Re: [Curdle] Second AD Review: draft-ietf-curdle-ssh-curves.

[Benjamin Kaduk <[e-mail]>]

I took over as responsible AD for this draft from Eric, but I don't
see any response to this second round of review comments.  Luckily there's
mot much left, so hopefully we can get a new rev out quickly and move the
document forward.

Thanks,

Ben

On Mon, Dec 24, 2018 at 02:16:24PM -0800, Eric Rescorla wrote:
> Thanks for addressing my comments.
> 
> IMPORTANT
> S 3.
> >      received public keys are not the expected lengths, or if the derived
> >      shared secret only consists of zero bits.  No further validation is
> >      required beyond what is discussed in [RFC7748].  The derived shared
> >      secret is 32 bytes when Curve25519 is used and 56 bytes when Curve448
> >      is used.  The encodings of all values are defined in [RFC7748].  The
> >      hash used is SHA-256 for Curve25519 and SHA-512 for Curve448.
> 
> This is true if you use the 7748 algorithm, but not necessarily
> otherwise.
> 
> Here is some OK language (from tcpcrypt)
> 
>  Key-agreement schemes ECDHE-Curve25519 and ECDHE-Curve448 perform the
>    Diffie-Helman protocol using the functions X25519 and X448,
>    respectively.  Implementations SHOULD compute these functions using
>    the algorithms described in [RFC7748].  When they do so,
>    implementations MUST check whether the computed Diffie-Hellman
> shared
>    secret is the all-zero value and abort if so, as described in
>    Section 6 of [RFC7748].  Alternative implementations of these
>    functions SHOULD abort when either input forces the shared secret
> to
>    one of a small set of values, as discussed in Section 7 of
> [RFC7748].
> COMMENTS
> S 1.
> >      key exchange protocol described in [RFC4253] supports an extensible
> >      set of methods.  [RFC5656] describes how elliptic curves are
> >      integrated in SSH, and this document reuses those protocol messages.
> >
> >      This document describes how to implement key exchange based on
> >      Curve25519 and Ed448-Goldilocks [RFC7748] in SSH.  For Curve25519
> 
> 7748 calls this Curve448 and you do so later, so please be consistent.