Re: draft-harris-ssh-arcfour-fixes-02: informational or proposed?

["william(at)elan.net" <william at elan.net>]

On Wed, 1 Jun 2005, Keith Moore wrote:

> > The argument in favor of publishing this document at proposed is that
> > the existing arcfour cipher is part of a standard and that many other
> > IETF protocols use rc4 in standards track documents.
>
> previous mistakes are not valid justifications for new mistakes.
> previous accidents are not valid justifications for deliberately weakening
> new products.

Keith,

I think you're right in general. But in this specific case its not a
"new product". SSH already uses RC4, the change is increasing size
of key that maybe used. Admittedly it does not fix problems with SSH
using RC4 in general, but the update provide for better security
then current system and is definitely not weakening it.

--
William Leibzon
Elan Networks
william at elan.net

_______________________________________________
Ietf mailing list
Ietf at ietf.org
https://www1.ietf.org/mailman/listinfo/ietf