On Wed, 1 Jun 2005, Keith Moore wrote:
The argument in favor of publishing this document at proposed is that
the existing arcfour cipher is part of a standard and that many other
IETF protocols use rc4 in standards track documents.
previous mistakes are not valid justifications for new mistakes.
previous accidents are not valid justifications for deliberately weakening
new products.
Keith,
I think you're right in general. But in this specific case its not a
"new product". SSH already uses RC4, the change is increasing size
of key that maybe used. Admittedly it does not fix problems with SSH
using RC4 in general, but the update provide for better security
then current system and is definitely not weakening it.
--
William Leibzon
Elan Networks
william@xxxxxxxx
_______________________________________________
Ietf@xxxxxxxx
https://www1.ietf.org/mailman/listinfo/ietf