Re: [Curdle] RSA key transport for SSH (RFC 4432) and forward secrecy

[Benjamin Kaduk <[e-mail]>]

Hi Mark,

On Wed, Feb 10, 2021 at 09:50:58PM -0800, Mark D. Baushke wrote:
> [To+ Ron, Alexandre, mosh-devel, Simon] question on rsa2048-sha256 KeX for SSH
> 
> Summary:
> 
>     Is anyone actively using rsa2048-sha256 for a Ssecure Shell Key
>     exchange per RFC 4432. 
> 
>     The Security Area Director Benjamin Kaduk has concerns regarding
>     this Key Exchange Algorithm (see messagess below).

That perhaps came across stronger than I had hoped for -- AFAIK the RFC
does what it says to do and says what it does; it's just that what it does
may no longer reflect what the IETF currently considers to be best
practices, and I'm pondering how we might go about recording that in some
official-ish way.

>     The IETF Draft
> 
>     https://datatracker.ietf.org/doc/draft-ietf-curdle-ssh-kex-sha2/
> 
>     is presently in Last Call.
> 
>     This draft is in the process of suggesting "MUST NOT" for
>     rsa1024-sha1.
> 
>     The question on the table is if the same rating should be appled to
>     rsa2048-sha256 or if RFC 4432 should itself be moved to historical,
>     or if this is still a useful key exchange being actively used.

To clarify: my intent and expectation was that we consider this question
separately from the advancement of draft-ietf-curdle-ssh-kex-sha2.  We may
want to think on this question for a while, and that draft is otherwise in
good shape and shouldn't be further held up.

>     Ben desires data and it is my suggestion that the supporters for the
>     implementations that provide for rsa2048-sha256 may information on
>     this topic.

Indeed, and thanks for all the responses received so far.

-Ben