Re: [Curdle] draft-ietf-curdle-ssh-kex-sha2 and diffie-hellman-group1-sha1 (1024-bit DH)

["Mark D. Baushke" <[e-mail]>]

Tero Kivinen <[e-mail]> writes:

> Russ Housley writes:
> > I agree with Tero.  However, I like the use of SHOULD+ and MUST- to
> > signal to project and product planners what is coming.   

Thank you for the feedback.

> Actually it is much better to explain that kind of things in the
> actual text. For example:
> 
> 3.5.  diffie-hellman-group14-sha1
> 
>    This method uses [RFC3526] group14 (a 2048-bit MODP group) which has
>    no concerns.  This generated key exchange group uses SHA-1 which has
>    security concerns [RFC6194].  However, this group is still strong
>    enough and is widely deployed.  This method is being moved from MUST
>    to SHOULD- to aid in transition to stronger SHA-2 based hashes. This
>    method will transition to MUST NOT when SHA-2 alternatives are more
>    generally available.
> 
> 
> Gives much better information what to expect than SHOULD- in table.
> SHOULD+, SHOULD- were useful when we only had table of requirement
> levels. Now when we have the text about each algorithm explain the
> reasoning, those + and - characters are getting more and more
> meaningless.

If I add "SHOULD NOT-" to the list and move diffie-hellman-group1-sha1
to it with this text:

      This method uses [RFC7296] Oakley Group 2 (a 1024-bit MODP group)
      and SHA-1 [RFC3174]. Due to recent security concerns with SHA-1
      [RFC6194] and with MODP groups with less than 2048 bits
      [NIST-SP-800-131Ar1], this method is considered insecure. This
      method is being moved from MUST to SHOULD NOT- instead of MUST NOT
      only to allow a transition time to get rid of it. It should be
      removed from server implementations as quickly as possible.

> For example the SHOULD- is defined in section 2 to mean that this
> algorithm will be deprecated to MAY in future version, but in practice
> we quite often go from SHOULD- to SHOULD NOT (or even MUST NOT, as the
> text above suggests).

Does this change make more sense?

    SHOULD+      This term means the same as SHOULD. However, it is
                 likely that an algorithm marked as SHOULD+ will be
                 promoted at some future time to be a MUST.

    SHOULD-      This term means the same as SHOULD. However, an
                 algorithm marked as SHOULD- will be deprecated to a
		 MAY in a future version of this document.

    SHOULD NOT-  This term means the same as SHOULD NOT. However, an
                 algorithm marked as SHOULD NOT- will be deprecated to
		 a MUST NOT in a future version of this document.
       

> Anyways this is separate issue than wheter we should make
> implementations having code for diffie-hellman-group1-sha1
> non-conforming by publishing that implementations MUST NOT implement
> diffie-hellman-group1-sha1...

Okay. I can make this change later today.

I will probably also add the SHOULD NOT- unless there is strong
objection.

	-- Mark