Re: [Curdle] draft-ssorce-gss-keyex-sha2-00

[Hubert Kario <[e-mail]>]

On Monday, 17 April 2017 07:15:08 CEST Mark D. Baushke wrote:
> Hi Simo & Hubert,
> 
> Regarding your draft:
> https://www.ietf.org/id/draft-ssorce-gss-keyex-sha2-00.txt
> 
> The reference to the -05 I-D.ietf-curdle-ssh-kex-sha2 should probably be
> replaced with a reference to draft-ietf-curdle-ssh-modp-dh-sha2-04

It probably should have references to both.
 
> I am somewhat curious why the same curves identified in RFC5656 as
> nistp256, nistp384, and nistp521 are being called secp256r1, secp384r1,
> secp521r1 in your draft in section 6. Is there a good reason to select
> this form of the names?

Because I took those names from TLS curve registry. Making them consistent 
with other SSH names is a good idea though. Thanks!

> I will note that gss-secp384r1-sha512-* should probably be
> gss-secp384r1-sha384-* to be consistent with how RFC5656
> felt security should be handled.

Good point.

> I do know that there is some controversy about supporting SHA2-384
> rather than SHA2-256 and SHA2-512, but it has been argued that SHA2-384
> does not expose as much of its internal state as does SH2-512 and that
> it aligns more closely with the nistp384 curve.

how is that applicable to the KEX?
-- 
Regards,
Hubert Kario
Senior Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 99/71, 612 45, Brno, Czech Republic