From ekr@rtfm.com Wed Dec 20 13:12:40 2023 Return-Path: X-Original-To: curdle@ietfa.amsl.com Delivered-To: curdle@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 987DEC151089 for ; Wed, 20 Dec 2023 13:12:40 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.904 X-Spam-Level: X-Spam-Status: No, score=-6.904 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_HI=-5, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20230601.gappssmtp.com Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tsBwxaFuRFdh for ; Wed, 20 Dec 2023 13:12:38 -0800 (PST) Received: from mail-yb1-xb2c.google.com (mail-yb1-xb2c.google.com [IPv6:2607:f8b0:4864:20::b2c]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 72E9CC151075 for ; Wed, 20 Dec 2023 13:12:38 -0800 (PST) Received: by mail-yb1-xb2c.google.com with SMTP id 3f1490d57ef6-db8892a5f96so108565276.2 for ; Wed, 20 Dec 2023 13:12:38 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20230601.gappssmtp.com; s=20230601; t=1703106757; x=1703711557; darn=ietf.org; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=jutVqOrqib2T7L/cWrXJBHWgBzj0gV6pS3q/onS1akY=; b=pM7xWIzy7QvVGHQz1+EBLjRHyVQuowCGZCnqUvFnb+GfQu3C6AAYGfgc/Fu8VCwKLF wTWBBeeoq1CclxQzk/IdxuGAuhdVEV1UxQwu5lnVnaf56eRU1r6jAwINUy7DvheL0q0P kV4/JLEGzqU+RSbPBhvnnl7AdbZUSlfagSWTk+7ppWKJrytvLhqkJULFtxuzWRQhg7uY Mg5Ni/BJoYLdLB7OCmsW9PpAnR1V4pnybqlXRTGKgdBSQ/GyTl04PuQ40Pu7InmrwDd4 t9gMi7SNhfs49JRImKNpwwKgE0zogfEPGu6s7xlPlFPUAJ+rfo7bWXhxJ7L9k8Q/65NJ XAOA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1703106757; x=1703711557; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=jutVqOrqib2T7L/cWrXJBHWgBzj0gV6pS3q/onS1akY=; b=EKSnBvnjxotE3RTunsm7p0mPUaxZ2fMszSGiI2EH+f2SbSOmgeffxv3KcJ9det9YyD 7t168k/86vakptujBuI1KCzb0KgWX9V2QYRUAykFYHUWWFavJ6osAr7iQdaUWIwQl3QL K5jLxaE4FTv4jHQofYpEvLZazCv2ujHdg5ApJUtUyGMyLAkUPG31yJFziYOKZTYCsZfn gZ/5vb5LDIAht8aDgNhbLCvK5tVQm/rI/2sEfKeX2gsNZlCKX4+4rULGa9rLkv1j1l1s uTrSLnGyNHfTK+y8GmAuAeM5Xm/VT0jXuSeGUvVVmiBCo1wYiQ3rHhpfbMtF2a0pr5UJ agmw== X-Gm-Message-State: AOJu0YzDYmq8uuIaeWux4qHBboK34g2rPqBOtct6Eh6K7z0yuqGTgxZF vsEnbp/ppnRBfy2mMUHK/D/3RiFmLHzVNPIIYF60Aw== X-Google-Smtp-Source: AGHT+IFQGD1CLuk1rjXohaSPFsCZxZY+ZgfEm8SauoGodXW4/gyM3LbzA1uRGXetiX/iNtMqVVUyu/uAbrApeLvRYvg= X-Received: by 2002:a25:8701:0:b0:dbd:b8fa:a0e9 with SMTP id a1-20020a258701000000b00dbdb8faa0e9mr369405ybl.66.1703106757335; Wed, 20 Dec 2023 13:12:37 -0800 (PST) MIME-Version: 1.0 References: <30cd214d9666d142cd8987ead79d5b42.squirrel@mail.ihtfp.org> <20231220163501.GB297455@mit.edu> <2b86631f-1d3c-4a58-a668-233d36368a36@cs.tcd.ie> In-Reply-To: From: Eric Rescorla Date: Wed, 20 Dec 2023 13:12:01 -0800 Message-ID: To: Dmitry Belyavsky Cc: David Schinazi , saag , curdle@ietf.org Content-Type: multipart/alternative; boundary="000000000000493403060cf771fc" Archived-At: Subject: Re: [Curdle] [saag] Time for SSH3? X-BeenThere: curdle@ietf.org X-Mailman-Version: 2.1.39 Precedence: list List-Id: "List for discussion of potential new security area wg." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 20 Dec 2023 21:12:40 -0000 --000000000000493403060cf771fc Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable In Wed, Dec 20, 2023 at 12:42=E2=80=AFPM Dmitry Belyavsky wrote: > Well, TLS 1.3 had to be redesigned to mimic TLS 1.2 and got 50% sites > supporting it only in November 2021 despite all the advantages. > The term "only" here seems a bit surprising, considering that the RFC was published in 2018. As a comparison point, IPv6 is still less than 50% of traffic to Google, even though Google is 100% IPv6 capable. -Ekr > On Wed, 20 Dec 2023, 21:37 David Schinazi, > wrote: > >> I wouldn't compare SSH2 -> SSH3 to IPv4 -> IPv6. IPv6 has been taking >> forever because it requires changing every router on the path. A better >> comparison would be TLS 1.2 -> TLS 1.3, or HTTP/2 -> HTTP/3, as those on= ly >> required modifying the endpoints (for a specific definition of >> endpoint...). And that transition happened quite quickly. I do think it >> makes sense to consider rearchitecting SSH like we did for TLS, but I ag= ree >> with Stephen that we'll need the developers of popular SSH stacks to be >> enthusiastic about such an effort for it to have any chance of success. >> >> David >> >> On Wed, Dec 20, 2023 at 8:37=E2=80=AFAM Stephen Farrell < >> stephen.farrell@cs.tcd.ie> wrote: >> >>> >>> >>> On 20/12/2023 16:35, Theodore Ts'o wrote: >>> > Moreover, if IETF tries to standardize a completely incompatible >>> > protocol rewrite without close coperation with development team(s) of >>> > the dominant implementation(s), the precedent of IPv6 of taking >>> > **decades** to be fully rolled out may be the more relevant >>> > comparison. >>> >>> +1 - if the main developers of SSH implementations were up >>> for starting work on an SSH3, then it'd be a good plan. If >>> they're not, it'd likely be a bad plan. >>> >>> Cheers, >>> S. >>> _______________________________________________ >>> Curdle mailing list >>> Curdle@ietf.org >>> https://www.ietf.org/mailman/listinfo/curdle >>> >> _______________________________________________ >> Curdle mailing list >> Curdle@ietf.org >> https://www.ietf.org/mailman/listinfo/curdle >> > _______________________________________________ > Curdle mailing list > Curdle@ietf.org > https://www.ietf.org/mailman/listinfo/curdle > --000000000000493403060cf771fc Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
In Wed, Dec 20, 2023 at 12:42=E2=80=AFPM Dmitry Belyavsky = <beldmit@gmail.com> wrote:
=
Well, TLS 1.3 had to be redesigned to mimic TLS 1.2 and g= ot 50% sites supporting it only in November 2021 despite all the advantages= .=C2=A0

The term "only" her= e seems a bit surprising, considering that the RFC was published in 2018. A= s a comparison point, IPv6 is still less than 50% of traffic to Google, eve= n though Google is 100% IPv6 capable.

-Ekr


On Wed, 20 Dec 202= 3, 21:37 David Schinazi, <dschinazi.ietf@gmail.com> wrote:<= br>
I wouldn't compare SSH2 -> SSH3 to IPv4 -> IPv6. IPv6 has been t= aking forever because it requires changing every router on the path. A bett= er comparison would be TLS 1.2 -> TLS 1.3, or HTTP/2 -> HTTP/3, as th= ose only required modifying the endpoints (for a specific definition of end= point...). And that transition happened quite quickly. I do think it makes = sense to consider rearchitecting SSH like we did for TLS, but I agree with = Stephen that we'll need the developers of popular SSH stacks to be enth= usiastic about such an effort for it to have any chance of success.
David

On Wed, Dec 20, 2023 at 8:37=E2=80=AFAM Stephen Farr= ell <stephen.farrell@cs.tcd.ie> wrote:


On 20/12/2023 16:35, Theodore Ts'o wrote:
> Moreover, if IETF tries to standardize a completely incompatible
> protocol rewrite without close coperation with development team(s) of<= br> > the dominant implementation(s), the precedent of IPv6 of taking
> **decades** to be fully rolled out may be the more relevant
> comparison.

+1 - if the main developers of SSH implementations were up
for starting work on an SSH3, then it'd be a good plan. If
they're not, it'd likely be a bad plan.

Cheers,
S.
_______________________________________________
Curdle mailing list
Curdle@ietf.org
https://www.ietf.org/mailman/listi= nfo/curdle
_______________________________________________
Curdle mailing list
Curdle@ietf.org
https://www.ietf.org/mailman/listi= nfo/curdle
_______________________________________________
Curdle mailing list
Curdle@ietf.org https://www.ietf.org/mailman/listinfo/curdle
--000000000000493403060cf771fc--