Re: [Curdle] Secdir last call review of draft-ietf-curdle-ssh-kex-sha2-14

[Mališa Vučinić <[e-mail]>]

Hi Mark,

Thanks, see a couple of comments inline, enclosed within [MV] ... [/MV].

Mališa

On 28/02/2021 18:26, "Mark D. Baushke" <[e-mail]> wrote:

    [CC- [e-mail]] This message really only addresses specific
    review comments...
    
    Hi Ben and Mališa and Rene,
    
    Benjamin Kaduk <[e-mail]> writes:
    
    > Hi 
    > 
    > Thanks for the detailed review!
    > 
    > I can only answer for some of the points, so hopefully Mark can chime in as
    > needed.
    
    I will do what I can to address the points raised by everyone.
    
    I do not believe that I can introduce anything about SHA-3 hashing as
    that is not being used by Secure Shell key exchanges today and this is
    really only a survey of the existing key exchanges.

[MV] The comment on SHA-3 was really of an editorial nature as the sentence read too general, see the response to Ben for an easy resolution. [/MV]
    
    I will try to do a better job about the objective requirements.
    
    For example, the use of a 2048-bit MODP group with 112 bits of security
    is fine to protect a 3des-cbc 112 bits of security symmetric cipher.
    However, it is not sufficient to protect an aes128 bit key with 128 bits
    of security. Likewise, a SHA-1 hash with 80 bits or less of security is
    not really good to protect even the 3des-cbc cipher.
    
    The reason I recommended that a 3072-bit MODP group be used was to
    protect aes128 keys. I will try to make that point more explicit.
    
    Thank you for all of the comments. I have to find time to incorporate
    them.
    
    With regard to Rene's question about changing Table 6...
    
    Rene wrote:
    
    > Section 1: “This document updates [RFC4250] [RFC4253] [RFC4432]
    > [RFC4462] by changing the requirement level ("MUST" moving to "SHOULD"
    > or "MAY" or "SHOULD NOT", and "MAY" moving to "MUST" or "SHOULD" or
    > "SHOULD NOT" or "MUST NOT") of various key-exchange mechanisms.” - The
    > specific updates to these documents are spread out throughout the text
    > and pretty hard to grasp. It would be nice to see Table 6 updated, by
    > adding the reference RFC that is being updated, alongside the RFC
    > specifying the key exchange method, and maybe an old requirement
    > level.
    
    Table 6 presently has the kex name, RFC reference, and the
    implementation guidance for the method. This is intended to be what
    becomes the IANA table for key exchange method names. I am not entirely
    sure I understand what is desired. Some methods do not have any language
    about MUST, SHOULD, or MAY implement. So, the previous history is not
    really defined. This is how the table might look if I list "none" for
    those that are not called out in their RFCs:

[MV] 
I believe this was a comment I made. The underlying issue here is that when I was going through the doc, I had a hard time understanding the specific updates to the referenced RFCs. The proposal above was a means to resolve that. If you find that too clumsy, feel free to propose any other way of making it explicit what exactly is being updated within those documents.
[/MV]
    
