--- 1/draft-ietf-curdle-rc4-die-die-die-06.txt 2018-08-09 08:13:17.623941406 -0700 +++ 2/draft-ietf-curdle-rc4-die-die-die-07.txt 2018-08-09 08:13:17.635941693 -0700 @@ -1,29 +1,27 @@ Internet Engineering Task Force (IETF) L. Camara -Internet-Draft January 26, 2018 -Obsoletes: 4345 (if approved) +Internet-Draft L.Velvindron +Obsoletes: 4345 (if approved) July 22, 2018 Updates: 4253 (if approved) Intended Status: Best Current Practice -Expires: July 30, 2018 +Expires: July 22, 2018 Deprecating RC4 in Secure Shell (SSH) - draft-ietf-curdle-rc4-die-die-die-06 + draft-ietf-curdle-rc4-die-die-die-07 [[RFC-Editor: please replace the second character of my surname by -U+00E2 when publishing as RFC in the header and in all pages. -Non-ASCII characters are allowed in RFCs as per RFC 7997.]] +U+00E2 when publishing as RFC in the header and in all pages.]] Abstract This document deprecates RC4 in Secure Shell (SSH). Therefore, this - document updates RFC 4253, and formally obsoletes and moves to - Historic RFC 4345. + document updates RFC 4253, and moves to Historic RFC 4345. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at http://datatracker.ietf.org/drafts/current/. @@ -58,22 +56,28 @@ 4. IANA Considerations . . . . . . . . . . . . . . . . . . . . . . 2 5. Security Considerations . . . . . . . . . . . . . . . . . . . . 3 6. Acknowlegdements . . . . . . . . . . . . . . . . . . . . . . . 3 7. References . . . . . . . . . . . . . . . . . . . . . . . . . . 3 7.1. Normative References . . . . . . . . . . . . . . . . . . . . 3 7.2. Informative References . . . . . . . . . . . . . . . . . . . 3 8. Author's Address . . . . . . . . . . . . . . . . . . . . . . . 3 1. Introduction - RC4 is broken [RFC7457] and this document deprecates its use in - Secure Shell (SSH). + The usage of RC4 suites ( also designated as arcfour ) for SSH are + specified in [RFC 4253] and [RFC 4345]. [RFC 4253] specifies the + allocation of the "arcfour" cipher for SSH. RFC 4345 specifies and + allocates the the "arcfour-128" and "arcfour-256" ciphers for SSH. + + RC4 encryption is steadily weakening in cryptographic strength [RFC7457] + [draft-ietf-curdle-des-des-des-die-die-die-05] and the deprecation process + should be begun for their use in SSH. The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119, RFC8174] when, and only when, they appear in all capitals, as shown here. 2. Why obsolete and move to Historic RFC 4345 RFC 4345 defines the "arcfour-128" and "arcfour-256" modes for SSH, @@ -128,10 +132,14 @@ [[RFC-Editor: please replace the 'i' in my name by U+00ED and the first 'a' in the surname by U+00E2, as non-ASCII characters are allowed as per RFC 7997]] 8. Author's Address Luis Camara EMail: + + Loganaden Velvindron + + EMail: