Subject: RE: PROPOSAL: Minimum Authentication and transport level encrypti on for CAP

From: Paul Leach <[email-masked]>
Date: Wed, 12 May 1999 19:14:13 -0700

> -----Original Message-----
> From: John Stracke [mailto:[email-masked]]
> Sent: Wednesday, May 12, 1999 6:57 PM
> To: [email-masked]
> Cc: [email-masked]; Paul Leach
> Subject: Re: PROPOSAL: Minimum Authentication and transport level
> encryption for CAP
> 
> 
> [email-masked] wrote:
> 
> > I'd like to propose that, within the SASL framework
> > the "Must" authenticate be DIGEST-MD5 [1]
> > and the the "Must" transport level encryption be
> > a US-Exportable DES.

As I wrote, this wouldn't get past the IESG.

> 
> Is it possible to have the MUST be something with parameterized
> strength? For example, "all implementations MUST support 
> X-bit DES, and
> MUST support negotiating what X is at runtime"? Then one could say, "I
> can go up to 1024-bit", and the other could say, "I can go up to
> 96-bit", so they'd use 96-bit.  (They'd probably also want to express
> minimal strengths ["I can't talk unless we use at least 256-bit"].)

The spec can handle this, but not exactly in the way you say.

> 
> My reasoning here is that we don't want to set a MUST based on the
> current political climate (especially since, at the moment, US export
> controls may be in abeyance).  Besides, so what if 1024-bit can't be
> exported? If I develop a 1024-bit program in the US, and 
> Andre develops
> one in Canada, they can talk to each other without the software ever
> being exported.
> 
> (On the other hand, if encryption is mandatory, compliant CAP software
> cannot be used in France at all.)

It's mandatory to implement, not mandatory to deploy, so if the local
government forbids you do deploy it, that's OK as far as the standard is
concerned.

Also, France did a complete flip-flop last I heard. They allow strong
encryption -- stronger than US companies can export to them.

Paul

---

From: John Stracke <[email-masked]>
Date: Thu, 13 May 1999 03:17:33 +0000

Paul Leach wrote:

> It's mandatory to implement, not mandatory to deploy,

I don't catch the distinction.  A piece of software that is speaking a
protocol either meets all the MUSTs or it doesn't comply with the
protocol.  Whether that noncompliance is because the vendor didn't ship a
feature or because one was disabled is not relevant to interoperability.

(I don't mean to be argumentative; I suspect there's a useful distinction
here that I just haven't encountered before.)

> Also, France did a complete flip-flop last I heard.

Ah, good.

--
/=============================================================\
|John Stracke    | My opinions are my own | S/MIME & HTML OK  |
[email-masked]|============================================|
|Chief Scientist | NT's lack of reliability is only surpassed |
|eCal Corp.      |  by its lack of scalability. -- John Kirch |
\=============================================================/