Subject: [Curdle] I-D Action: draft-ietf-curdle-des-des-des-die-die-die-03.txt

From: [email-masked]
Date: Thu, 15 Jun 2017 21:01:48 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the CURves, Deprecating and a Little more Encryption of the IETF.

        Title           : Deprecate 3DES and RC4 in Kerberos
        Authors         : Benjamin Kaduk
                          Michiko Short
	Filename        : draft-ietf-curdle-des-des-des-die-die-die-03.txt
	Pages           : 9
	Date            : 2017-06-15

Abstract:
   The 3DES and RC4 encryption types are steadily weakening in
   cryptographic strength, and the deprecation process should be begun
   for their use in Kerberos.  Accordingly, RFC 4757 is moved to
   Obsolete status, as none of the encryption types it specifies should
   be used, and RFC 3961 is updated to note the deprecation of the
   triple-DES encryption types.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-curdle-des-des-des-die-die-die/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-curdle-des-des-des-die-die-die-03
https://datatracker.ietf.org/doc/html/draft-ietf-curdle-des-des-des-die-die-die-03

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-curdle-des-des-des-die-die-die-03

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Benjamin Kaduk <[email-masked]>
Date: Thu, 15 Jun 2017 23:04:58 -0500

This new version should address the comments raised during shepherd
review.

The new text about when AES support appeared (as an alternative to
RC4) is:

   Fortuntately, modern (i.e., supported) Kerberos implementations
   support a secure alternative to RC4, in the form of AES.  Windows has
   supported AES since 2007-2008 with the release of Windows Vista and
   Server 2008, respectively; MIT Kerberos [MITKRB5] has fully supported
   AES (including the GSSAPI mechanism) since 2004 with the release of
   version 1.3.2; Heimdal [HEIMDAL] has fully supported AES since 2005
   with the release of version 0.7.  Though there may still be issues
   running ten-year-old unsupported software in mixed environments with
   new software, issues of that sort seem unlikely to be unique to
   Kerberos, and the aministrators of such environments are expected to
   be capable of devising workarounds.

(I fixed the "Fortuntately" typo in my local copy already.)

-Ben

On Thu, Jun 15, 2017 at 09:01:48PM -0700, [email-masked] wrote:
> _______________________________________________
> Curdle mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/curdle