{"action":"created","issue":{"url":"https://api.github.com/repos/linuxfoundation/cii-best-practices-badge/issues/365","repository_url":"https://api.github.com/repos/linuxfoundation/cii-best-practices-badge","labels_url":"https://api.github.com/repos/linuxfoundation/cii-best-practices-badge/issues/365/labels{/name}","comments_url":"https://api.github.com/repos/linuxfoundation/cii-best-practices-badge/issues/365/comments","events_url":"https://api.github.com/repos/linuxfoundation/cii-best-practices-badge/issues/365/events","html_url":"https://github.com/linuxfoundation/cii-best-practices-badge/issues/365","id":155096711,"number":365,"title":"Slightly relax crypto_working criterion when standards require their use","user":{"login":"david-a-wheeler","id":813150,"avatar_url":"https://avatars.githubusercontent.com/u/813150?v=3","gravatar_id":"","url":"https://api.github.com/users/david-a-wheeler","html_url":"https://github.com/david-a-wheeler","followers_url":"https://api.github.com/users/david-a-wheeler/followers","following_url":"https://api.github.com/users/david-a-wheeler/following{/other_user}","gists_url":"https://api.github.com/users/david-a-wheeler/gists{/gist_id}","starred_url":"https://api.github.com/users/david-a-wheeler/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/david-a-wheeler/subscriptions","organizations_url":"https://api.github.com/users/david-a-wheeler/orgs","repos_url":"https://api.github.com/users/david-a-wheeler/repos","events_url":"https://api.github.com/users/david-a-wheeler/events{/privacy}","received_events_url":"https://api.github.com/users/david-a-wheeler/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/linuxfoundation/cii-best-practices-badge/labels/criteria","name":"criteria","color":"fbca04"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2016-05-16T18:59:05Z","updated_at":"2016-06-12T00:15:40Z","closed_at":null,"body":"The [crypto_working] criterion currently says:  \"The default project security mechanisms MUST NOT depend on cryptographic algorithms that are broken (e.g., MD4, MD5, single DES, RC4, or Dual_EC_DRBG).\"\r\n\r\nAs it stands this means that systems that implement current standard protocols that rely on older algorithms can never achieve certification. A key case-in-point is Network Time Protocol (NTP).   NTPv4 requires the use of MD5 and 128 bit keys for authentication if authentication is enabled (RFC 5905, section 9.2). The RFC even mentioned in the security considerations section \"While the security shortfalls of the MD5 algorithm are well-known, its use in the NTP specification is consistent with widescale deployment in the Internet community.\"\r\n\r\nI’m very open to tweaking the criterion as long as it doesn’t become an open door to never have strong crypto.  Suggestions on how to carefully word that exception, so it’s carefully limited, would be very welcome.  I don’t see a conflict between “while there’s no better open standard, use the best available” and “we’re working to make the standards better.”  It would make sense to not penalize a project for implementing the most recent version of a widely deployed protocol correctly, and doing it as best as it can do, simply because the protocol it must implement is flawed.\r\n\r\nOne approach would be to add a rider to this question to say \"unless there is no more secure standard available\".\r\n\r\nNicko van Someren (CTO, Linux Foundation) suggests the following longer rewrite of crypto_working:  \"The default project security mechanisms MUST NOT depend on cryptographic algorithms that are broken (e.g., MD4, MD5, single DES, RC4, or Dual_EC_DRBG) unless it is used to implement an interoperable protocol defined in a published standard, the protocol implemented is the most recent published version of that standard, the standard requires the use of such an algorithm and does not offer any more secure alternative. If the most recent, most secure standardised version of the protocol demands that a broken algorithm be used then the documentation MUST describe the security risks and any known mitigations.\"\r\n\r\nNicko notes that, \"While this is rather less succinct than the previous text it I think it is appropriate to limit the exception to cases of interoperability that can not be avoided.  The only other alternative that I can see to this would be to say that if the default security is based on a broken algorithm then you have to have security switched off by default, but that is not a behaviour I want to encourage. In the future I would like to see the badge criteria demand that secure modes of operation are switched on by default but since in many cases that probably means having a valid X.509 certificate installed I think we need to be careful about how we introduce this requirement.\"\r\n\r\nAs this is a potential criterion change, this is related to issue #334."},"comment":{"url":"https://api.github.com/repos/linuxfoundation/cii-best-practices-badge/issues/comments/225401747","html_url":"https://github.com/linuxfoundation/cii-best-practices-badge/issues/365#issuecomment-225401747","issue_url":"https://api.github.com/repos/linuxfoundation/cii-best-practices-badge/issues/365","id":225401747,"user":{"login":"david-a-wheeler","id":813150,"avatar_url":"https://avatars.githubusercontent.com/u/813150?v=3","gravatar_id":"","url":"https://api.github.com/users/david-a-wheeler","html_url":"https://github.com/david-a-wheeler","followers_url":"https://api.github.com/users/david-a-wheeler/followers","following_url":"https://api.github.com/users/david-a-wheeler/following{/other_user}","gists_url":"https://api.github.com/users/david-a-wheeler/gists{/gist_id}","starred_url":"https://api.github.com/users/david-a-wheeler/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/david-a-wheeler/subscriptions","organizations_url":"https://api.github.com/users/david-a-wheeler/orgs","repos_url":"https://api.github.com/users/david-a-wheeler/repos","events_url":"https://api.github.com/users/david-a-wheeler/events{/privacy}","received_events_url":"https://api.github.com/users/david-a-wheeler/received_events","type":"User","site_admin":false},"created_at":"2016-06-12T00:15:40Z","updated_at":"2016-06-12T00:15:40Z","body":"So let me summarize my position:\r\n\r\n1. We should water down the criterion so that it deals *practically* with interoperability, as exemplified by Samba and NTP.\r\n2. We should minimize that watering down and keep the criterion clear.\r\n"}}
{"actor":{"display_login":"david-a-wheeler"}}