Re: [Curdle] Martin Duke's No Objection on draft-ietf-curdle-ssh-kex-sha2-19: (with COMMENT)

["Mark Baushke (ietf)" <[e-mail]>]

Hi Martin,

Comment in-line below.

> On Jul 6, 2021, at 11:48 AM, Martin Duke via Datatracker <[e-mail]> wrote:
> 
> Martin Duke has entered the following ballot position for
> draft-ietf-curdle-ssh-kex-sha2-19: No Objection
> 
> When responding, please keep the subject line intact and reply to all
> email addresses included in the To and CC lines. (Feel free to cut this
> introductory paragraph, however.)
> 
> 
> Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
> for more information about DISCUSS and COMMENT positions.
> 
> 
> The document, along with other ballot positions, can be found here:
> https://datatracker.ietf.org/doc/draft-ietf-curdle-ssh-kex-sha2/
> 
> 
> 
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
> 
> Two nits:
> 
> (1.1) this is optional, but
> 
> s/man in the middle/on-path attacker

Agreed.

> 
> Or other suitable synonym
> 
> (3.1.1) and (3.1.2) I cannot parse the sentences with the phrase "is a
> reasonable hash...", e.g.
> 
> SHA2-256 is a reasonable hash in both the KDF and integrity in both gss and
> non-gss uses of curve25519 key exchange methods.
> 
> Can you reword?

Benjamin Kaduk already answered your question, but I do not know if it was satisfying or if the document should be updated.

I could add the following paragraph to section 3.1.

        RFC4253 section 7.2 "Output of Key Exchange" defines
        generation of a shared secret K (really the output of the KDF)
        and an exchange key hash H. Each key exchange method uses a
        specified HASH function which must be the same for both key
        exchange and Key Derivation. H is used for key exchange
        integrity across the SSH session as it is computed only once.
        It is noted at the end of the 7.2 section that "This process
        will lose entropy if the amount of entropy in K is larger than
        the internal state size of HASH." so care must be taken that
        the hashing algorithm used is well chosen ("reasonable") for
        the key exchange algorithms being used.

Please let me know if adding something like that will improve what 3.1.1 and 3.1.2 are trying to say.

        Be safe, stay healthy
        -- Mark