Subject: [Curdle] I-D Action: draft-ietf-curdle-des-des-des-die-die-die-02.txt

From: [email-masked]
Date: Sun, 04 Jun 2017 19:49:57 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the CURves, Deprecating and a Little more Encryption of the IETF.

        Title           : Deprecate 3DES and RC4 in Kerberos
        Authors         : Benjamin Kaduk
                          Michiko Short
	Filename        : draft-ietf-curdle-des-des-des-die-die-die-02.txt
	Pages           : 9
	Date            : 2017-06-04

Abstract:
   The 3DES and RC4 encryption types are steadily weakening in
   cryptographic strength, and the deprecation process should be begun
   for their use in Kerberos.  Accordingly, RFC 4757 is moved to
   Obsolete status, as none of the encryption types it specifies should
   be used, and RFC 3961 is updated to note the deprecation of the
   triple-DES encryption types.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-curdle-des-des-des-die-die-die/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-curdle-des-des-des-die-die-die-02
https://datatracker.ietf.org/doc/html/draft-ietf-curdle-des-des-des-die-die-die-02

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-curdle-des-des-des-die-die-die-02

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Benjamin Kaduk <[email-masked]>
Date: Sun, 4 Jun 2017 21:51:11 -0500

This just updates the reference for the IANA registries to have the
actual URL for the registry on the web, instead of referencing the
RFC that created the registries.

-Ben

On Sun, Jun 04, 2017 at 07:49:57PM -0700, [email-masked] wrote:
> _______________________________________________
> Curdle mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/curdle

---

From: Daniel Migault <[email-masked]>
Date: Mon, 5 Jun 2017 21:50:16 +0000

Hi, 

Thanks for updating the draft. I have found some small nits, but overall the draft seems ready to me to be sent to the IESG. I have prepared the shepherd write-up [1]. I believe 03 will be sent it to the IESG. 

If anyone has additional comments, please let us know as soon as possible.

Yours, 
Daniel

[1] https://datatracker.ietf.org/doc/draft-ietf-curdle-des-des-des-die-die-die/shepherdwriteup/

COMMENT A)
"""
 However, both Windows XP and Windows Server 2003 are already out of
   their official support periods.  It is now believed that all machines
   that might be broken by disabling RC4 are unsupported, and concerns
   about breaking them will be reduced.  That should facilitate the
   removal of RC4 from common use.
"""

Maybe that is my English and I might misinterpret the text, but it do not find appropriated to mention we are not concerned by breaking some systems. I also feel that the text can be interpreted as a commercial argument to "buy the new release". Maybe it might be more appropriated to say that as unsupported, their numbers is expected to be quite low, then that such machines are unlikely to operate on managed networks where Kerberos is deployed.  If that is the case, it is the responsibility of the network administrator to address appropriately this issue. But I am fine with the conclusion: That should facilitate the removal of RC4 from common use.

COMMENT B) 
Maybe some references could be provided for the cited Kerberos implementations.  

MIT Kerberos; https://web.mit.edu/kerberos/
Heimdal Kerberos: https://www.h5l.org/

COMMENT C) 

The URL does not appear in the references. 
[MS-NLMP]  Microsoft Corporation, "[MS-NLMP]: NT LAN Manager (NTLM)
              Authentication Protocol", May 2014.
[IANA-KRB]
              Internet Assigned Numbers Authority, "IANA Kerberos
              Parameters Registry", March 2017.

