Re: [Curdle] State of draft-ietf-curdle-ssh-kex-sha2?

On Sun, Jul 12, 2020 at 1:38 PM Mark D. Baushke
<mdb=40juniper.net@dmarc.ietf.org> wrote:
>
> Hi denis,
>
> denis bider <denisbider.ietf@gmail.com> writes:
>
> > Hey everyone,
> >
> > I notice the following draft has not moved forward:
> >
> > https://datatracker.ietf.org/doc/draft-ietf-curdle-ssh-kex-sha2/
> >
> > This seems to be an important draft which would standardize the
> > current use of key exchange algorithms in SSH. However, it looks like
> > no changes have been made in 2.5 years?
>
> Correct.
>
> > Did I miss some event where this draft morphed into something else so
> > that I'm not seeing the right information about progress?
>
> I have not progressed the draft, mostly due to private email received
> over two years ago...
>
> A number of people told me to not move it forward until after all of the
> RFCs for draft-ietf-curdle-ssh-curves (now RFC 8731) and
> draft-ietf-curdle-gss-keyex-sha2 (now RFC 8732) were adopted. Also, many
> people were unhappy with the characterizations of the existing
> algorithms and my scoring of MUST, SHOULD, and MAY
>
> In addition, there was a general dislike for the references of the NSA
> documents provided or the CNSA document reference.
>
> > Otherwise, what seems to be the current obstacle with making progress
> > on this?
>
> I think that work on the document is desirable. Does anyone wish to be a
> co-author with me?
>
> I would like to see more opinions on the list about which algorithms are
> to be 'SHOULD NOT' and which are to be 'MUST' ... in general, I would
> like to see this document as a KEX refernce that may be updated every
> few years as we learn more about which KEX algorithms are best to use.
>
> My opinion for Section 5 as I write this email today is:
>
>       Key Exchange Method Name             Reference  Implement
>       ------------------------------------ ---------- ----------
>       curve25519-sha256                    RFC8731    SHOULD
>       curve448-sha512                      RFC8731    MAY
>       diffie-hellman-group-exchange-sha1   RFC4419    SHOULD NOT
>       diffie-hellman-group-exchange-sha256 RFC4419    MAY
>       diffie-hellman-group1-sha1           RFC4253    SHOULD NOT
>       diffie-hellman-group14-sha1          RFC4253    SHOULD NOT
>       diffie-hellman-group14-sha256        RFC8268    SHOULD
>       diffie-hellman-group15-sha256        RFC8268    MAY
>       diffie-hellman-group16-sha512        RFC8268    MUST
>       diffie-hellman-group17-sha512        RFC8268    MAY
>       diffie-hellman-group18-sha512        RFC8268    MAY
>       ecdh-sha2-*                          RFC5656    MAY
>       ecdh-sha2-nistp256                   RFC5656    SHOULD
>       ecdh-sha2-nistp384                   RFC5656    SHOULD
>       ecmqv-sha2                           RFC5656    MAY
>       ext-info-c                           RFC8308    SHOULD
>       ext-info-s                           RFC8308    SHOULD
>       gss-*                                RFC4462    MAY
>       gss-curve25519-sha256-*              RFC8732    SHOULD
>       gss-curve448-sha512-*                RFC8732    MAY
>       gss-gex-sha1-*                       RFC4462    SHOULD NOT
>       gss-group1-sha1-*                    RFC4462    SHOULD NOT
>       gss-group14-sha256-*                 RFC8732    SHOULD
>       gss-group15-sha512-*                 RFC8732    MAY
>       gss-group16-sha512-*                 RFC8732    SHOULD
>       gss-group17-sha512-*                 RFC8732    MAY
>       gss-group18-sha512-*                 RFC8732    MAY
>       gss-nistp256-sha256-*                RFC8732    SHOULD
>       gss-nistp384-sha384-*                RFC8732    MAY
>       gss-nistp521-sha512-*                RFC8732    MAY
>       rsa1024-sha1                         RFC4432    MUST NOT
>       rsa2048-sha256                       RFC4432    MAY
>
> The above list of KEX algorithms comes from the IANA ssh-parameters list
> URL:
> https://www.iana.org/assignments/ssh-parameters/ssh-parameters.xhtml#ssh-parameters-16
>
> Please let me know if I have missed any of the KEX algorithms in the
> list.
>
> Of these, I am not sure if rsa2048-sha256 has support for a 'MAY' or if
> its lack of use would drive it to a 'SHOULD NOT' in the table.
>
> To be honest, I am really not sure which KEX algorithms should be listed
> as Mandatory To Implement (MTI) for key exchanges going forward.
>
> Which diffie-hellman FFC group should be listed as MTI? group14-sha256
> or group16-sha512? (I tentatively selected this one). Is that wise?
> Should any FFC Diffie-Hellman group size be MTI?
>
> I would like to hear if others on this list believe that
> curve25519-sha256 should be a MUST or a SHOULD.
>
Personally, I think that it should be a MUST or at least a strong
SHOULD (SHOULD + ?)


> I also do not know if the expired draft-ietf-curdle-ssh-kex-sha2
> document should bother to give opinions on any of the KEX options other
> than those being deprecated or thrust into MTI. Opinions please?
>
> It seems clear to me that removing the *-sha1* KEX algorithms is a good
> idea. I would love to move diffie-hellman-group14-sha1, but I honestly
> suspect that some hardware is deployed for which it is the only KEX
> algorithm that may still need to be supported... which is the only
> reason it is a 'SHOULD' on my list instead of a 'SHOULD NOT' ...
>
>         Be safe, stay healthy,
>         -- Mark
>
> _______________________________________________
> Curdle mailing list
> Curdle@ietf.org
> https://www.ietf.org/mailman/listinfo/curdle