Re: [Curdle] draft-ietf-curdle-ssh-kex-sha2 and diffie-hellman-group1-sha1 (1024-bit DH)

[Damien Miller <[e-mail]>]

On Mon, 17 Jul 2017, Mark D. Baushke wrote:

> Hi Tero,
> 
> Tero Kivinen <[e-mail]> writes:
> 
> > I think it is bad idea to go from MUST to implement algorithm to MUST
> > NOT implement in one step. Especially as this will make all current
> > ssh implementations non-conforming as they do still implement
> > diffie-hellman-group1-sha1 even when it might be disabled by default.
> 
> I see your point.
> 
> > We are defining here a MUST implement and MUST not implement, not MUST
> > use and MUST NOT use recommendations.
> 
> For reference, there are five key exchanges that
> draft-ietf-curdle-ssh-kex-sha2-08 marks as "MUST NOT"
> 
>           Key Exchange Method Name           Reference  Implement
>           ---------------------------------- ---------- ---------
>           diffie-hellman-group1-sha1         RFC4253    MUST NOT
>           diffie-hellman-group-exchange-sha1 RFC4419    MUST NOT
>           gss-gex-sha1-*                     RFC4462    MUST NOT
>           gss-group1-sha1-*                  RFC4462    MUST NOT
>           rsa1024-sha1                       RFC4432    MUST NOT
> 
> Of these, only diffie-hellman-group1-sha1 is moving from MUST to MUST
> NOT. Due to 1024-bit Diffie-Hellman being considered by many as having
> too little security (the same would be true of gss-group1-sha1-*).
> 
> What transition period is desirable for taking group1 "MUST" to "SHOULD
> NOT" to "MUST NOT" ? Is it possible to codify both "SHOULD NOT" and 
> "MUST NOT" time frames into one RFC?

Anecdata: OpenSSH has disabled diffie-hellman-group1-sha1 by default
for approximately two years in the client and for considerably longer in
the server.

Opinion: there's still enough old junk out there that optional support for
diffie-hellman-group1-sha1 is probably necessary for a while longer.
IMO this is probably worth an explicit note in the draft.

-d