Re: [Curdle] Kathleen Moriarty's Yes on draft-ietf-curdle-ssh-dh-group-exchange-05: (with COMMENT)

[Ben Campbell <[e-mail]>]

> On Sep 15, 2017, at 9:04 AM, Spencer Dawkins at IETF <[e-mail]> wrote:
> 
> So, Kathleen's ballot thread, but since she and I share this curiosity …

Same here :-)

> >
> > I do agree with Spencer, the text that is non-normative reads as if this is
> > fully deprecating any recommendation below 2048, but then the normative text
> > just says SHOULD.  Is there a reason this is not MUST?  I know deprecating
> > things takes a long time.
> 
> Yes, it takes a long time, and also because of backward compatibility.
> We felt that "SHOULD" was sufficient at the time.
> 
> That doesn't surprise me (speaking only for myself).
> 
> It might be helpful to add a sentence explaining that the SHOULD is for backward compatibility.
> 
> That changes the incentives a bit - implementers have more incentive to implement a SHOULD if it's not a MUST *yet*, but when the community stops worrying about backward compatibility, it could be, and then other implementations won't interop with yours.
> 
> And, for extra credit, that could happen suddenly, if someone posts a clever attack on 1024-bit keys that requires minimal computing resources and includes an implementation that anyone can pick up ... so everyone else stops accepting shorter keys, like, today.
> 
> But do the right thing, of course.

I agree with Spencer’s comments, especially the one about adding text to explain the SHOULDs.

I also understand the need for a transition period. However, unconstrained SHOULDs leave things open ended. Was that the intent of the working group? Is there an expectation that these might be revised to MUSTs sometime in the future?

IIRC, Benoit mentioned the idea of logging or surfacing a warning if you receive less than 2048 bits. That seems like a good idea.

Thanks!

Ben.