, we should reiterate that
the security considerations of RFC 4757 continue to apply, with the
exception that RC4-HMAC-EXP is no longer considered secure.

> yes, I suggest to remove the deprecation of RC4 from the document.

If your concern is with the accuracy of the title, note that in this
document, we already say an implementation SHOULD NOT implement some
algorithms that do not involve DES -- CRC32 and RSA-MD4 among them.

I'm not willing to drop all references to RC4-HMAC, because its
continued safe (somewhat) usage in legacy deployments is a
justification for allowing the limited use of RSA-MD5.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Simon Josefsson <[email-masked]>
Date: Mon, 13 Feb 2012 14:42:16 +0100

> exception that RC4-HMAC-EXP is no longer considered secure.

That seems like a good idea.

> algorithms that do not involve DES -- CRC32 and RSA-MD4 among them.

How about a title of "Deprecate historical algorithms in Kerberos" or
something similar instead?  Even though the document has contained
references to RC4 before, I did not fully realize that before this
discussion, because the title has caused me to treat this as
DES-deprecation only.

/Simon

---

From: Simo Sorce <[email-masked]>
Date: Mon, 13 Feb 2012 09:27:00 -0500

> discussion, because the title has caused me to treat this as

I am for narrowing the scope to DES and getting this standard out ASAP.
It has been bounced enough, and adding more discussion to deprecate
other algorithms would only delay it, further.

Meanwhile DES is really insecure these days and we ought to deprecate it
officially so that all vendors wake up and start moving off of it for
real.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York

---

From: Tom Yu <[email-masked]>
Date: Mon, 13 Feb 2012 10:47:12 -0500

> officially so that all vendors wake up and start moving off of it for

RC4-HMAC-EXP is just as insecure as DES (both DES and RC4-HMAC-EXP use
56-bit keys), which is some of the motivation for wanting to do both.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Tom Yu <[email-masked]>
Date: Mon, 13 Feb 2012 10:49:31 -0500

> discussion, because the title has caused me to treat this as

I prefer "Deprecate DES and other weak cryptographic algorithms in
Kerberos", because I think most of the problem consists of legacy
deployments of DES.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Love Hörnquist Åstrand <[email-masked]>
Date: Mon, 13 Feb 2012 16:48:35 +0000

13 feb 2012 kl. 07:49 skrev Tom Yu <[email-masked]>:

> deployments 

I agree, let's deprecate des and rc4-hmac-exp. while rc4-hmac should also be deprecated, it's not horrible to use and for some deployments it's the only enctype available. If anything, msft should chime in and say what they think is the status of the rc4-hmac deployments, if they think its ready to be deprecated, it probably should.

Love

---

From: Simon Josefsson <[email-masked]>
Date: Tue, 14 Feb 2012 08:52:57 +0100

> Kerberos", because I think most of the problem consists of legacy

That seems fine to me.

/Simon

---

From: Michiko Short <[email-masked]>
Date: Tue, 14 Feb 2012 21:10:39 +0000

+1

Windows XP is under extended support until 2014 and Windows Server 2003 until 2015, so we can expect that customers will continue to use until at least then.

Also since I am catching up on my email I have been reading all the threads at once and it seems that if we restrict this draft to RFC to DES it would go faster. I agree we should message that RC4 is next and we can even start a RC4 draft to make it obvious to people outside the working group.   

Thanks,
Michiko Short | Program Manager | Windows Security & Identity

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Nico Williams
Sent: Friday, February 10, 2012 12:57 PM
To: Russ Allbery
Cc: [email-masked]
Subject: Re: [Ietf-krb-wg] I-D Action: draft-ietf-krb-wg-des-die-die-die-02.txt

On Fri, Feb 10, 2012 at 2:41 PM, Russ Allbery <[email-masked]> wrote:
> interoperability with Windows XP systems, which is still an issue for 
> a lot of sites.  By contrast, there's much less operational need for 
> either DES or RC4-HMAC-EXP these days.
>
> Sites that move from DES to RC4-HMAC are almost certainly much better 
> off, so I would be hesitant to give both of those enctypes the same 
> status as long as Windows XP is still a significant going concern.

+1

Nico

---

From: Sam Hartman <[email-masked]>
Date: Tue, 14 Feb 2012 18:12:11 -0500

>>>>> "Tom" == Tom Yu <[email-masked]> writes:

    Tom> Simo Sorce <[email-masked]> writes:
    >> I am for narrowing the scope to DES and getting this standard out
    >> ASAP.  It has been bounced enough, and adding more discussion to
    >> deprecate other algorithms would only delay it, further.
    >> 
    >> Meanwhile DES is really insecure these days and we ought to
    >> deprecate it officially so that all vendors wake up and start
    >> moving off of it for real.

As a process point, I believe that once we conclude our discussion here
about what if anything to say about RC4, we will not be slowed down
regardless of whether we include RC4.  I think that coming to consensus
to remove RC4 references is likely as difficult as coming to consensus
to keep it.

So, my opinion as someone familiar with IETF process is that we should
do what is right: it will take about the same time either way.

--Sam

---

From: Simo Sorce <[email-masked]>
Date: Tue, 14 Feb 2012 18:29:39 -0500

> do what is right: it will take about the same time either way.

In this case I agree deprecating RC4-HMAC-EXP, but not RC4-HMAC as I am
involved in quite a few projects that needs to keep to interop with
older Windows clients that understand only RC4.

Simo.

---

From: "Henry B. Hotz" <[email-masked]>
Date: Wed, 15 Feb 2012 16:54:47 -0800

> do what is right: it will take about the same time either way.

OK, sold!

------------------------------------------------------
The opinions expressed in this message are mine,
not those of Caltech, JPL, NASA, or the US Government.
[email-masked], or [email-masked]