Re: [Curdle] Looking for comments on draft-ietf-curdle-ssh-kex-sha2

[Hubert Kario <[e-mail]>]

On Thursday, 26 November 2020 21:46:12 CET, Tero Kivinen wrote:
> Mark D. Baushke writes:
>> I could add this informative reference:
>> 
>>     Karthikeyan Bhargavan, Gaeutan Leurent. Transcript Collision Attacks:
>>     Breaking Authentication in TLS, IKE, and SSH. Network and Distributed
>>     System Security Symposium -- NDSS 2016, Feb 2016, San Diego, United
>>     States. 10.14722/ndss.2016.23418 . hal-01244855 ...
>
> I think it would be good idea to add that reference, even when it do
> consider that attack against ssh impractical with 2^77 work, but it do
> warn about not including weak ciphers in the list, and warn about the
> group exchange. 

SHA-1 resistance against 2nd preimage is still at 160 bits, but as SSH 
doesn't
depend on that, but rather on chosen prefix resistance, that's a 
significant
mind-shift

also, 2^77 work is similar to attacking 1024 bit DH or 1024 RSA, and I 
don't
think we have any arguments against deprecating those; besides,
"impractical" != "safe", for "safe" we generally require a work factor of 
2^128

-- 
Regards,
Hubert Kario
Senior Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 115, 612 00  Brno, Czech Republic