Subject: [Curdle] I-D Action: draft-ietf-curdle-rc4-die-die-die-03.txt

From: [email-masked]
Date: Sat, 09 Dec 2017 12:22:41 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the CURves, Deprecating and a Little more Encryption WG of the IETF.

        Title           : Depreciating RC4 in all IETF Protocols
        Author          : Luis Camara
	Filename        : draft-ietf-curdle-rc4-die-die-die-03.txt
	Pages           : 8
	Date            : 2017-12-09

Abstract:
   RC4 is extremely weak as shown by RFC 6649 and RFC 7457, is
   prohibited in TLS by RFC 7465, is prohibited in Kerberos by RFC xxxx
   and it needs to be prohibited in all IETF protocols. This document
   obsoletes RFC 4345 "Improved Arcfour Modes for the Secure Shell (SSH)
   Transport Layer Protocol" (note Arcfour and RC4 are synonymous).
   RFC 3501, RFC 4253, RFC 6649 and RFC 6733 are updated to note the
   deprecation of RC4 in all IETF protocols.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-curdle-rc4-die-die-die/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-curdle-rc4-die-die-die-03
https://datatracker.ietf.org/doc/html/draft-ietf-curdle-rc4-die-die-die-03

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-curdle-rc4-die-die-die-03

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: "Salz, Rich" <[email-masked]>
Date: Sun, 10 Dec 2017 20:42:51 +0000

The security AD’s just got back to us.  Apologies from the AD’s and Chairs for letting this fall through the cracks.

A general “deprecate in all protocols” document is not appropriate for CURDLE.  This means that Section 4 (IMAP->EXTRA), Section 6 (DIAMETER->DIME) and Section 7 are out of scope for this WG. This is quoting Eric, one of the co-Directors.

On a personal level, I think Section 3 should be handled by UTA. And Section 5 has KITTEN

Even if the WG disagrees with me about 3 and 5, there is a question about if it’s worth still having this as a WG document.  Please post your reply to the list; we will call for consensus to move this forward or abandon it early in January.

On 12/9/17, 3:22 PM, "[email-masked]" <[email-masked]> wrote:

    
    Abstract:

    

    
    _______________________________________________
    Curdle mailing list
    [email-masked]
    https://www.ietf.org/mailman/listinfo/curdle

---

From: Benjamin Kaduk <[email-masked]>
Date: Sun, 10 Dec 2017 15:37:20 -0600

> On a personal level, I think Section 3 should be handled by UTA. And Section 5 has KITTEN

I think section 5 is roughly equivalent to
draft-ietf-curdle-des-des-des-die-die-die (of which I am coauthor),
which is currently waiting for the IESG to decide whether it is more
appropriate to move RFC 4757 to Historic or make it Obsolete.
So I'm surpirsed that this draft did not refer to "RFC xxxx" in
section 5 but did refer to it in other places :)

> Even if the WG disagrees with me about 3 and 5, there is a question about if it’s worth still having this as a WG document.  Please post your reply to the list; we will call for consensus to move t…

I think it is worth having this WG do the work it can do in this
space within its charter (which is probably the bits in this
document minus sections 3 and 5).  It feels a little strange to me
to do it all in a single document, as this does, but I wouldn't let
that stop us from doing it.

-Ben

---

From: Benjamin Kaduk <[email-masked]>
Date: Sun, 10 Dec 2017 15:58:32 -0600

> document minus sections 3 and 5).  It feels a little strange to me

A little bird points out that sections 3 and 5 are what Rich was
uncertain of, but it is sections 4, 6, and 7 that Ekr did not think
were appropriate, which is perhaps more authoritative.

> that stop us from doing it.

And all in all, the mentioned sections are basically the entire
document.  So, I have to revise my opinion to "this document as-is
doesn't make much sense, but we might consider separate
document(s) for the one or two sections that may still remain".

-Ben

---

From: "Mark D. Baushke" <[email-masked]>
Date: Sun, 10 Dec 2017 23:36:22 -0800

For what it is worth, I would like to see SSH use of arcfour in RFC4253
and arcfour128 and arcfour256 in rfc4345 deprecated.

I do not know if this needs to be a separate document or not, but I
think the CURdle WG changes to SSH are in scope.

	-- Mark