Re: [Curdle] Secdir last call review of draft-ietf-curdle-ssh-kex-sha2-14

["Salz, Rich" <[e-mail]>]

During AD, SecDir, IESG, etc., review, the desire to clean up some wording was expressed.  The following diff was suggested by our AD. He pointed out that " This does arguably strengthen the guidance to not use groups smaller than 2048 bits, and I note that the WG list seems to not be CC'd on this thread."

If anyone in the WG objects to the stronger guidance, please reply to the list before the end of the week.  Thanks!


    --- draft-ietf-curdle-ssh-kex-sha2-15.txt	2021-04-12 14:15:12.244182171 -0700
    +++ draft-ietf-curdle-ssh-kex-sha2-15.bjk.txt	2021-04-12 14:33:18.203129555 -0700
    @@ -592,17 +592,25 @@

     3.2.1.  FFC diffie-hellman using generated MODP groups

    -   This random selection from a set of pre-generated moduli for key
    -   exchange uses SHA2-256 as defined in [RFC4419].  [RFC8270] mandates
    -   that implementations avoid any MODP group whose modulus size is less
    -   than 2048 bits.  Care should be taken in the pre-generation of the
    -   moduli P and generator G such that the generator provides a Q-ordered
    -   subgroup of P.  Otherwise, the parameter set may leak one bit of the
    -   shared secret.  The diffie-hellman-group-exchange-sha1 uses SHA-1
    -   which is being deprecated.  This key exchange SHOULD NOT be used.
    -   The diffie-hellman-group-exchange-sha256 uses SHA2-256 which is
    -   reasonable for MODP groups less than 4K bits.  The diffie-hellman-
    -   group-exchange-sha256 key exchange MAY be used.
    +   [RFC4419] defines two key exchange methods that use a random
    +   selection from a set of pre-generated moduli for key exchange: the
    +   diffie-hellman-group-exchange-sha1 method, and the diffie-hellman-
    +   group-exchange-sha256 method.  Per [RFC8270], implementations SHOULD
    +   use a MODP group whose modulus size is equal to or greater than 2048
    +   bits.  MODP groups with a modulus size less than 2048 bits are weak
    +   and MUST NOT be used.
    +
    +   The diffie-hellman-group-exchange-sha1 key exchange method SHOULD
    +   NOT be used.  This method uses SHA-1, which is being deprecated.
    +
    +   The diffie-hellman-group-exchange-sha256 key exchange method MAY be
    +   used.  This method uses SHA-256, which is reasonable for MODP groups
    +   less than 4K bits.
    +
    +   Care should be taken in the pre-generation of the moduli P and
    +   generator G such that the generator provides a Q-ordered subgroup of
    +   P.  Otherwise, the parameter set may leak one bit of the shared
    +   secret.

        Table 9 provides a summary of the Guidance for these exchanges.

    @@ -967,8 +975,14 @@
        is insufficient to match the symmetric cipher or the algorithm has
        been broken.

    -   At this time, the 1024-bit MODP group used by diffie-hellman-
    -   group1-sha1 is too small for the symmetric ciphers used in SSH.
    +   The 1024-bit MODP group used by diffie-hellman-group1-sha1 is too
    +   small for the symmetric ciphers used in SSH.
    +
    +   MODP groups with a modulus size less than 2048 bits are too small
    +   for the symmetric ciphers used in SSH.  If the diffie-hellman-
    +   group-exchange-sha256 or diffie-hellman-group-exchange-sha1 key exchange
    +   method is used, the modulus size of the MODP group used needs to be
    +   at least 2048 bits.

        At this time, the rsa1024-sha1 key exchange is too small for the
        symmetric ciphers used in SSH.