RE: [Cfrg] RE: [saag] Cryptography Algorithm Choice

["Hallam-Baker, Phillip" <pbaker at verisign.com>]

> >In your example DES is still a MUST for conformance testing but it
> >is a SHOULD NOT as far as security goes.
> 
> Huh? Where in RFC 2407 do you see that? The RFC is completely clear: 
> MUST support DES, "strongly encouraged" to support TripleDES. The 
> waffly words in the IESG note do not say "SHOULD NOT", and the 
> prediction that "it is very likely that the IETF will deprecate the 
> use of ESP_DES as a mandatory cipher suite in the near future" never 
> came to pass.

Since when was RFC status a useful guide to security?

An RFC can recommend ROT13 as an encryption algorithm. Its still a
SHOULD NOT as far as security goes.

The point of my note is that I do NOT regard IETF requirements as
being authoratative on security matters.

_______________________________________________
Cfrg mailing list
Cfrg at ietf.org
https://www1.ietf.org/mailman/listinfo/cfrg