I suppose this is an issue in the xml, and maybe the following syntax could solve this issue:

OLD: 
<reference anchor="MS-NLMP">
    <front>
        <title abbrev="NTLM Authentication Protocol">[MS-NLMP]: NT LAN Manager (NTLM) Authentication Protocol</title>
        <author>
            <organization>Microsoft Corporation</organization>
        </author>
		<date year="2014" month="May"/>
    </front>
    <format type="HTML" target="https://msdn.microsoft.com/en-us/library/cc236621.aspx"/>
</reference>

<reference anchor="IANA-KRB">
    <front>
	    <title>IANA Kerberos Parameters Registry</title>
		<author>
		    <organization>Internet Assigned Numbers Authority</organization>
			</author><date year="2017" month="March"/>
	</front>
	<format type="HTML" target="https://www.iana.org/assignments/kerberos-parameters/kerberos-parameters.xhtml"/>
	</reference>
NEW:
<reference anchor="MS-NLMP" target="https://msdn.microsoft.com/en-us/library/cc236621.aspx">
    <front>
        <title abbrev="NTLM Authentication Protocol">[MS-NLMP]: NT LAN Manager (NTLM) Authentication Protocol</title>
        <author>
            <organization>Microsoft Corporation</organization>
        </author>
		<date year="2014" month="May"/>
    </front>
</reference>

<reference anchor="IANA-KRB" target="https://www.iana.org/assignments/kerberos-parameters/kerberos-parameters.xhtml">
    <front>
	    <title>IANA Kerberos Parameters Registry</title>
		<author>
		    <organization>Internet Assigned Numbers Authority</organization>
			</author><date year="2017" month="March"/>
	</front>
</reference>	

COMMENT D) 

The RFC6150 is informational and is listed in the normative section. I believe it should be in the informational reference section. 

[RFC6150]  Turner, S. and L. Chen, "MD4 to Historic Status",
              RFC 6150, DOI 10.17487/RFC6150, March 2011,
              <http://www.rfc-editor.org/info/rfc6150>.

COMMENT E) 

s/Similarly, IANA Is requested/ Similarly, IANA is requested

-----Original Message-----
From: Curdle [mailto:[email-masked]] On Behalf Of Benjamin Kaduk
Sent: Sunday, June 04, 2017 10:51 PM
To: [email-masked]
Subject: Re: [Curdle] I-D Action: draft-ietf-curdle-des-des-des-die-die-die-02.txt

This just updates the reference for the IANA registries to have the actual URL for the registry on the web, instead of referencing the RFC that created the registries.

-Ben

On Sun, Jun 04, 2017 at 07:49:57PM -0700, [email-masked] wrote:
> Please note that it may take a couple of minutes from the time of 
> submission until the htmlized version and diff are available at tools.ietf.org.
>

---

From: Michiko Short <[email-masked]>
Date: Tue, 6 Jun 2017 16:13:16 +0000

Also why do we only call out Windows. Perhaps the better option is to list all which of our versions support AES? For example:

Windows has supported AES since 2007 with the release of Windows Vista & 2008 with the release of Windows Server 2008, therefore numbers of Windows which required RC4 should be low. MIT has... Heimdal has..

-----Original Message-----
From: Daniel Migault [mailto:[email-masked]] 
Sent: Monday, June 5, 2017 2:50 PM
To: [email-masked]
Cc: [email-masked]; [email-masked]
Subject: RE: [Curdle] I-D Action: draft-ietf-curdle-des-des-des-die-die-die-02.txt

Hi, 

Yours,
Daniel

[1] https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatatracker.ietf.org%2Fdoc%2Fdraft-ietf-curdle-des-des-des-die-die-die%2Fshepherdwriteup%2F&data=02%7C01%7Cmichikos%40microsoft.com%7Cbcc759a2ac824a5e026608d4ac5cddff%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636322962250114126&sdata=kjynmx5IEKqTpLmmzE5AftZdS4PxJ12uSKn%2B%2F3Ay7b8%3D&reserved=0

COMMENT A)
"""

COMMENT B)

MIT Kerberos; https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fweb.mit.edu%2Fkerberos%2F&data=02%7C01%7Cmichikos%40microsoft.com%7Cbcc759a2ac824a5e026608d4ac5cddff%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636322962250114126&sdata=uXgb5iakspN%2FI%2Bj9yqfrkKbcXbKHkaRwM5oDWJU7PuU%3D&reserved=0
Heimdal Kerberos: https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.h5l.org%2F&data=02%7C01%7Cmichikos%40microsoft.com%7Cbcc759a2ac824a5e026608d4ac5cddff%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636322962250124134&sdata=zCRCdJ24R93jirCIwfNT2ifgPG28%2FQlfoHjIQfKreBs%3D&reserved=0

COMMENT C) 

OLD: 
    <format type="HTML" target="https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmsdn.microsoft.com%2Fen-us%2Flibrary%2Fcc236621.aspx&data=02%7C01%7Cmichikos%40microsoft.com%7Cbcc759a2ac824a5e026608d4ac5cddff%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636322962250124134&sdata=QiK%2FpC9fJXh5fQEt2IjugLsuTPkd6%2Bv4qEymkUOHPVs%3D&reserved=0"/>
</reference>

<reference anchor="IANA-KRB">
    <front>
	    <title>IANA Kerberos Parameters Registry</title>
		<author>
		    <organization>Internet Assigned Numbers Authority</organization>
			</author><date year="2017" month="March"/>
	</front>
	<format type="HTML" target="https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.iana.org%2Fassignments%2Fkerberos-parameters%2Fkerberos-parameters.xhtml&data=02%7C01%7Cmichikos%40microsoft.com%7Cbcc759a2ac824a5e026608d4ac5cddff%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636322962250124134&sdata=vGEHkoMc%2F00ptdCgXR2A0kPN90aFKcyo%2Bzlb86IcgRQ%3D&reserved=0"/>
	</reference>
NEW:
<reference anchor="MS-NLMP" target="https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmsdn.microsoft.com%2Fen-us%2Flibrary%2Fcc236621.aspx&data=02%7C01%7Cmichikos%40microsoft.com%7Cbcc759a2ac824a5e026608d4ac5cddff%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636322962250124134&sdata=QiK%2FpC9fJXh5fQEt2IjugLsuTPkd6%2Bv4qEymkUOHPVs%3D&reserved=0">
    <front>
        <title abbrev="NTLM Authentication Protocol">[MS-NLMP]: NT LAN Manager (NTLM) Authentication Protocol</title>
        <author>
            <organization>Microsoft Corporation</organization>
        </author>
		<date year="2014" month="May"/>
    </front>
</reference>

<reference anchor="IANA-KRB" target="https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.iana.org%2Fassignments%2Fkerberos-parameters%2Fkerberos-parameters.xhtml&data=02%7C01%7Cmichikos%40microsoft.com%7Cbcc759a2ac824a5e026608d4ac5cddff%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636322962250124134&sdata=vGEHkoMc%2F00ptdCgXR2A0kPN90aFKcyo%2Bzlb86IcgRQ%3D&reserved=0">
    <front>
	    <title>IANA Kerberos Parameters Registry</title>
		<author>
		    <organization>Internet Assigned Numbers Authority</organization>
			</author><date year="2017" month="March"/>
	</front>
</reference>	

COMMENT D) 

[RFC6150]  Turner, S. and L. Chen, "MD4 to Historic Status",
              RFC 6150, DOI 10.17487/RFC6150, March 2011,
              <https://na01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.rfc-editor.org%2Finfo%2Frfc6150&data=02%7C01%7Cmichikos%40microsoft.com%7Cbcc759a2ac824a5e026608d4ac5cddff%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636322962250124134&sdata=%2BhSjbFbDOKRbzJxM3QiDDGtqnPV6BPfxPdysNFvW9pQ%3D&reserved=0>.

