Re: a more detailed analysis of "known IV" vulnerability.

[Damien Miller <djm%mindrot.org@localhost>]

On Sat, 16 Mar 2002, RJ Atkinson wrote:

> > I believe this rationale should be carefully explained in the SSH RFC.
> > Otherwise, some readers might get the wrong impression.  Also, it will
> > help inform those who might re-use the SSH encoding transform without
> > also maintaining the upper layers that they are in a danger zone.
> 
> I'm not sure whether the detailed analysis really belongs in the
> core SSH RFCs.  Documenting in some RFC, possibly a parallel RFC
> with Informational status, seems eminently reasonable.

Can we put some text in the "security considerations" referring someone
to a published document without delaying the drafts?

-d