Re: [Curdle] call for adoption for draft-mu-curdle-ssh-xmss-00

SSH sessions are frequently established in a quick and short manner. Common
examples:
- Git over SSH will establish a separate SSH session for each remote Git
command.
- There exist file transfer clients (part of business applications and/or
scripts) that will initiate a separate SSH session for each file they
transfer via SFTP.
- There exist file transfer applications that will e.g. connect every 5-15
minutes to check for new files.

SSH is rife with short, ad-hoc sessions in practical usage; as well as long
sessions that can last many days.

On Wed, Nov 20, 2019 at 11:47 AM Panos Kampanakis (pkampana) <
pkampana@cisco.com> wrote:

> I support the adoption of this draft.
>
>
>
> I would like to see the addition of LMS along with XMSS in it. It is
> trivial to add both stateful HBS schemes in the draft.
>
>
>
> I recommend more explicit and clear language in the Security
> Considerations regarding state management (HSMs, other techniques [1]). And
> an informative reference to NIST’s upcoming SP on Stateful HBS and [2].
> Implementers need to be very careful with managing state of these
> signatures and the draft needs to make it clear. Also the security
> considerations need to make clear that SSH makes a good use-case for these
> signatures because SSH tunnels are usually not established in a “quick and
> short” fashion which would make stateful HBS even more risky because of the
> state management requirement.
>
>
>
> Rgs,
>
> Panos
>
>
>
> [1]: https://eprint.iacr.org/2016/357.pdf
>
> [2] https://csrc.nist.gov/Projects/Stateful-Hash-Based-Signatures
>
>
>
>
>
> *From:* Curdle <curdle-bounces@ietf.org> *On Behalf Of *Daniel Migault
> *Sent:* Wednesday, November 20, 2019 9:38 AM
> *To:* curdle <curdle@ietf.org>
> *Subject:* [Curdle] call for adoption for draft-mu-curdle-ssh-xmss-00
>
>
>
> Hi,
>
>
>
> This mail starts a call for adoption for draft-mu-curdle-ssh-xmss-00 XMSS
> public key algorithms for the Secure Shell (SSH) protocol. Please state on
> the mailing list whether you support the adoption of the draft or if you
> have any objection by December 5.
>
>
>
> Yours,
>
> Rich and Daniel
>
>
>
> [1] https://datatracker.ietf.org/doc/draft-mu-curdle-ssh-xmss/
>
>
> _______________________________________________
> Curdle mailing list
> Curdle@ietf.org
> https://www.ietf.org/mailman/listinfo/curdle
>