Re: [Curdle] Second AD Review: draft-ietf-curdle-ssh-curves.

[Benjamin Kaduk <[e-mail]>]

On Tue, Jul 30, 2019 at 03:23:22PM -0700, Mark D. Baushke wrote:
> Benjamin Kaduk <[e-mail]> writes:
> 
> > I took over as responsible AD for this draft from Eric, but I don't
> > see any response to this second round of review comments.  Luckily there's
> > mot much left, so hopefully we can get a new rev out quickly and move the
> > document forward.
> 
> I do owe the AD a response to the comments and a new draft.
> I regret that other commitments have prevented me from this.

I completely understand; my main goal is to ensure that *I* was not the one
holding things up, as there are quite a few things for which that is the
case at the moment.

(BTW, if anyone feels there is some urgency to getting these documents
published, the chairs can appoint a new document editor to handle the
mechanical text juggling and document submission.  That might be less
feasible for the other document, though, given the volume of comments Eric
made.)

-Ben

> 
> > Thanks,
> > 
> > Ben
> > 
> > On Mon, Dec 24, 2018 at 02:16:24PM -0800, Eric Rescorla wrote:
> > > Thanks for addressing my comments.
> > > 
> > > IMPORTANT
> > > S 3.
> > >    
> > > >      received public keys are not the expected lengths, or if the
> > > >      derived shared secret only consists of zero bits. No further
> > > >      validation is required beyond what is discussed in [RFC7748].
> > > >      The derived shared secret is 32 bytes when Curve25519 is used
> > > >      and 56 bytes when Curve448 is used. The encodings of all
> > > >      values are defined in [RFC7748]. The hash used is SHA-256 for
> > > >      Curve25519 and SHA-512 for Curve448.
> > > 
> > > This is true if you use the 7748 algorithm, but not necessarily
> > > otherwise.
> > > 
> > > Here is some OK language (from tcpcrypt)
> > > 
> > >    Key-agreement schemes ECDHE-Curve25519 and ECDHE-Curve448 perform
> > >    the Diffie-Helman protocol using the functions X25519 and X448,
> > >    respectively. Implementations SHOULD compute these functions
> > >    using the algorithms described in [RFC7748]. When they do so,
> > >    implementations MUST check whether the computed Diffie-Hellman
> > >    shared secret is the all-zero value and abort if so, as described
> > >    in Section 6 of [RFC7748]. Alternative implementations of these
> > >    functions SHOULD abort when either input forces the shared secret
> > >    to one of a small set of values, as discussed in Section 7 of
> > >    [RFC7748].
> > >
> > > COMMENTS
> > > S 1.
> > > >      key exchange protocol described in [RFC4253] supports an extensible
> > > >      set of methods.  [RFC5656] describes how elliptic curves are
> > > >      integrated in SSH, and this document reuses those protocol messages.
> > > >
> > > >      This document describes how to implement key exchange based on
> > > >      Curve25519 and Ed448-Goldilocks [RFC7748] in SSH.  For Curve25519
> > > 
> > > 7748 calls this Curve448 and you do so later, so please be consistent.
> 
> 	-- Mark