Re: [Curdle] Secdir last call review of draft-ietf-curdle-ssh-kex-sha2-14

["Mark D. Baushke" <[e-mail]>]

[CC- [e-mail]] This message really only addresses specific
review comments...

Hi Ben and Mališa and Rene,

Benjamin Kaduk <[e-mail]> writes:

> Hi 
> 
> Thanks for the detailed review!
> 
> I can only answer for some of the points, so hopefully Mark can chime in as
> needed.

I will do what I can to address the points raised by everyone.

I do not believe that I can introduce anything about SHA-3 hashing as
that is not being used by Secure Shell key exchanges today and this is
really only a survey of the existing key exchanges.

I will try to do a better job about the objective requirements.

For example, the use of a 2048-bit MODP group with 112 bits of security
is fine to protect a 3des-cbc 112 bits of security symmetric cipher.
However, it is not sufficient to protect an aes128 bit key with 128 bits
of security. Likewise, a SHA-1 hash with 80 bits or less of security is
not really good to protect even the 3des-cbc cipher.

The reason I recommended that a 3072-bit MODP group be used was to
protect aes128 keys. I will try to make that point more explicit.

Thank you for all of the comments. I have to find time to incorporate
them.

With regard to Rene's question about changing Table 6...

Rene wrote:

> Section 1: “This document updates [RFC4250] [RFC4253] [RFC4432]
> [RFC4462] by changing the requirement level ("MUST" moving to "SHOULD"
> or "MAY" or "SHOULD NOT", and "MAY" moving to "MUST" or "SHOULD" or
> "SHOULD NOT" or "MUST NOT") of various key-exchange mechanisms.” - The
> specific updates to these documents are spread out throughout the text
> and pretty hard to grasp. It would be nice to see Table 6 updated, by
> adding the reference RFC that is being updated, alongside the RFC
> specifying the key exchange method, and maybe an old requirement
> level.

Table 6 presently has the kex name, RFC reference, and the
implementation guidance for the method. This is intended to be what
becomes the IANA table for key exchange method names. I am not entirely
sure I understand what is desired. Some methods do not have any language
about MUST, SHOULD, or MAY implement. So, the previous history is not
really defined. This is how the table might look if I list "none" for
those that are not called out in their RFCs:

   +==========================+===========+================+===========+
   | Key Exchange Method      | Reference | Previous       | Implement |
   | Name                     |           | Recommendation |           |
   +==========================+===========+================+===========+
   | curve25519-sha256        | RFC8731   | none           | SHOULD    |
   +--------------------------+-----------+----------------+-----------+
   | curve448-sha512          | RFC8731   | none           | MAY       |
   +--------------------------+-----------+----------------+-----------+
   | diffie-hellman-group-    | RFC4419   | none           | SHOULD    |
   | exchange-sha1            | RFC8270   |                | NOT       |
   +--------------------------+-----------+----------------+-----------+
   | diffie-hellman-group-    | RFC4419   | none           | MAY       |
   | exchange-sha256          | RFC8720   |                |           |
   +--------------------------+-----------+----------------+-----------+
   | diffie-hellman-          | RFC4253   | MUST           | SHOULD    |
   | group1-sha1              |           |                | NOT       |
   +--------------------------+-----------+----------------+-----------+
   | diffie-hellman-          | RFC4253   | MUST           | MAY       |
   | group14-sha1             |           |                |           |
   +--------------------------+-----------+----------------+-----------+
   | diffie-hellman-          | RFC8268   | none           | MUST      |
   | group14-sha256           |           |                |           |
   +--------------------------+-----------+----------------+-----------+
   | diffie-hellman-          | RFC8268   | none           | MAY       |
   | group15-sha512           |           |                |           |
   +--------------------------+-----------+----------------+-----------+
   | diffie-hellman-          | RFC8268   | none           | SHOULD    |
   | group16-sha512           |           |                |           |
   +--------------------------+-----------+----------------+-----------+
   | diffie-hellman-          | RFC8268   | none           | MAY       |
   | group17-sha512           |           |                |           |
   +--------------------------+-----------+----------------+-----------+
   | diffie-hellman-          | RFC8268   | none           | MAY       |
   | group18-sha512           |           |                |           |
   +--------------------------+-----------+----------------+-----------+
   | ecdh-sha2-*              | RFC5656   | MAY            | MAY       |
   +--------------------------+-----------+----------------+-----------+
   | ecdh-sha2-nistp256       | RFC5656   | MUST           | SHOULD    |
   +--------------------------+-----------+----------------+-----------+
   | ecdh-sha2-nistp384       | RFC5656   | MUST           | SHOULD    |
   +--------------------------+-----------+----------------+-----------+
   | ecdh-sha2-nistp521       | RFC5656   | MUST           | SHOULD    |
   +--------------------------+-----------+----------------+-----------+
   | ecmqv-sha2               | RFC5656   | MAY            | MAY       |
   +--------------------------+-----------+----------------+-----------+
   | ext-info-c               | RFC8308   | SHOULD         | SHOULD    |
   +--------------------------+-----------+----------------+-----------+
   | ext-info-s               | RFC8308   | SHOULD         | SHOULD    |
   +--------------------------+-----------+----------------+-----------+
   | gss-*                    | RFC4462   | none           | MAY       |
   +--------------------------+-----------+----------------+-----------+
   | gss-                     | RFC8732   | SHOULD         | SHOULD    |
   | curve25519-sha256-*      |           |                |           |
   +--------------------------+-----------+----------------+-----------+
   | gss-curve448-sha512-*    | RFC8732   | MAY            | MAY       |
   +--------------------------+-----------+----------------+-----------+
   | gss-gex-sha1-*           | RFC4462   | none           | SHOULD    |
   |                          |           |                | NOT       |
   +--------------------------+-----------+----------------+-----------+
   | gss-group1-sha1-*        | RFC4462   | none           | SHOULD    |
   |                          |           |                | NOT       |
   +--------------------------+-----------+----------------+-----------+
   | gss-group14-sha256-*     | RFC8732   | none           | SHOULD    |
   +--------------------------+-----------+----------------+-----------+
   | gss-group15-sha512-*     | RFC8732   | none           | MAY       |
   +--------------------------+-----------+----------------+-----------+
   | gss-group16-sha512-*     | RFC8732   | none           | MAY       |
   +--------------------------+-----------+----------------+-----------+
   | gss-group17-sha512-*     | RFC8732   | none           | MAY       |
   +--------------------------+-----------+----------------+-----------+
   | gss-group18-sha512-*     | RFC8732   | none           | MAY       |
   +--------------------------+-----------+----------------+-----------+
   | gss-nistp256-sha256-*    | RFC8732   | none           | SHOULD    |
   +--------------------------+-----------+----------------+-----------+
   | gss-nistp384-sha384-*    | RFC8732   | none           | SHOULD    |
   +--------------------------+-----------+----------------+-----------+
   | gss-nistp521-sha512-*    | RFC8732   | none           | SHOULD    |
   +--------------------------+-----------+----------------+-----------+
   | rsa1024-sha1             | RFC4432   | none           | MUST NOT  |
   +--------------------------+-----------+----------------+-----------+
   | rsa2048-sha256           | RFC4432   | none           | MAY       |
   +--------------------------+-----------+----------------+-----------+

I am not sure if this table is now too busy to be in the IANA table or
not and ask for suggestions to make the IANA table more useful.

My goal is to upload a -15 revision of the document on or soon after
March 8th when submissions are open again.

	Be safe, stay healthy,
	-- Mark