RFC 8423

Reclassification of Suite B Documents to Historic Status

📅 published July 2018, from ietf

Reclassification of Suite B Documents to Historic Status 💖

Request for Comments: 8423 🎀 (this is the number, bestie, remember it)

Category: Informational 🌸 (not a standard, just here for the info)

ISSN: 2070-1721

Authors: R. Housley from Vigil Security and L. Zieglar from the National Security Agency 🧚

Date: July 2018 📅

Obsoletes / Updates: the header doesn't list any RFCs as obsoleted or updated. What this one actually does is move ten older RFCs over to Historic status 🦋

Abstract ✨

okay so this doc reclassifies the RFCs about the United States National Security Agency (NSA) Suite B cryptographic algorithms as Historic, and it explains why 💅 It moves seven Informational RFCs to Historic status: RFCs 5759, 6239, 6318, 6379, 6380, 6403, and 6460. It also moves three obsolete Informational RFCs to Historic status: RFCs 4869, 5008, and 5430 🔥

Status of This Memo 🫶

This document is not an Internet Standards Track specification. It's published for informational purposes only 📚

This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It went through public review and got approved for publication by the Internet Engineering Steering Group (IESG). Not every document the IESG approves is a candidate for any level of Internet Standard, so see Section 2 of RFC 7841 for more on that 🌈

You can find info about the current status of this document, any errata, and how to send feedback at https://www.rfc-editor.org/info/rfc8423 💜

Copyright (c) 2018 IETF Trust and the persons identified as the document authors. All rights reserved ©️

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) as they stand on the date this document was published. Please read these documents carefully, because they explain your rights and restrictions when it comes to this document 🙈 Code Components pulled out of this document must include the Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they come without warranty, as described in the Simplified BSD License ⚠️

Table of Contents 🗂️

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
   2.  Rationale . . . . . . . . . . . . . . . . . . . . . . . . . .   3
   3.  The RFCs Related to Suite B . . . . . . . . . . . . . . . . .   3
   4.  Documents That Reference the Suite-B-Related RFCs . . . . . .   3
     4.1.  Documents That Reference RFC 4869 . . . . . . . . . . . .   4
     4.2.  Documents That Reference RFC 5759 . . . . . . . . . . . .   4
     4.3.  Documents That Reference RFC 6379 . . . . . . . . . . . .   4
     4.4.  Documents That Reference RFC 6403 . . . . . . . . . . . .   4
     4.5.  Documents That Reference RFC 6460 . . . . . . . . . . . .   5
   5.  Impact of Reclassifying the Suite-B-Related RFCs to Historic    5
   6.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .   5
   7.  Security Considerations . . . . . . . . . . . . . . . . . . .   5
   8.  References  . . . . . . . . . . . . . . . . . . . . . . . . .   6
     8.1.  Normative References  . . . . . . . . . . . . . . . . . .   6
     8.2.  Informative References  . . . . . . . . . . . . . . . . .   7
   Authors' Addresses  . . . . . . . . . . . . . . . . . . . . . . .   8

1. Introduction 🦋

Several RFCs profile security protocols for use with the National Security Agency (NSA) Suite B Cryptography. Suite B is no longer supported by NSA, and the web pages that spelled out the cryptographic algorithms are gone too 😭

In July 2015, NSA published the Committee for National Security Systems Advisory Memorandum 02-15 as the first step in replacing Suite B with NSA's Commercial National Security Algorithm (CNSA) Suite. You can find info about the CNSA Suite in [CNSA] 📖

2. Rationale 💅

As [CNSA] points out, NSA is moving from Suite B to the CNSA Suite. So the profiles of the security protocols for the Suite B algorithms are now only of historic interest 🕰️✨

Between 2007 and 2012, a bunch of Suite-B-related RFCs got published to profile security protocols for use with the Suite B algorithms. Here they are, iykyk:

  • [RFC4869], "Suite B Cryptographic Suites for IPsec" (Obsoleted by RFC 6379)
  • [RFC5008], "Suite B in Secure/Multipurpose Internet Mail Extensions (S/MIME)" (Obsoleted by RFC 6318)
  • [RFC5430], "Suite B Profile for Transport Layer Security (TLS)" (Obsoleted by RFC 6460)
  • [RFC5759], "Suite B Certificate and Certificate Revocation List (CRL) Profile"
  • [RFC6239], "Suite B Cryptographic Suites for Secure Shell (SSH)"
  • [RFC6318], "Suite B in Secure/Multipurpose Internet Mail Extensions (S/MIME)"
  • [RFC6379], "Suite B Cryptographic Suites for IPsec"
  • [RFC6380], "Suite B Profile for Internet Protocol Security (IPsec)"
  • [RFC6403], "Suite B Profile of Certificate Management over CMS"
  • [RFC6460], "Suite B Profile for Transport Layer Security (TLS)"

These RFCs reference each other a lot, like a whole friend group 👯‍♀️ This doc doesn't dig into those cross-references any further.

Other RFCs also reference these Suite-B-related RFCs, and those references get covered in the subsections below 💜

4.1. Documents That Reference RFC 4869 🌷

One other RFC references RFC 4869 [RFC4869].

RFC 6071, "IP Security (IPsec) and Internet Key Exchange (IKE) Document Roadmap" [RFC6071], points out that RFC 4869 adds four predefined suites based on the Suite B specifications. They are:

  • IKE/ESP suite "Suite-B-GCM-128"
  • IKE/ESP suite "Suite-B-GCM-256"
  • IKE/AH suite "Suite-B-GMAC-128"
  • IKE/AH suite "Suite-B-GMAC-256"

In each case, these suite definitions use algorithms that are defined in other RFCs. No interoperability or security concerns are raised if implementations keep using these suite names ✨

4.2. Documents That Reference RFC 5759 🧚

One other RFC references RFC 5759 [RFC5759].

RFC 6187, "X.509v3 Certificates for Secure Shell Authentication" [RFC6187], points out that RFC 5759 gives extra guidance for Elliptic Curve Digital Signature Algorithm (ECDSA) keys when they're used with Suite B 🫶

8.2. Informative References ✨

Okay, now the informative references, the extra reading that's good to know about 📚

Authors' Addresses 💖

Meet the authors, bestie 🫶

Russ Housley
Vigil Security, LLC
918 Spring Knoll Drive
Herndon, VA  20170
United States of America

Email: housley@vigilsec.com


Lydia Zieglar
National Security Agency
9800 Savage Road
Ft. George G. Meade, MD  20755-6940
United States of America

Email: llziegl@nsa.gov
📦 where this page comes from