COMMENT E) 

-----Original Message-----
From: Curdle [mailto:[email-masked]] On Behalf Of Benjamin Kaduk
Sent: Sunday, June 04, 2017 10:51 PM
To: [email-masked]
Subject: Re: [Curdle] I-D Action: draft-ietf-curdle-des-des-des-die-die-die-02.txt

-Ben

On Sun, Jun 04, 2017 at 07:49:57PM -0700, [email-masked] wrote:
> https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatat
> racker.ietf.org%2Fdoc%2Fdraft-ietf-curdle-des-des-des-die-die&data=02%
> 7C01%7Cmichikos%40microsoft.com%7Cbcc759a2ac824a5e026608d4ac5cddff%7C7
> 2f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636322962250124134&sdata=W9D
> 1cNitX3lTbDk82Viu4VSSxX%2FlZxH9RCk%2BUS56jM8%3D&reserved=0
> -die/
> 
> https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftools
> .ietf.org%2Fhtml%2Fdraft-ietf-curdle-des-des-des-die-die-die-&data=02%
> 7C01%7Cmichikos%40microsoft.com%7Cbcc759a2ac824a5e026608d4ac5cddff%7C7
> 2f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636322962250124134&sdata=gJQ
> NwHRax8r5cRudXHHHRFK9aS0hLSfD6HNf6vBkwFg%3D&reserved=0
> 02
> https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdatat
> racker.ietf.org%2Fdoc%2Fhtml%2Fdraft-ietf-curdle-des-des-des-die-die-d
> ie-02&data=02%7C01%7Cmichikos%40microsoft.com%7Cbcc759a2ac824a5e026608
> d4ac5cddff%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C63632296225012
> 4134&sdata=wcJm7JdAsBBznGfPi3c5WRJ1Jgt5jdBQIDhC5EkM4Gk%3D&reserved=0
> 
> https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.i
> etf.org%2Frfcdiff%3Furl2%3Ddraft-ietf-curdle-des-des-des-die-di&data=0
> 2%7C01%7Cmichikos%40microsoft.com%7Cbcc759a2ac824a5e026608d4ac5cddff%7
> C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636322962250124134&sdata=E
> hrVb769fbxn41qg7kVeBZIMk2jycmQRFJ26yil%2BO1c%3D&reserved=0
> e-die-02
> 
> 
> https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.i
> etf.org%2Fmailman%2Flistinfo%2Fcurdle&data=02%7C01%7Cmichikos%40micros
> oft.com%7Cbcc759a2ac824a5e026608d4ac5cddff%7C72f988bf86f141af91ab2d7cd
> 011db47%7C1%7C0%7C636322962250124134&sdata=DcfGyzuZ89ur3shrhsefQ6N0fIM
> %2Fw%2BiVBvl%2FC0CD3%2FQ%3D&reserved=0

_______________________________________________
Curdle mailing list
[email-masked]
https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fcurdle&data=02%7C01%7Cmichikos%40microsoft.com%7Cbcc759a2ac824a5e026608d4ac5cddff%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636322962250134142&sdata=0K2JfDATGftlKs81oowUfCPupD%2B8YavdBrxhxTblpCc%3D&reserved=0

---

From: Benjamin Kaduk <[email-masked]>
Date: Thu, 15 Jun 2017 21:29:36 -0500

> Windows has supported AES since 2007 with the release of Windows Vista & 2008 with the release of Windows Server 2008, therefore numbers of Windows which required RC4 should be low. MIT has... Heim…

That sounds like a good idea.  I think that calling out the two
windows versions by name/number was an artifact of the document
originally being written *before* they were out of support (but they
were "going to be out of support soon"), and I did a very mechanical
update when preparing the version after the long hiatus.

Thanks for the suggestion!

-Ben

---

From: Benjamin Kaduk <[email-masked]>
Date: Thu, 15 Jun 2017 23:09:17 -0500

> Thanks for updating the draft. I have found some small nits, but overall the draft seems ready to me to be sent to the IESG. I have prepared the shepherd write-up [1]. I believe 03 will be sent it…

Thanks for these; they should be addressed in the -03 (just
submitted).

-Ben