Re: [Curdle] new-AD review comments on draft-ietf-curdle-gss-keyex-sha2-08

[Benjamin Kaduk <[e-mail]>]

Hi Mark,

On Wed, May 08, 2019 at 08:42:27AM -0700, Mark D. Baushke wrote:
> Hi Ben,
> 
> In RFC 8268, I tried (and apparently failed) to say that the NSA IAD
> appears to prefer the use of SHA2-384 for TOP SECRET documents, but that
> the SHA2-256, SHA2-384, and SHA2-512 hashing functions are all NIST
> approved for FIPS 140-2 Implementation Guidance.

Given that 8268 still uses SHA-256 it is clearly not forbidden to do so; my
comment here was mostly of an editorial nature, that the word "rationale"
does not seem to match up well with the reference.  I don't think we need
to change what we're doing in this document; we just may want to change how
we talk about what we're doing.

> The rationale for SHA2-384 being 'better' for TOP SECRET is apparently
> that there are 1024 bits in the internal state of the hashing algorithm,
> so 640 bits are kept private while for SHA2-256 there are 512 bits in
> the internal state, half of which are public and half of which are
> private.
> 
> The only weak DH group which should be deprecated is the
> diffie-hellman-group1-sha1 and that mostly because of logjam
> (https://en.wikipedia.org/wiki/Logjam_(computer_security).

I'm not opposed to adding that in to this document (instead of removing the
bit from the abstract), but it might require another IETF LC if we choose
to go that route.

> I have been remiss in addressing the AD comments and submitting an
> updated draft of draft-ietf-curdle-ssh-curves (Secure Shell (SSH) Key
> Exchange Method using Curve25519 and Curve448), so there is no RFC
> listing for those key exchange methods in the IANA repository (URL:
> https://www.iana.org/assignments/ssh-parameters/ssh-parameters.xhtml ).
> 
> I have not yet compared RFC7748 to the implementations of Curve25519
> that exist in many SSH implementations which is one of the reasons that
> draft-ietf-curdle-ssh-curves has not been updated. The draft was trying
> to document a well deployed [e-mail] to ensure
> interoperability.

Thanks for the extra background; let's hope that we can both find some
time to work on our respective backlogs :)

-Ben