Re: des-die-die-die and RC4

Simon Josefsson <[email protected]> writes:

> Saying that "implementations SHOULD NOT implement" makes it easy to test
> whether a particular implementation has code for a particular algorithm
> or not.  Saying "implementaters SHOULD NOT provide" appears weaker to
> me.  I read "provide" to permit implementing but disabling by default.

To me, a capability that is implemented but is disabled by default is
still available, and thus still provided.

Imagine changing the "SHOULD NOT" to a "MUST NOT".  I think it's
reasonable to say that given a specification that says "MUST NOT
provide DES", an implementation that implements DES capability but
disables it by default nevertheless still provides it and would _not_
conform.

> I thought we had consensus on the stronger wording to "SHOULD NOT
> implement" which also seems preferrable, thus this change surprised me.

I think there's no difference between "implement" and "provide" from
the perspective of an implementor, but the fact that you appear to
think that there is a difference implies that we do not yet have
consensus about whether to specify that certain capabilities SHOULD
NOT or MUST NOT be enabled by default.  I suspect that if we have
consensus to say something about default behavior, we would also have
consensus to say "MUST NOT enable weak crypto by default".

Do you believe that we should say something explicit about
requirements for default behavior?
_______________________________________________
ietf-krb-wg mailing list
[email protected]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg