Subject: Re: [Ietf-krb-wg] Comments on Adopting draft-hudson-krbwg-camellia-cts-02 as a work item

From: Thomas Hardjono <[email-masked]>
Date: Wed, 13 Jul 2011 10:39:18 -0400

> -----Original Message-----
> From: [email-masked] [mailto:ietf-krb-wg-
> [email-masked]] On Behalf Of Simon Josefsson
> Sent: Tuesday, July 12, 2011 4:21 PM
> To: Tom Yu
> Cc: [email-masked]; Sam Hartman
> Subject: Re: [Ietf-krb-wg] Comments on Adopting draft-hudson-krbwg-
> camellia-cts-02 as a work item
> 
> Tom Yu <[email-masked]> writes:
> 
> >> * Prepare, review, and advance standards-track and informational
> >> specifications defining use of new cryptographic algorithms in
> >> Kerberos using the RFC3961 framework. Cryptographic algorithms
> >> intended for standards track status must be of good quality, have
> >> broad international support, and fill a definite need.
> >
> > The above text is modeled after a proposed policy that has been
> > brought up by the Security Area Directors recently.
> >
> > Which of these criteria is in doubt for Camellia?
> 
> What is the 'definite need' for Camellia in Kerberos?
> 
> /Simon

Hi Simon,

There are a bunch of companies in Japan that want to use Kerberos but with Camellia present in the code (and can be enabled as a deployment option). Unfortunately this constituency is represented today in the IETF only by NTT (and myself to a certain degree).

So to me there is a 'definite need' for a given market/users (quite a large one).

/thomas/

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Stephen C Buckley <[email-masked]>
Date: Wed, 13 Jul 2011 20:06:14 -0400

On Jul 13, 2011, at 10:39 AM, Thomas Hardjono wrote:

Tom Yu <[email-masked]<mailto:[email-masked]>> writes:

/Simon

Hi Simon,

/thomas/

Sure, but there are bunches of companies everywhere.  Like Nico says we may have no choice about implementing some national crypto based on their local regulations.  But, we can see how that goes.  Remember, it is expensive to implement even for the folks responsible for deploying that at the organizational level to many people.  For example, the Bank of X country is unlikely to encourage its government to force it to incur expense, unless it is beneficial in terms of economics or security.

I recall we decided to move forward on this only because it might provide a handy alternative to AES should it be discovered to be vulnerable.  Although unlikely, we might call it a definite need.

At a totally selfish level, I'd love to see this advance purely as an indication of our desire to see Kerberos use spread and evolve worldwide.

s