Subject: [kitten] Fwd: New Version Notification for draft-kaduk-kitten-des-des-des-die-die-die-00.txt

From: Benjamin Kaduk <[email-masked]>
Date: Fri, 6 Mar 2015 15:02:20 -0500 (EST)

It's probably about time to start thinking about deprecating RC4/3DES...

-Ben

---------- Forwarded message ----------
Date: Fri, 6 Mar 2015 14:48:48 -0500
From: [email-masked]
To: Michiko Short <[email-masked]>, Benjamin Kaduk <[email-masked]>,
    Michiko Short <[email-masked]>, Benjamin Kaduk <[email-masked]>
Subject: New Version Notification for
    draft-kaduk-kitten-des-des-des-die-die-die-00.txt

A new version of I-D, draft-kaduk-kitten-des-des-des-die-die-die-00.txt
has been successfully submitted by Benjamin Kaduk and posted to the
IETF repository.

Name:		draft-kaduk-kitten-des-des-des-die-die-die
Revision:	00
Title:		Deprecate 3DES and RC4 in Kerberos
Document date:	2015-03-06
Group:		Individual Submission
Pages:		8
URL:            http://www.ietf.org/internet-drafts/draft-kaduk-kitten-des-des-des-die-die-die-00.txt
Status:         https://datatracker.ietf.org/doc/draft-kaduk-kitten-des-des-des-die-die-die/
Htmlized:       http://tools.ietf.org/html/draft-kaduk-kitten-des-des-des-die-die-die-00

Abstract:
   The 3DES and RC4 encryption types are steadily weakening in
   cryptographic strength, and the deprecation process should be begun
   for their use in Kerberos.

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat

---

From: Chaskiel Grundman <[email-masked]>
Date: Fri, 6 Mar 2015 15:28:08 -0500

I'm not going to object to the principle of deprecating DES3, but
claiming that AES "quickly followed" DES3 is inaccurate. The first
mention of DES3 in the mit krb5 commit history is

Author: tytso <tytso@dc483132-0cff-0310-8789-dd5450dbe970>
Date:   Thu Jan 11 03:29:50 1996 +0000

    Fix return type for mit_des3_string_to_key().

    git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@7297
dc483132-0cff-0310-8789-dd5450dbe970

It also appeared in the first heimdal release in 1999 (but GSSAPI did
not interop with MIT until somewhere between late 0.3 and 0.6.)

Some AES code appeared in MIT krb5 in 2003, but I don't know if it
corresponds to what was standardized in rfc3962 in 2005. Heimdal did
not release AES until 0.7 in 2005

---

From: Tom Yu <[email-masked]>
Date: Fri, 06 Mar 2015 15:49:24 -0500

> dc483132-0cff-0310-8789-dd5450dbe970

I believe that krb5-1.2 (around 2000) was the first to have substantial
support for DES3.  krb5-1.1 (around 1999) only supported it for ticket
encryption, not session keys.  It might also have been a variant that
didn't do key derivation.

> not release AES until 0.7 in 2005

Thanks for the historical information.  I think it's most important to
note that we believe that deployed code that supports DES3 but not
AES is rare, partly as a result of this history.  Please provide some
more details if there is evidence to the contrary.

-Tom

---

From: Benjamin Kaduk <[email-masked]>
Date: Mon, 9 Mar 2015 22:27:50 -0400 (EDT)

> more details if there is evidence to the contrary.

It was somewhat difficult to tell from just the commit logs when a given
feature (enctype) was fully present and functional/supported, since they
seem to have come in piecewise everywhere.  I'm not sure if release notes
are any better, but I agree that we should try to do a better job of
research before publishing this document.

-Ben

---

From: Jeffrey Altman <[email-masked]>
Date: Tue, 10 Mar 2015 19:06:51 -0400

> didn't do key derivation.

DES3 support was a point of issue with Microsoft in late 1998/1999 when
the Common Solutions Group was invited to Redmond for meetings regarding
the feature set for Windows 2000.

DES3 support was standardized in Telnet in RFCs 2947 and 2948 based upon
the prior existence of DES3 support in Kerberos 5.  The RFCs were
published in September 2000 and the work on them began more than a year
before that which means that DES3 was deployed at Columbia in mid-1999.

Rijndael was announced as the AES algorithm in October 2000. The first
AES support was added to MIT krb5 by

commit e697a50c77314b0294b3a94329fb82e0c8692e56
Author: Ken Raeburn <[email-masked]>
Date:   Mon Feb 3 21:10:25 2003 +0000

    AES implementation by Briad Gladman; tweaked for krb5 tree

    git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@15141
dc483132-0cff-0310-8789-dd5450dbe970

and was released as part of MIT krb5 1.3.

Jeffrey Altman

---

From: Tom Yu <[email-masked]>
Date: Sun, 15 Mar 2015 17:45:18 -0400

Section 6.1: Several instances of des-cbc-sha1-kd should probably be
des3-cbc-sha1-kd.  On the other hand, RFC 3961 isn't consistent about
whether the algorithm name is des3-cbc-sha1-kd, des3-cbc-hmac-sha1-kd,
or des3-hmac-sha1-kd.

Also in Section 6.1: The single-DES enctype family doesn't use n-fold;
it uses a "fan-fold" that alternately reverses 56-bit chunks.  I think
the other observations in that section about the des3 string-to-key
algorithm are true.