Subject: Re: [Ietf-krb-wg] Comments on Adopting draft-hudson-krbwg-camellia-cts-02 as a work item

From: Thomas Hardjono <[email-masked]>
Date: Fri, 8 Jul 2011 10:41:48 -0400

Hi Stephen,

Comments inline below.

> -----Original Message-----
> From: Stephen Farrell [mailto:[email-masked]]
> Sent: Friday, July 08, 2011 4:21 AM
> To: Thomas Hardjono
> Cc: Sam Hartman; [email-masked]; [email-masked]
> Subject: Re: [Ietf-krb-wg] Comments on Adopting draft-hudson-krbwg-
> camellia-cts-02 as a work item
> 
> 
> Hi Thomas,
> 
> On 08/07/11 01:02, Thomas Hardjono wrote:
> >
> > Hi Stephen,
> >
> >>> So, I'd be quite interested in knowing who actually
> >>> (currently) wants Camellia for kerberos as part of this
exercise.
> >
> > This work (Camellia support in Kerberos) originated from joint
work
> > between the MIT-KC and NTT.
> > The first draft was submitted by NTT in March 2010, but after
several
> > revisions we finally settled for the CTS-based solution (which is
the
> > current draft under consideration).
> >
> > In terms of user community, NTT and several other companies in
Japan
> > want to use Kerberos with a cipher other than AES. Since the
Camellia
> > cipher itself is already an ISO standard (ISO/IEC 18033-3),
> 
> Seems like that's true for almost all algorithms that show up. I'm
not
> clear what the requirements are there.

I think it is useful to distinguish drafts on ciphers as:

(a) Defining the cipher itself, or 
(b) Standardizing how the cipher *retrofits* into one 
    or more IETF-defined protocols.

What we are asking from the Kerberos WG and the IETF is (b),
since Camellia is already defined as (a) by an ISO standard spec.
That is, we want an RFC saying if you want to run Camellia 
with Kerberos, the security experts in the Kerberos WG says you
must/should do it in a particular way (eg. CTS mode, block sizes, etc
etc).

In terms of requirements, I think there is a strong requirement 
on the part of vendors who must sell into the Japanese market. 
There are already over two dozen vendor products today that 
implement Camellia in one mode or another.
I believe this draft will help them when they have to deal
with Kerberos.

> 
> > we thought it a reasonable
> > to support Camellia in Kerberos.
> 
> So I'd be interested if several other folks also said they wanted
this.
> (I'm not insisting, but I am asking.)

I guess I'm not sure who you mean by "several other folks". 
Did you mean inside the Kerberos WG or also outside the IETF.

I'm guessing that this work item will not impact that many 
people in the Kerberos WG (other than the reviewers). 
Having said that, I don't think lack of popularity is 
sufficient reason to reject any work-item.

> 
> > ps.  There is already RFC4132 covering Camellia in TLS.
> > And I believe there are other Camellia-related drafts in other
WGs.
> 
> Maybe we need to think about this - there's a constant stream of
new-
> cipher-with-TLS drafts, just because one of those got through
doesn't
> mean that we should follow suit in other WGs without being happy
with
> the algorithm, its IPR environment, performance etc.

I agree with your sentiment, but I think this is 
unavoidable/inevitable seeing that IETF is the home 
of many Internet protocols (eg. IPsec, IKE, TLS, Kerberos, etc)
and the IETF does claim itself to be an International organization.

It should not be surprising if every time there is a new 
cipher (regardless of its security-quality), 
there will be a corresponding desire to retrofit the 
cipher to one of more IETF protocols.

> I guess that's one cfrg/saag really - what's the preferred thing to
> have in most places as an alternative to AES?

Perhaps it is time for the IAB and IESG to publish an IETF policy 
document regarding support for new cipher. 
It would make life easier for ADs and chairs.

/thomas/

> S.
> 
> >
> > Hope this helps.
> >
> > cheers,
> >
> > /thomas/
> >
> >
> >
> > ________________________________________
> > From: [email-masked]
> > [[email-masked]] On Behalf Of Stephen Farrell
> > [[email-masked]]
> > Sent: Thursday, July 07, 2011 7:00 PM
> > To: Sam Hartman
> > Cc: [email-masked]
> > Subject: Re: [Ietf-krb-wg] Comments on Adopting
> > draft-hudson-krbwg-camellia-cts-02 as a work item
> >
> > Hi Sam,
> >
> > On 29/06/11 15:14, Sam Hartman wrote:
> >> It's my understanding that
> >> we have a consensus to specify some Camellia enctype.
> > ...
> >> Please send comments by July 10.
> >
> > Could I add a request to yours?
> >
> > We see a fairly constant stream of "new cipher for foo"
> > requests and, as ADs, Sean and I generally ask "which WG
wants/needs
> > this?" and push back if the answer is none. The basis for asking
> being
> > that we don't think that having seven different ciphers for foo is
> > generally helpful unless there's a reason.
> >
> > So, I'd be quite interested in knowing who actually
> > (currently) wants Camellia for kerberos as part of this exercise.
> > Actually, if/when this I-D comes up for an AD review then that'll
be
> > my first question.
> >
> > I'm not sure if that was something that happened already in the WG
or
> > not, if so, then a pointer to the archive would be appreciated,
but
> > I'd still be interested in current opinions.
> >
> > Thanks,
> > Stephen.
> > _______________________________________________
> > ietf-krb-wg mailing list
> > [email-masked]
> > https://lists.anl.gov/mailman/listinfo/ietf-krb-wg
> >
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Tom Yu <[email-masked]>
Date: Tue, 12 Jul 2011 11:13:13 -0400

> It would make life easier for ADs and chairs.

The existing krb-wg charter text guidance on choosing informational vs
standards-track for new crypto algorithms is:

> * Prepare, review, and advance standards-track and informational
> specifications defining use of new cryptographic algorithms in
> Kerberos using the RFC3961 framework. Cryptographic algorithms
> intended for standards track status must be of good quality, have
> broad international support, and fill a definite need.

The above text is modeled after a proposed policy that has been
brought up by the Security Area Directors recently.

Which of these criteria is in doubt for Camellia?
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Simon Josefsson <[email-masked]>
Date: Tue, 12 Jul 2011 22:20:35 +0200

> Which of these criteria is in doubt for Camellia?

What is the 'definite need' for Camellia in Kerberos?

/Simon