Subject: [secdir] secdir review of draft-housley-suite-b-to-historic-04

From: Taylor Yu <[email-masked]>
Date: Tue, 24 Apr 2018 03:51:34 +0000

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG.  These comments were written primarily for the benefit of the
security area directors.  Document editors and WG chairs should treat
these comments just like any other last call comments.

The summary of the review is Ready with Nits.

It's not clear to me whether there are any replacement specs for the
crypto suites being declared Historic.  Are the remaining crypto suites
for these protocols of comparable strength and security properties?

More concretely, Section 5 says:

"5.  Impact of Reclassifying the Suite-B-related RFCs to Historic

   No interoperability or security concerns are raised by reclassifing
   the Suite-B-related RFCs to Historic Status."

It would be helpful to have some explanation.  For example, is it true
that none of the RFCs being moved to Historic Status is the sole
specification of an algorithm or an identifier for an algorithm that we
expect people to continue using?

Also there's a typo: "reclassifing" should be "reclassifying".

Similarly, in Section 7:

"7.  Security Considerations

   The CNSA Suite includes algorithms using the larger key sizes that
   are included in Suite B.  There are no interoperability or security
   concerns raised by reclassifying the Suite-B-related RFCs to Historic
   Status."

Will there be forthcoming specs for using CNSA Suite algorithms with
these protocols?

Best regards,
-Taylor

---

From: Paul Wouters <[email-masked]>
Date: Tue, 24 Apr 2018 11:08:14 -0400 (EDT)

>   concerns raised by reclassifying the Suite-B-related RFCs to Historic

This text is interesting as I see two statements by the US government
on the CNSA Suite.

The first one is at:

https://www.iad.gov/iad/programs/iad-initiatives/cnsa-suite.cfm

Which claims the CNSA Suite is not published yet, but there is a
transition set of algorithms to use.

The second one is at:

https://www.iad.gov/iad/library/ia-guidance/ia-solutions-for-classified/algorithm-guidance/cnsa-suite-and-quantum-computing-faq.cfm

Which lists the same algorithms, but no longer calls these a transition
list but the actual CNSA Suite.

Regardless, since I think the IETF should not be advertising a single
governments crypto standards, I think this document would be better of
not mentioning CNSA in Section 7 at all. We shouldn't have stamped Suite B
in the IETF either, but we were young and naive at the time. So let's
not stamp CNSA as a "successor" in any kind of way. The only thing this
document should do is move Suite B to Historic.

I would suggest something like this for Section 7:

 	The algorithms and key sizes from Suite B, where these algorithms
 	and key sizes were published by the IETF, have been obsoleted or
 	updated by new and more secure algorithms and key sizes. Please
 	see the respective IANA registries and RFC updates for the
 	specific algorithm usage within their specific protocols.

I'm fine with mentioning CNSA in Section 2.

Paul

---

From: Russ Housley <[email-masked]>
Date: Tue, 24 Apr 2018 11:48:28 -0400

> On Apr 23, 2018, at 11:51 PM, Taylor Yu <[email-masked]> wrote:
> 

Yes, it is true that the conventions for using these algorithms are specified in other documents.  The Suite B profile documents make reference to those other documents.

Section 4.5 points to the one document that makes reference to one of the Suite B profile document as a citation for a ciphersuite.  Both of these ciphersuites are defined in RFC 5289, which would have been a better reference.

> Also there's a typo: "reclassifing" should be "reclassifying".

Indeed.

> Will there be forthcoming specs for using CNSA Suite algorithms with

There will be documents, but unlike the Suite B profiles, the IESG will not be asked to approve them as Informational RFCs.

Russ

---

From: Russ Housley <[email-masked]>
Date: Tue, 24 Apr 2018 11:51:46 -0400

> On Apr 24, 2018, at 11:08 AM, Paul Wouters <[email-masked]> wrote:
> 

I think that last sentence of the existing Security Considerations should remain:

   ... There are no interoperability or security
   concerns raised by reclassifying the Suite-B-related RFCs to Historic
   Status.

In fact, I think it should be said first.

> I'm fine with mentioning CNSA in Section 2.

Good.  I think it is useful information.

Russ

---

From: Paul Wouters <[email-masked]>
Date: Tue, 24 Apr 2018 12:02:25 -0400 (EDT)

> In fact, I think it should be said first.

Indeed, I agree with that. I only object to the first sentence
mentioning CNSA. Just removing it without replacement text would
work too for me.

Paul