Re: [Curdle] State of draft-ietf-curdle-ssh-kex-sha2?

["Mark D. Baushke" <[e-mail]>]

Hi denis,

denis bider <[e-mail]> writes:

> Hey everyone,
> 
> I notice the following draft has not moved forward:
> 
> https://datatracker.ietf.org/doc/draft-ietf-curdle-ssh-kex-sha2/
> 
> This seems to be an important draft which would standardize the
> current use of key exchange algorithms in SSH. However, it looks like
> no changes have been made in 2.5 years?

Correct.

> Did I miss some event where this draft morphed into something else so
> that I'm not seeing the right information about progress?

I have not progressed the draft, mostly due to private email received
over two years ago...

A number of people told me to not move it forward until after all of the
RFCs for draft-ietf-curdle-ssh-curves (now RFC 8731) and
draft-ietf-curdle-gss-keyex-sha2 (now RFC 8732) were adopted. Also, many
people were unhappy with the characterizations of the existing
algorithms and my scoring of MUST, SHOULD, and MAY

In addition, there was a general dislike for the references of the NSA
documents provided or the CNSA document reference.

> Otherwise, what seems to be the current obstacle with making progress
> on this?

I think that work on the document is desirable. Does anyone wish to be a
co-author with me?

I would like to see more opinions on the list about which algorithms are
to be 'SHOULD NOT' and which are to be 'MUST' ... in general, I would
like to see this document as a KEX refernce that may be updated every
few years as we learn more about which KEX algorithms are best to use.

My opinion for Section 5 as I write this email today is:

      Key Exchange Method Name             Reference  Implement
      ------------------------------------ ---------- ----------
      curve25519-sha256                    RFC8731    SHOULD
      curve448-sha512                      RFC8731    MAY
      diffie-hellman-group-exchange-sha1   RFC4419    SHOULD NOT
      diffie-hellman-group-exchange-sha256 RFC4419    MAY
      diffie-hellman-group1-sha1           RFC4253    SHOULD NOT
      diffie-hellman-group14-sha1          RFC4253    SHOULD NOT
      diffie-hellman-group14-sha256        RFC8268    SHOULD
      diffie-hellman-group15-sha256        RFC8268    MAY
      diffie-hellman-group16-sha512        RFC8268    MUST
      diffie-hellman-group17-sha512        RFC8268    MAY
      diffie-hellman-group18-sha512        RFC8268    MAY
      ecdh-sha2-*                          RFC5656    MAY
      ecdh-sha2-nistp256                   RFC5656    SHOULD
      ecdh-sha2-nistp384                   RFC5656    SHOULD
      ecmqv-sha2                           RFC5656    MAY
      ext-info-c                           RFC8308    SHOULD
      ext-info-s                           RFC8308    SHOULD
      gss-*                                RFC4462    MAY
      gss-curve25519-sha256-*              RFC8732    SHOULD
      gss-curve448-sha512-*                RFC8732    MAY
      gss-gex-sha1-*                       RFC4462    SHOULD NOT
      gss-group1-sha1-*                    RFC4462    SHOULD NOT
      gss-group14-sha256-*                 RFC8732    SHOULD
      gss-group15-sha512-*                 RFC8732    MAY
      gss-group16-sha512-*                 RFC8732    SHOULD
      gss-group17-sha512-*                 RFC8732    MAY
      gss-group18-sha512-*                 RFC8732    MAY
      gss-nistp256-sha256-*                RFC8732    SHOULD
      gss-nistp384-sha384-*                RFC8732    MAY
      gss-nistp521-sha512-*                RFC8732    MAY
      rsa1024-sha1                         RFC4432    MUST NOT
      rsa2048-sha256                       RFC4432    MAY

The above list of KEX algorithms comes from the IANA ssh-parameters list
URL:
https://www.iana.org/assignments/ssh-parameters/ssh-parameters.xhtml#ssh-parameters-16

Please let me know if I have missed any of the KEX algorithms in the
list.

Of these, I am not sure if rsa2048-sha256 has support for a 'MAY' or if
its lack of use would drive it to a 'SHOULD NOT' in the table.

To be honest, I am really not sure which KEX algorithms should be listed
as Mandatory To Implement (MTI) for key exchanges going forward.

Which diffie-hellman FFC group should be listed as MTI? group14-sha256
or group16-sha512? (I tentatively selected this one). Is that wise?
Should any FFC Diffie-Hellman group size be MTI?

I would like to hear if others on this list believe that
curve25519-sha256 should be a MUST or a SHOULD.

I also do not know if the expired draft-ietf-curdle-ssh-kex-sha2
document should bother to give opinions on any of the KEX options other
than those being deprecated or thrust into MTI. Opinions please?

It seems clear to me that removing the *-sha1* KEX algorithms is a good
idea. I would love to move diffie-hellman-group14-sha1, but I honestly
suspect that some hardware is deployed for which it is the only KEX
algorithm that may still need to be supported... which is the only
reason it is a 'SHOULD' on my list instead of a 'SHOULD NOT' ...

        Be safe, stay healthy,
        -- Mark