Re: [Curdle] draft-ietf-curdle-ssh-kex-sha2 and diffie-hellman-group1-sha1 (1024-bit DH)

["Mark D. Baushke" <[e-mail]>]

Hi Folks,

In the wake of the IETF 99 Curdle meeting, I am in the process of
updating the draft-ietf-curdle-ssh-kex-sha2 draft. The following are the
summary of changes:

 - remove use of SHOULD+ and SHOULD-

 - enumerate all of the Key exchange methods. The table will still have
   only the non-default "MAY" values, but all entries will exist with a
   brief indication stating that they MAY be implemented instead of
   the stronger SHOULD or MUST or SHOULD NOT or MUST NOT.

 - I am listing diffie-hellman-group1-sha1 as a SHOULD NOT (because it
   was a MUST preiously), but I am also listing gss-group1-sha1-* as a
   SHOULD NOT for consistency. Is this okay? Or, should I list the gss
   group as a MUST NOT?

 - I am thinking that gss-group14-sha1-* is better as a MAY than a
   SHOULD.

Everything else is MAY, here is the suggested new guidance:

         Key Exchange Method Name           Reference  Implement
         ---------------------------------- ---------- ----------
         curve25519-sha256                  ssh-curves SHOULD
         diffie-hellman-group-exchange-sha1 RFC4419    SHOULD NOT
         diffie-hellman-group1-sha1         RFC4253    SHOULD NOT
         diffie-hellman-group14-sha1        RFC4253    SHOULD
         diffie-hellman-group14-sha256      new-modp   MUST
         diffie-hellman-group16-sha512      new-modp   SHOULD
         ecdh-sha2-nistp256                 RFC5656    SHOULD
         ecdh-sha2-nistp384                 RFC5656    SHOULD
         gss-gex-sha1-*                     RFC4462    SHOULD NOT
         gss-group1-sha1-*                  RFC4462    SHOULD NOT
         gss-group14-sha256-*               gss-keyex  SHOULD
         gss-group16-sha512-*               gss-keyex  SHOULD
         gss-nistp256-sha256-*              gss-keyex  SHOULD
         gss-nistp384-sha384-*              gss-keyex  SHOULD
         gss-curve25519-sha256-*            gss-keyex  SHOULD
         rsa1024-sha1                       RFC4432    MUST NOT

I also have a new piece of text that tries to describe the section of
SHA256 vs SHA384 vs SHA512. However, I am not sure it is reasonable.
I provide it here for your comments:

    Selecting an appropriate hashing algorithm

       As may be seen from the above, the Key Exchange Methods area
       all using either SHA256 or SHA512 with the exception of the
       ecdh-sha2-nistp384 which uses SHA384.

       The cited CNSA Suite specifies the use of SHA384 and says that
       SHA256 is no longer good enough for TOP SECRET. Nothing is said
       about the use of SHA512. It may be that the internal state of
       1024 bits in both SHA384 and SHA512 makes the SHA384 more
       secure because it does not leak an additional 128 bits of
       state. Of course, use of SHA384 also reduces the security
       strength to 192 bits instead of being 256 bits or more. This
       seems to contradict the desire to double the symmetric key
       strength in order to try to be safe from Post Quantum Computing
       (PQC) attacks given a session key derived from the key
       exchange will be limited to the security strength of the hash
       being used.

       The move away from SHA256 to SHA512 for the newer key exchange
       methods is more to try to slow Grover's algorithm (a PQC
       attack) slightly. It is also the case that SHA2-512 may, in
       many modern CPUs, be implemented more efficiently using 64-bit
       arithmetic than SHA256 which is faster on 32-bit CPUs. The
       selection of SHA384 vs SHA512 is more about reducing the number
       of code point alternatives to negotiate. There seemed to be
       consensus in favor of SHA2-512 over SHA2-384 for key exchanges.

Before I publish -09, it would be nice to see if this list
is reasonable or not for other folks on the list.

Interesting note: I did not find a gss-gex-sha2-* defined in RFC4462.
It is also not found in the I-D.ietf-curdle-gss-keyex-sha2 draft.

	Thank you,
	-- Mark

PS: For completness, here is the list of all of the Key Exchanges
methods in my current copy of the draft.

     3.1.  curve25519-sha256 . . . . . . . . . . . . . . . . . . . .   4
     3.2.  curve448-sha512 . . . . . . . . . . . . . . . . . . . . .   4
     3.3.  diffie-hellman-group-exchange-sha1  . . . . . . . . . . .   4
     3.4.  diffie-hellman-group-exchange-sha256  . . . . . . . . . .   4
     3.5.  diffie-hellman-group1-sha1  . . . . . . . . . . . . . . .   4
     3.6.  diffie-hellman-group14-sha1 . . . . . . . . . . . . . . .   5
     3.7.  diffie-hellman-group14-sha256 . . . . . . . . . . . . . .   5
     3.8.  diffie-hellman-group15-sha512 . . . . . . . . . . . . . .   5
     3.9.  diffie-hellman-group16-sha512 . . . . . . . . . . . . . .   5
     3.10. diffie-hellman-group17-sha512 . . . . . . . . . . . . . .   6
     3.11. diffie-hellman-group18-sha512 . . . . . . . . . . . . . .   6
     3.12. ecdh-sha2-nistp256  . . . . . . . . . . . . . . . . . . .   6
     3.13. ecdh-sha2-nistp384  . . . . . . . . . . . . . . . . . . .   6
     3.14. ecdh-sha2-nistp521  . . . . . . . . . . . . . . . . . . .   6
     3.15. gss-gex-sha1-*  . . . . . . . . . . . . . . . . . . . . .   6
     3.16. gss-group1-sha1-* . . . . . . . . . . . . . . . . . . . .   7
     3.17. gss-group14-sha1-*  . . . . . . . . . . . . . . . . . . .   7
     3.18. gss-group14-sha256-*  . . . . . . . . . . . . . . . . . .   7
     3.19. gss-group15-sha512-*  . . . . . . . . . . . . . . . . . .   7
     3.20. gss-group16-sha512-*  . . . . . . . . . . . . . . . . . .   7
     3.21. gss-group17-sha512-*  . . . . . . . . . . . . . . . . . .   8
     3.22. gss-group18-sha512-*  . . . . . . . . . . . . . . . . . .   8
     3.23. gss-nistp256-sha256-* . . . . . . . . . . . . . . . . . .   8
     3.24. gss-nistp384-sha384-* . . . . . . . . . . . . . . . . . .   8
     3.25. gss-nistp521-sha512-* . . . . . . . . . . . . . . . . . .   8
     3.26. gss-curve25519-sha256-* . . . . . . . . . . . . . . . . .   8
     3.27. gss-curve448-sha512-* . . . . . . . . . . . . . . . . . .   8
     3.28. rsa1024-sha1  . . . . . . . . . . . . . . . . . . . . . .   8
     3.29. rsa2048-sha256  . . . . . . . . . . . . . . . . . . . . .   9