Subject: [Ietf-krb-wg] I-D Action: draft-ietf-krb-wg-des-die-die-die-04.txt

From: [email-masked]
Date: Mon, 27 Feb 2012 12:12:48 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Kerberos Working Group of the IETF.

	Title           : Deprecate DES, RC4-HMAC-EXP, and other weak cryptographic algorithms in Kerberos
	Author(s)       : Love Hornquist Astrand
                          Tom Yu
	Filename        : draft-ietf-krb-wg-des-die-die-die-04.txt
	Pages           : 7
	Date            : 2012-02-27

   The Kerberos 5 network authentication protocol, originally specified
   in RFC1510, can use the Data Encryption Standard (DES) for
   encryption.  Almost 30 years after first publishing DES, the National
   Institute of Standards and Technology (NIST) finally withdrew the
   standard in 2005, reflecting a long-established consensus that DES is
   insufficiently secure.  By 2008, commercial hardware costing less
   than USD 15,000 could break DES keys in less than a day on average.
   DES is long past its sell-by date.  Accordingly, this document
   updates RFC1964, RFC4120, RFC4121, and RFC4757 to deprecate the use
   of DES, RC4-HMAC-EXP, and other weak cryptographic algorithms in
   Kerberos.  Because RFC1510 (obsoleted by RFC4120) supports only DES,
   this document reclassifies RFC1510 as Historic.

A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-krb-wg-des-die-die-die-04.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

This Internet-Draft can be retrieved at:
ftp://ftp.ietf.org/internet-drafts/draft-ietf-krb-wg-des-die-die-die-04.txt

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Tom Yu <[email-masked]>
Date: Mon, 27 Feb 2012 15:25:47 -0500

Changes since -03:

* Use RC4-HMAC-EXP in the title

* Clarify that "export strength" RC4 is RC4-HMAC-EXP, and is a weaker
  variant of RC4

* Replace "provide" with "implement or deploy"
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Nico Williams <[email-masked]>
Date: Mon, 27 Feb 2012 16:38:15 -0600

> * Replace "provide" with "implement or deploy"

An English language reading of "MUST NOT this or that" translates to
"(MUST NOT this) AND (MUST NOT that)" in pseudo-code.  I don't think
that's the intention.  I think you'll want to say "and/or" instead of
"or".

Nico
--