Subject: RE: [TLS] Status of IDEA

From: <[email-masked]>
Date: Fri, 4 Jan 2008 11:15:10 +0200

Hovav Shacham wrote:

> Weighing in late, I support "MUST NOT."  The conservative
> interpretation of an absence of extensive studies of a block cipher
> is that the security of that cipher cannot be relied upon.  And
> there is no reason now to prefer IDEA to AES.  I think "MUST NOT"
> will do the best job of steering implementations towards
> known-secure cipher suites.

IMHO "MUST NOT" is totally inappropriate mechanism for conveying
opinions about the amount and/or quality of security reviews done for 
some particular algorithm. (RFC 2119 also gives guidance that MUSTs 
must be used sparingly.)

While most folks will indeed prefer AES over anything else, the
reasons why people prefer one algorithm over another vary. E.g.,
presumably more people have looked at AES than Camellia (RFC 4132) 
or SEED (RFC 4162), but some folks may be perfectly happy with
the reviews those latter two have received (and may have other
reasons for preferring them).

Best regards,
Pasi

_______________________________________________
TLS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tls

---

From: "Blumenthal, Uri" <[email-masked]>
Date: Fri, 4 Jan 2008 12:03:40 -0500

IMHO, there are several reasons not to use IDEA - some are security-related and some aren't - and to make sure that standard-compliant implementations avoid using this algorithm (and the surest way to avoid using is not implementing).

IMHO in IETF lingo "MUST NOT" conveys this meaning.

On 1/4/08 4:15 AM, "[email-masked]" <[email-masked]> wrote:

Best regards,
Pasi

--
Regards,
Uri

---

From: Martin Rex <[email-masked]>
Date: Mon, 7 Jan 2008 14:22:12 +0100 (MET)

> some particular algorithm. (RFC 2119 also gives guidance that MUSTs 

I also think that "MUST NOT implement" for IDEA ciphersuites is entirely
inappropriate.  Lacking a convincing reason, I believe that even
"MUST NOT negotiate for TLS v1.2" for the IDEA ciphersuites would
be inappropriate.

> reasons for preferring them).

There are many more crypto algorithms that are uncommon (Gost, CAST,
*fish and other participants of the AES contest.  Reasons for their
use in certain environments are manyfold, including legacy, licensing
and political.  I can not see a compelling reason why IDEA should
be treated any different than the others.

-Martin