Re: [Curdle] new-AD review comments on draft-ietf-curdle-gss-keyex-sha2-08

[Benjamin Kaduk <[e-mail]>]

Sorry for the slow reply -- it's been a busy month in my personal
situation.

On Thu, May 09, 2019 at 12:34:40PM +0200, Hubert Kario wrote:
> On Wednesday, 8 May 2019 17:06:04 CEST Benjamin Kaduk wrote:
> > Hi all,
> > 
> > I'm almost ready to send draft-ietf-curdle-gss-keyex-sha2 to the IESG for
> > evaluation, but would like to see a new revision posted first, mostly for
> > the Abstract changes.  In addition to the changes mentioned below, please
> > also go ahead and make the editorial changes mentioned in the last
> > call/directorate reviews.
> > 
> > -Ben
> > 
> > Abstract
> > 
> >    This document specifies additions and amendments to RFC4462.  It
> >    defines a new key exchange method that uses SHA-2 for integrity and
> >    deprecates weak DH groups.  The purpose of this specification is to
> > 
> > I think we need to remove this statement about "deprecates weak DH groups";
> > I didn't see any further discussion of such deprecations in any revision of
> > the document.
> 
> 
> we've done that by not listing them, would you prefer to list them explicitly 
> in section 6 and Section 4 with a "MUST NOT" in "Implementation Support" and 
> "Implementation Recommendations"?

Since we are only Update:ing 4462 and not Obsolete:ing it, we do need to
explicitly say what is deprecated.  The sections you list seem like fine
places (note that since the IANA registry doesn't list the "implementation
support" column, it seems that our request would just be to add this
document as a reference for the affected entries).

-Ben

> > Section 2
> > 
> >                                                            Following the
> >    rationale of [RFC8268] only SHA-256 and SHA-512 hashes are used for
> >    DH groups.  For NIST curves the same curve-to-hashing algorithm
> >    pairing used in [RFC5656] is adopted for consistency.
> > 
> > 8268 doesn't provide a whole lot of rationale for using SHA-256, rather,
> > the closest thing to guidance would be in Section 1 where it cites the NSA
> > IAD FAQ that wants to *avoid* using SHA-256.  So perhaps it's better to say
> > that this just follows the practice of 8268, rather than the rationale from
> > it, especially since we are just using a "consistency" argument for the
> > NIST curves' hashes.
> 
> yes, "practice" would work better in this context
> 
> -- 
> Regards,
> Hubert Kario
> Senior Quality Engineer, QE BaseOS Security team
> Web: www.cz.redhat.com
> Red Hat Czech s.r.o., Purkyňova 115, 612 00  Brno, Czech Republic