       +==========================+===========+================+===========+
       | Key Exchange Method      | Reference | Previous       | Implement |
       | Name                     |           | Recommendation |           |
       +==========================+===========+================+===========+
       | curve25519-sha256        | RFC8731   | none           | SHOULD    |
       +--------------------------+-----------+----------------+-----------+
       | curve448-sha512          | RFC8731   | none           | MAY       |
       +--------------------------+-----------+----------------+-----------+
       | diffie-hellman-group-    | RFC4419   | none           | SHOULD    |
       | exchange-sha1            | RFC8270   |                | NOT       |
       +--------------------------+-----------+----------------+-----------+
       | diffie-hellman-group-    | RFC4419   | none           | MAY       |
       | exchange-sha256          | RFC8720   |                |           |
       +--------------------------+-----------+----------------+-----------+
       | diffie-hellman-          | RFC4253   | MUST           | SHOULD    |
       | group1-sha1              |           |                | NOT       |
       +--------------------------+-----------+----------------+-----------+
       | diffie-hellman-          | RFC4253   | MUST           | MAY       |
       | group14-sha1             |           |                |           |
       +--------------------------+-----------+----------------+-----------+
       | diffie-hellman-          | RFC8268   | none           | MUST      |
       | group14-sha256           |           |                |           |
       +--------------------------+-----------+----------------+-----------+
       | diffie-hellman-          | RFC8268   | none           | MAY       |
       | group15-sha512           |           |                |           |
       +--------------------------+-----------+----------------+-----------+
       | diffie-hellman-          | RFC8268   | none           | SHOULD    |
       | group16-sha512           |           |                |           |
       +--------------------------+-----------+----------------+-----------+
       | diffie-hellman-          | RFC8268   | none           | MAY       |
       | group17-sha512           |           |                |           |
       +--------------------------+-----------+----------------+-----------+
       | diffie-hellman-          | RFC8268   | none           | MAY       |
       | group18-sha512           |           |                |           |
       +--------------------------+-----------+----------------+-----------+
       | ecdh-sha2-*              | RFC5656   | MAY            | MAY       |
       +--------------------------+-----------+----------------+-----------+
       | ecdh-sha2-nistp256       | RFC5656   | MUST           | SHOULD    |
       +--------------------------+-----------+----------------+-----------+
       | ecdh-sha2-nistp384       | RFC5656   | MUST           | SHOULD    |
       +--------------------------+-----------+----------------+-----------+
       | ecdh-sha2-nistp521       | RFC5656   | MUST           | SHOULD    |
       +--------------------------+-----------+----------------+-----------+
       | ecmqv-sha2               | RFC5656   | MAY            | MAY       |
       +--------------------------+-----------+----------------+-----------+
       | ext-info-c               | RFC8308   | SHOULD         | SHOULD    |
       +--------------------------+-----------+----------------+-----------+
       | ext-info-s               | RFC8308   | SHOULD         | SHOULD    |
       +--------------------------+-----------+----------------+-----------+
       | gss-*                    | RFC4462   | none           | MAY       |
       +--------------------------+-----------+----------------+-----------+
       | gss-                     | RFC8732   | SHOULD         | SHOULD    |
       | curve25519-sha256-*      |           |                |           |
       +--------------------------+-----------+----------------+-----------+
       | gss-curve448-sha512-*    | RFC8732   | MAY            | MAY       |
       +--------------------------+-----------+----------------+-----------+
       | gss-gex-sha1-*           | RFC4462   | none           | SHOULD    |
       |                          |           |                | NOT       |
       +--------------------------+-----------+----------------+-----------+
       | gss-group1-sha1-*        | RFC4462   | none           | SHOULD    |
       |                          |           |                | NOT       |
       +--------------------------+-----------+----------------+-----------+
       | gss-group14-sha256-*     | RFC8732   | none           | SHOULD    |
       +--------------------------+-----------+----------------+-----------+
       | gss-group15-sha512-*     | RFC8732   | none           | MAY       |
       +--------------------------+-----------+----------------+-----------+
       | gss-group16-sha512-*     | RFC8732   | none           | MAY       |
       +--------------------------+-----------+----------------+-----------+
       | gss-group17-sha512-*     | RFC8732   | none           | MAY       |
       +--------------------------+-----------+----------------+-----------+
       | gss-group18-sha512-*     | RFC8732   | none           | MAY       |
       +--------------------------+-----------+----------------+-----------+
       | gss-nistp256-sha256-*    | RFC8732   | none           | SHOULD    |
       +--------------------------+-----------+----------------+-----------+
       | gss-nistp384-sha384-*    | RFC8732   | none           | SHOULD    |
       +--------------------------+-----------+----------------+-----------+
       | gss-nistp521-sha512-*    | RFC8732   | none           | SHOULD    |
       +--------------------------+-----------+----------------+-----------+
       | rsa1024-sha1             | RFC4432   | none           | MUST NOT  |
       +--------------------------+-----------+----------------+-----------+
       | rsa2048-sha256           | RFC4432   | none           | MAY       |
       +--------------------------+-----------+----------------+-----------+
    
    I am not sure if this table is now too busy to be in the IANA table or
    not and ask for suggestions to make the IANA table more useful.
    
    My goal is to upload a -15 revision of the document on or soon after
    March 8th when submissions are open again.

[MV] Great, thanks! [/MV]
    
    	Be safe, stay healthy,
    	-- Mark