Re: [Curdle] Which curves are MUST and SHOULD ?

[Ron Frederick <[e-mail]>]

On Dec 10, 2020, at 4:38 PM, Peter Gutmann <[e-mail]> wrote:
> Mark D. Baushke <mdb=[e-mail]> writes:
>> MAY diffie-hellman-group14-sha1
>> SHOULD NOT diffie-hellman-group-exchange-sha1
> 
> Just wondering why the hardcoded group is MAY but the negotiated, and probably
> more secure, group is SHOULD NOT?  Is it because lots of legacy stuff will
> only do the hardcoded group?


I imagine the reasoning behind most of these being SHOULD NOT is due to the use of SHA-1. As for making an exception for group14-sha1, I think the intent there was that it was one of the most commonly implemented algorithms due to it being one of two REQUIRED algorithms in RFC 4253. This proposal drops it from being REQUIRED, but still allows it for interoperability with older implementations that didn’t add support for anything stronger.

I agree that diffie-hellman-group-exchange-sha1 could in theory be more secure than diffie-hellman-group14-sha1, but I think it makes more sense to encourage implementations to support diffie-hellman-group-exchange-sha256. It’s nearly as widely implemented as the SHA-1 version of group exchange, and much stronger.

Mark Baushke wrote:
> I am NOT certain about the nistp384 and nistp521. They are not
> consistent between the ecdh-sha2-nistp* and gss-nistp* forms.
> They most likely are best at SHOULD for all four of them.

SHOULD for all of these works for me.

Regarding the nistp curves vs. curve25519, I also have a personal bias toward curve25519, but I worry about it being much less widely implemented than the nistp curves. I’m not sure we’ve seen wide enough implementation to justify move curve25519-sha256 to be a “MUST”. Even if we include the older naming of “[e-mail]”, it’s still only about half as widely implemented as the ECDH/ECDSA nistp algorithms.

Unfortunately, this still leaves us with a question about how we get at least one MUST in the algorithm list.
-- 
Ron Frederick
[e-mail]