Re: [Curdle] AD Review: draft-ietf-curdle-ssh-ext-info-00.txt

> Can you explain what "neutral" means?

Rephrased as:

"The indicator names inserted by the client and server are different to ensure
these names will not produce a match, and therefore not affect the
algorithm chosen in key exchange algorithm negotiation."

> Can a server send ext-info-s if it did not receive ext-info-c?

Certainly. RFC 4253 makes no suggestions that either client or server
should wait for the other with their KEXINIT packet. The server is free to
send KEXINIT before receiving anything from the client.

I have made this clearer by elaborating Section 2.2.

> You need a citation for "elevated."

I have added the following paragraph:

"The terms "elevation" and "elevated" refer to an operating system mechanism
where an administrator user's logon session is associated with two security
contexts: one limited, and one with administrative rights. To "elevate"
such a session is to activate the security context with full administrative
rights. For more information about this mechanism on Windows, see also
[WINADMIN] and [WINTOKEN]."

The informative references are:

WINADMIN:
https://blogs.msdn.microsoft.com/winsdk/2013/03/22/how-to-launch-a-process-as-a-full-administrator-when-uac-is-enabled/

WINTOKEN:
https://msdn.microsoft.com/en-us/library/windows/desktop/bb530718.aspx

denis

On Sat, Jun 17, 2017 at 1:37 PM, Eric Rescorla <ekr@rtfm.com> wrote:

>
> S 2.1.
>   The indicator names inserted by the client and server are different to
>   ensure that these names will not produce a match, and will be neutral
>   with respect to key exchange algorithm negotiation.
>
> Can you explain what "neutral" means?
>
>
> S 2.2.
> If a client or server offers "ext-info-c" or "ext-info-s"
>   respectively, it must be prepared to accept a SSH_MSG_EXT_INFO message
>   from the peer.
>
> Can a server send ext-info-s if it did not receive ext-info-c?
>
>
> S 3.4.
>   A client sends "y" to indicate its preference that the session should
>   be elevated; "n" to not be elevated; and "d" for the server to use its
>   default behavior. If a client does not send the "elevation" extension,
>   the server SHOULD act as if "d" was sent.
>
> You need a citation for "elevated."
>
>
>
> _______________________________________________
> Curdle mailing list
> Curdle@ietf.org
> https://www.ietf.org/mailman/listinfo/curdle
>
>