Subject: PROPOSAL: Minimum Authentication and transport level encryption f or CAP

From: [email-masked]
Date: Wed, 12 May 1999 16:00:23 -0400

One very important decision this group has to decide
is the MUST implement for secure authentication 
and transport-level encryption.

I'd like to propose that, within the SASL framework
the "Must" authenticate be DIGEST-MD5 [1]
and the the "Must" transport level encryption be 
a US-Exportable DES. I think that 48 bit simple
DES is exportable.

* Reasons to support the proposal for DIGEST-MD5:
1-Well known and well documented
2-Reasonably secure
3-Fits well in the CAP with the SASL framework
4-Easy to implement. 

* Reasons to support 48bit key simple DES encryption:
1-Well known and well documented
2-Reasonably secure, yet exportable. (Some may debate that
if it is US-exportable, it is not secure )
3-Easy to implement.

Any thoughts ?

[1] draft-leach-digest-sasl-03.txt, Chris Newman, Paul Leach.

Andre Courtemanche
CS&T

---

From: John Stracke <[email-masked]>
Date: Thu, 13 May 1999 01:57:21 +0000

[email-masked] wrote:

> a US-Exportable DES.

Is it possible to have the MUST be something with parameterized
strength? For example, "all implementations MUST support X-bit DES, and
MUST support negotiating what X is at runtime"? Then one could say, "I
can go up to 1024-bit", and the other could say, "I can go up to
96-bit", so they'd use 96-bit.  (They'd probably also want to express
minimal strengths ["I can't talk unless we use at least 256-bit"].)

My reasoning here is that we don't want to set a MUST based on the
current political climate (especially since, at the moment, US export
controls may be in abeyance).  Besides, so what if 1024-bit can't be
exported? If I develop a 1024-bit program in the US, and Andre develops
one in Canada, they can talk to each other without the software ever
being exported.

(On the other hand, if encryption is mandatory, compliant CAP software
cannot be used in France at all.)

--
/=============================================================\
|John Stracke    | My opinions are my own | S/MIME & HTML OK  |
[email-masked]|============================================|
|Chief Scientist | NT's lack of reliability is only surpassed |
|eCal Corp.      |  by its lack of scalability. -- John Kirch |
\=============================================================/