Subject: [Ietf-krb-wg] I-D Action: draft-ietf-krb-wg-des-die-die-die-01.txt

From: [email-masked]
Date: Wed, 08 Feb 2012 21:01:08 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Kerberos Working Group of the IETF.

	Title           : Deprecate DES support for Kerberos
	Author(s)       : Love Hornquist Astrand
                          Tom Yu
	Filename        : draft-ietf-krb-wg-des-die-die-die-01.txt
	Pages           : 6
	Date            : 2012-02-08

   The Kerberos 5 network authentication protocol, originally specified
   in RFC1510, can use the Data Encryption Standard (DES) for
   encryption.  Almost 30 years after first publishing DES, the National
   Institute of Standards and Technology (NIST) finally withdrew the
   standard in 2005, reflecting a long-established consensus that DES is
   insufficiently secure.  By 2008, commercial hardware costing less
   than USD 15,000 could break DES keys in less than a day on average.
   DES is long past its sell-by date.  Accordingly, this document
   updates RFC1964, RFC4120, and RFC4121 to deprecate the use of DES in
   Kerberos.  Because RFC1510 (obsoleted by RFC4120) supports only DES,
   this document also reclassifies RFC1510 as Historic.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-krb-wg-des-die-die-die-01.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

This Internet-Draft can be retrieved at:
ftp://ftp.ietf.org/internet-drafts/draft-ietf-krb-wg-des-die-die-die-01.txt

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Tom Yu <[email-masked]>
Date: Thu, 09 Feb 2012 09:07:02 -0500

Removed "DES-MD5" from the deprecated list, and clarified
implementations MAY use RSA-MD5 inside an encrypted Authenticator for
backwards compatibility purposes.  Deleted "Other old enctypes"
section.  Removed 3961 from "Updates" header and moved its reference
to Informative.

Trimmed Abstract a little.  Minor editorial cleanup.

Chairs, do you think this needs an additional WGLC, or should we
forward it on to the IESG?
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Simon Josefsson <[email-masked]>
Date: Thu, 09 Feb 2012 15:56:54 +0100

Quick review of -01:

The -01 document refers to 'RSA-MD4-MAC-K' instead of the RFC 3961 and
IANA name 'rsa-md4-des-k'.

There should be a reference to RFC 4757 when ARCFOUR-HMAC is mentioned,
and the reference should use the name RC4-HMAC instead of ARCFOUR-HMAC
since that is what RFC 4757 calls it.

In the same paragraph as ARCFOUR-HMAC is mentioned there is a reference
to "MIT's DES3" which eludes me, what does it refer to?  As far as I
know, DES3 for Kerberos GSS-API is from IETF's RFC 3961 and RFC 4121.

/Simon

---

From: Tom Yu <[email-masked]>
Date: Thu, 09 Feb 2012 10:26:31 -0500

> IANA name 'rsa-md4-des-k'.

Thanks; I missed this somehow.  Fixed in my copy.

> since that is what RFC 4757 calls it.

Implementations call it ARCFOUR-HMAC in various places for trademark
reasons, as I recall.  (Though skimming RFC 4757 reminds me that we
might also want to deprecate rc4-hmac-exp (24) -- "export strength"
RC4 -- as weak.)  I'd be willing to skip that to get the document out
sooner.  Do people have strong opinions about naming it RC4 versus
ARCFOUR?

> know, DES3 for Kerberos GSS-API is from IETF's RFC 3961 and RFC 4121.

The details of using DES3 in Kerberos GSS-API in RFC 1964 token
formats are not specified in an RFC, but MIT was first to implement
it, and Heimdal also implements it.  Notably, Microsoft does not
implement DES3 Kerberos GSS-API tokens (or any Kerberos DES3 support
at all).
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: "Henry B. Hotz" <[email-masked]>
Date: Thu, 9 Feb 2012 10:45:42 -0800

> sooner.  Do people have strong opinions about naming it RC4 versus

No strong opinion, but if forced to vote, I would vote for the RFC 4757 name.

Get rid of "export strength" crypto as long as it doesn't slow passage of this document.
------------------------------------------------------
The opinions expressed in this message are mine,
not those of Caltech, JPL, NASA, or the US Government.
[email-masked], or [email-masked]

---

From: Tom Yu <[email-masked]>
Date: Thu, 09 Feb 2012 14:04:15 -0500

> Get rid of "export strength" crypto as long as it doesn't slow passage of this document.

It might slow it down... I believe updating RFC 4757 means adding it
as a normative reference, which means doing the normative downref
thing because RFC 4757 is Informational.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Sam Hartman <[email-masked]>
Date: Thu, 09 Feb 2012 15:09:14 -0500

>>>>> "Simon" == Simon Josefsson <[email-masked]> writes:

    Simon> reference to "MIT's DES3" which eludes me, what does it refer
    Simon> to?  As far as I know, DES3 for Kerberos GSS-API is from
    Simon> IETF's RFC 3961 and RFC 4121.

It is not.  See src/lib/gssapi/krb5/3des.txt (also probably
draft-raeburn-krb-gssapi-krb5-3des-01.txt)

That document may loosely correspond to MIT's 3DES implementation.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Sam Hartman <[email-masked]>
Date: Thu, 09 Feb 2012 15:11:58 -0500

>>>>> "Tom" == Tom Yu <[email-masked]> writes:

    Tom> Implementations call it ARCFOUR-HMAC in various places for
    Tom> trademark reasons, as I recall.  (Though skimming RFC 4757
    Tom> reminds me that we might also want to deprecate rc4-hmac-exp
    Tom> (24) -- "export strength" RC4 -- as weak.)  I'd be willing to
    Tom> skip that to get the document out sooner.  Do people have
    Tom> strong opinions about naming it RC4 versus ARCFOUR?

I feel strongly that we should use whatever name is registered with IANA
which is presumably rc4.

I support deprecating the export strength RC4 enctype.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Tom Yu <[email-masked]>
Date: Thu, 09 Feb 2012 15:50:39 -0500

> thing because RFC 4757 is Informational.

I'm now fairly sure that the incremental procedural cost of doing a
normative downref is amounts to explicitly calling it out in the
IETF-wide last call, so it shouldn't slow things down very much.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Simon Josefsson <[email-masked]>
Date: Fri, 10 Feb 2012 15:29:07 +0100

> draft-raeburn-krb-gssapi-krb5-3des-01.txt)

Thanks for the pointer.  I suggest adding those references to the
document, so the reader can understand what is intended.

/Simon