Re: [Curdle] Looking for comments on draft-ietf-curdle-ssh-kex-sha2

[Hubert Kario <[e-mail]>]

On Monday, 23 November 2020 22:54:17 CET, Mark D. Baushke wrote:
> Hi Folks,
>
> I have uploaded draft-ietf-curdle-ssh-kex-sha2-12 which is a large
> rewrite of the text to adress the structural comments made by Eric
> Rescorla.
>
> It is probably best to review the document from scratch to see if the
> flow and issues with older crypto primitives (sha-1) lead to the
> conclusions being drawn.
>
> There may not yet be full agreement about the summary guidance for Key
> Exchange Method Names.
>
> The diffie-hellman-group1-sha1 exchange was a mandatory to implement and
> is now a SHOULD NOT. I could move it to MUST NOT if everyone else thinks
> it best.

+1 for a MUST NOT, though I'm ok with keeping it at SHOULD NOT

people that need it for interoperability, will use it irrespective of what
RFC says, but new deployments should require the user to jump through
at least one hoop to make it work

> The diffie-hellman-group14-sha1 exchange was a mandatory to implement
> MUST and is now a SHOULD. Similarly for gss-group1-sha1-*

no, I think it should be SHOULD NOT, the sha-1 disqualifies it

> The rsa1024-sha1 exchange is now a MUST NOT.
>
> I have suggested that diffie-hellman-group14-sha256 be a MUST (mandatory
> to implement).
>
> A plurality of the list seemed to be in favor of this, but if 2048-bit
> (112 bits of security) is falling out of favor (along with 3DES), then
> perhaps a different KeX is desirable to be MUST.

while small security margin of 3DES is a factor for its deprecation, the 
most
problematic part of 3DES is the 64 bit block size

and AFAIK, we're not even considering deprecation of 2048 bit RSA in the 
web
PKIX, so, I don't see any arguments against making group14 mandatory

-- 
Regards,
Hubert Kario
Senior Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 115, 612 00  Brno, Czech Republic