[Curdle] Second AD Review: draft-ietf-curdle-ssh-curves.

[Eric Rescorla <[e-mail]>]

Thanks for addressing my comments.

IMPORTANT
S 3.
>      received public keys are not the expected lengths, or if the derived
>      shared secret only consists of zero bits.  No further validation is
>      required beyond what is discussed in [RFC7748].  The derived shared
>      secret is 32 bytes when Curve25519 is used and 56 bytes when Curve448
>      is used.  The encodings of all values are defined in [RFC7748].  The
>      hash used is SHA-256 for Curve25519 and SHA-512 for Curve448.

This is true if you use the 7748 algorithm, but not necessarily
otherwise.

Here is some OK language (from tcpcrypt)

 Key-agreement schemes ECDHE-Curve25519 and ECDHE-Curve448 perform the
   Diffie-Helman protocol using the functions X25519 and X448,
   respectively.  Implementations SHOULD compute these functions using
   the algorithms described in [RFC7748].  When they do so,
   implementations MUST check whether the computed Diffie-Hellman
shared
   secret is the all-zero value and abort if so, as described in
   Section 6 of [RFC7748].  Alternative implementations of these
   functions SHOULD abort when either input forces the shared secret
to
   one of a small set of values, as discussed in Section 7 of
[RFC7748].
COMMENTS
S 1.
>      key exchange protocol described in [RFC4253] supports an extensible
>      set of methods.  [RFC5656] describes how elliptic curves are
>      integrated in SSH, and this document reuses those protocol messages.
>
>      This document describes how to implement key exchange based on
>      Curve25519 and Ed448-Goldilocks [RFC7748] in SSH.  For Curve25519

7748 calls this Curve448 and you do so later, so please be consistent.