Re: [Curdle] Looking for comments on draft-ietf-curdle-ssh-kex-sha2

[Tero Kivinen <[e-mail]>]

Hubert Kario writes:
> On Thursday, 26 November 2020 18:09:41 CET, Tero Kivinen wrote:
> > Hubert Kario writes:
> >>> The diffie-hellman-group14-sha1 exchange was a mandatory to implement
> >>> MUST and is now a SHOULD. Similarly for gss-group1-sha1-*
> >> 
> >> no, I think it should be SHOULD NOT, the sha-1 disqualifies it
> >
> > If I remember right about ssh key exchange, it does not rely on the
> > collision resistance at all, it relies on the 2nd preimage resistance,
> 
> I don't think this is the case:
> https://hal.inria.fr/hal-01244855/document

>From that paper:
----------------------------------------------------------------------
	In this attack, the MitM does not tamper
	with the Diffie-Hellman values and hence it does not
	know the connection keys. However, it manages to
	tamper with both Ic and Is , and can therefore down-
	grade the negotiate ciphersuite to a weak cryptographic
	algorithm that the attacker knows how to break.
----------------------------------------------------------------------

So simple answer, do not allow weak ciphers in your policy, as
attacker might do really hard attack to force you to use them:

----------------------------------------------------------------------
	Implementing the target collision for SSH-2 requires
	a chosen-prefix attack on SHA-1 which is still consid-
	ered impractical (at least 2^77 work). Moreover, since the
	two tampered fields Ic and Is are meant to be strings
	(not bitstrings), we cannot use arbitrary collisions. Still,
	we find this attack to be an interesting illustration of
	the use of transcipt collisions for downgrade attacks.
-- 
[e-mail]