Subject: [Cfrg] Fwd: New Version Notification for draft-irtf-cfrg-cipher-catalog-00.txt

From: David McGrew <[email-masked]>
Date: Tue, 6 Mar 2012 07:05:24 -0500

Hi,

the initial version of "Ciphers in Use in the Internet" is now available at <http://tools.ietf.org/html/draft-irtf-cfrg-cipher-catalog-00>.   Sean and I ask for your review, constructive criticism, and input.    Some parts of the draft need more detail and organization, but it should be in sound enough shape for review.   

If you have text to contribute, that would be appreciated, especially if you can supply citations for the more consequential statements.  

regards,

David

Begin forwarded message:

> From: [email-masked]
> Subject: New Version Notification for draft-irtf-cfrg-cipher-catalog-00.txt
> Date: March 5, 2012 8:35:57 PM EST
> To: [email-masked]
> Cc: [email-masked]
> 
> A new version of I-D, draft-irtf-cfrg-cipher-catalog-00.txt has been successfully submitted by David McGrew and posted to the IETF repository.
> 
> Filename:	 draft-irtf-cfrg-cipher-catalog
> Revision:	 00
> Title:		 Ciphers in Use in the Internet
> Creation date:	 2012-03-05
> WG ID:		 Individual Submission
> Number of pages: 63
> 
> Abstract:
>   This note catalogs the ciphers in use on the Internet, to guide users
>   and standards processes.  It presents the security goals, security
>   analysis and results, specification, intellectual property
>   considerations, and publication dates of each cipher.  Background
>   information and security guidance is provided as well.
> 
> 
> 
> 
> The IETF Secretariat

---

From: Simon Josefsson <[email-masked]>
Date: Tue, 06 Mar 2012 14:16:40 +0100

David McGrew <[email-masked]> writes:

> Hi,
>
> the initial version of "Ciphers in Use in the Internet" is now
> available at
> <http://tools.ietf.org/html/draft-irtf-cfrg-cipher-catalog-00>.  Sean
> and I ask for your review, constructive criticism, and input.  Some
> parts of the draft need more detail and organization, but it should be
> in sound enough shape for review.
>
> If you have text to contribute, that would be appreciated, especially
> if you can supply citations for the more consequential statements.

Hi.  First an editorial issue, but one that affects readability
negatively: there appears to be many '!' and other characters inserted
at various points in the document.

Section 5.5 on Blowfish says "supports keys lengths 32,64,96,!, and 448"
however blowfish supports variable-length keys between 1 and 448 bits.
It also says 'IETF use includes None'.  Blowfish is mentioned in the
following list of RFCs.  I have not verified how many of them make any
normative use of the reference though.

rfc2367.txt rfc2407.txt rfc2409.txt rfc2440.txt rfc2451.txt rfc2628.txt
rfc2786.txt rfc2828.txt rfc3211.txt rfc3316.txt rfc4037.txt rfc4250.txt
rfc4251.txt rfc4253.txt rfc4301.txt rfc4306.txt rfc4344.txt rfc4718.txt
rfc4880.txt rfc4949.txt rfc5201.txt rfc5202.txt rfc5374.txt rfc5996.txt
rfc6020.txt rfc6071.txt rfc6476.txt

Section 6.3 on RC4 could say that RC4 has been claimed to be a
registered trademark, similar to what is said about RC2.

/Simon