Re: [Curdle] Looking for comments on draft-ietf-curdle-ssh-kex-sha2

["Mark D. Baushke" <[e-mail]>]

Hubert Kario <[e-mail]> writes:

> On Monday, 23 November 2020 22:54:17 CET, Mark D. Baushke wrote:
> > The diffie-hellman-group1-sha1 exchange was a mandatory to implement and
> > is now a SHOULD NOT. I could move it to MUST NOT if everyone else thinks
> > it best.
> 
> +1 for a MUST NOT, though I'm ok with keeping it at SHOULD NOT

Good. Personally, I favor MUST NOT, but I was being conservative in how
fast something goes from a MUST to a MUST NOT.

> > The diffie-hellman-group14-sha1 exchange was a mandatory to implement
> > MUST and is now a SHOULD. Similarly for gss-group1-sha1-*

Minor typo here. I intended 'gss-group14-sha1-*' which shadows the
non-gss name.

> no, I think it should be SHOULD NOT, the sha-1 disqualifies it

Okay. I hope others provide their inputs on this one. I have no issues
with making it a SHOULD NOT if that is desirable by others on the list.

> > A plurality of the list seemed to be in favor of this, but if 2048-bit
> > (112 bits of security) is falling out of favor (along with 3DES), then
> > perhaps a different KeX is desirable to be MUST.
> 
> while small security margin of 3DES is a factor for its deprecation,
> the most problematic part of 3DES is the 64 bit block size

Yes.

> and AFAIK, we're not even considering deprecation of 2048 bit RSA in
> the web PKIX, so, I don't see any arguments against making group14
> mandatory

Good points. Thank you.

	Be safe, stay healthy,
	-- Mark