Re: [Curdle] Quantum Resistant SSH connections

[Hubert Kario <[e-mail]>]

On Thursday, 1 October 2020 18:06:57 CEST, Mark D. Baushke wrote:
> Hi Hubert,
>
> Hubert Kario <[e-mail]> writes:
>
>> Hi everybody,
>> 
>> As it's fairly easy, and common, to configure Kerberos infrastructure
>> to be resistant against quantum computers, I'd like to submit a new
>> key exchange for SSH that leverages that quantum resistance to make
>> quantum resistant SSH connections. ...
>
> Thank you for the pointers.
>
> Related to Quantum-Resistant and Quantum-Safe algorithms, you may find
> these pointers useful as well:
>
> There is a github project under an MIT licesnse:
>
>     https://github.com/open-quantum-safe/liboqs
>
> which provides for various Quantum-Safe cryptographic algorithms.
>
> There is also a paper published last year:
>
>     Prototyping post-quantum and hybrid key exchange and authentication in
>     TLS and SSH
>     by Eric Crockett and Christian Paquin and Douglas Stebila
>     URL: https://eprint.iacr.org/2019/858
>
> which may be of interest as a hybrid mechanism may be more acceptable as
> a transition to PQ than a direct move for some implementers.
>
> 	Be safe, stay healthy,
> 	-- Mark

Yes, I'm aware of those projects and this research.

The reason why I went with stright-up kerberos is becasue:
1. There is no single quantum safe algorithm widely agreed as the best
2. It may be good few years before we will get one
3. It may require few more years still before those algorithms become 
acceptable
   to national or international standard bodies (FIPS, PCI-DSS, Common
   Criteria, etc.)
4. Backporting completely new cryptographic algorithms to existing 
deployments
   is usually hard, if not impossible. Not to mention it may take years 
before
   we have something that's secure against side-channel attacks in 
practice.

This I-D proposes a mechanism that doesn't use any new cryptography and
requires minimal changes to a SSH implementation (and uses just two new 
methods
from GSSAPI). Which should make it very easy to add in new deployments and
isn't very hard to backport to old deployments.

In other words, I don't consider it a replacement for proper quantum-safe
kex, but a stepping stone that will tide us over until quantum-safe 
algorithms
are widely deployed.
-- 
Regards,
Hubert Kario
Senior Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 115, 612 00  Brno, Czech Republic