Re: [Curdle] RFC 8308 on Extension Negotiation in the Secure Shell (SSH) Protocol

[denis bider <[e-mail]>]

EXT_INFO with the "server-sig-algs" extension is widely deployed. It's well
tested with rsa-sha2-256 and rsa-sha2-512 signatures, and I have no
concerns about it. As far as I know, there are no compatibility issues to
be experienced by an implementation that follows the just-published spec.

Where I'm less comfortable is the hinges that are not yet widely deployed.
As long as a hinge is not in common use, it is in danger of rusting. These
hinges include:

- EXT_INFO sent by client (only server sends it for "server-sig-algs").

- Extensions with binary extension-value (for example "delay-compression").

Both of these hinges will be exercised in our next SSH Server and Client
versions (8.xx). However, our implementation has presence on only one
platform, so I would love to see "delay-compression" implemented more
widely so that these hinges do not rust.

This hinge did already rust in the initial implementation by OpenSSH
(binary extension-value caused disconnect until version 7.5).

"delay-compression" involves both client-side EXT_INFO and a binary
extension-value, so it is the single most effective thing to implement to
avoid rust.



On Wed, Mar 21, 2018 at 12:48 AM, Peter Gutmann <[e-mail]>
wrote:

> denis bider <[e-mail]> writes:
>
> >That depends - which extensions do you have in mind to test? In what way
> in
> >particular would you like to test them?
>
> It was actually meant for both of the new RFCs, the RSA one to
> regression-test
> that nothing has broken since versions based on the drafts were written
> (e.g.
> in regard to fixed- vs variable-length RSA blocks :-), the extension one
> just
> to check that extensions sent and received are correctly handled without
> anything choking.  The actual extension doesn't matter, just the message
> flow
> handling.
>
> >If you are looking for "server-sig-algs", this is by now fairly widely
> >implemented in e.g. the latest versions of OpenSSH, and Bitvise SSH Server
> >and Client versions 7.xx.
>
> OK, I'll see if I can set up a recent OpenSSH to bounce some messages
> off.  I
> just want to make sure that both RSA and extension messages are handled
> correctly.
>
> Peter.