Re: [Curdle] Which curves are MUST and SHOULD ?

["Mark D. Baushke" <[e-mail]>]

Peter Gutmann <[e-mail]> writes:

> Mark D. Baushke <mdb=[e-mail]> writes:
> 
> >MAY diffie-hellman-group14-sha1
> >SHOULD NOT diffie-hellman-group-exchange-sha1
> 
> Just wondering why the hardcoded group is MAY but the negotiated, and
> probably more secure, group is SHOULD NOT?

Mostly because diffie-hellman-group14-sha1 is a REQUIRED to implement
algorithm per RFC 4253.

This suggests that all implementations of SSH provide the implementation
as they were mandatory-to-implement in the original standard. So, by
suggesting MAY rather than SHOULD NOT, there is wiggle room for a time
to cross over from current implementtaions to future implementations
with at least one common KeX.

> Is it because lots of legacy stuff will only do the hardcoded group?

RFC 4419 and RFC 8270 provided the diffie-hellman-group-exchange-sha1
and diffie-hellman-group-exchange-sha256 but never specified them as
REQUIRED for an SSH implementation. At best, they are a MAY implement or
possibly they are implicitly a SHOULD given the 38 implementations
described on https://ssh-comparison.quendi.de/comparison/kex.html

It is shown in [TRANS-COLL] that sending thr eg,p diffie-hellman
parameters to a client that does not know what to expect for those
values with only a SHA1 hash allows for a substituion to potentially be
made for the p value. This implies the group-exchange mechanism may be
weaker when SHA1 is used.

I think I also read elsewhere that in a 6K or higher MODP group, there
was a higher possibility of created SHA1 collisions. However, I am
unable to find that reference at present.

The guidance of this draft suggests that any *-sha1 SHOULD NOT be
implemented and that the formerly REQUIRED and group14 SHA1 hashed
parameters MAY be implemented only as a transitional step.

If we were changing this draft into to a BCP, then group1-sha1 would be
certainly be a MUST NOT (due to the group1 of 1024-bits of MODP being so
weak) and group14-sha1 would be a SHOULD NOT or a MUST NOT (the former
to allow for legacy key exchanges and the latter based on a desire to
eliminate SHA1 entirely).

If there is consensus, I would be happy to make ALL *-sha1* KeX
algorithms get changed to MUST NOT as well as note that consistent with
RFC 8270, no group exchange MODP group should be less than 2048 bits...
that is instead of just being the recommended size it be the mandatory
minimum size.

That said, I have heard that there is some hardware in the field that is
barely able to do group1-sha1 and do not implement group14-sha1 even
though it is REQUIRED because it would take the very low power CPUs too
long to do a key exchange at all.

I'd like to hear from anyone who has an opinion if this RFC should be
closer to a BCP than just a deprecation of some KeX algorithms.

	Be safe, stay healthy,
	-- Mark

PS: The following is a summary from the current published -12 draft, my
work-in-progress -13 draft assuming it is NOT attempting to be a BCP and
what I suspect should be used if it were to be a leading BCP.

 Key Exchange Method Name             | draft -12  | draft -13  | BCP
 
 curve25519-sha256                    | SHOULD     | SHOULD     | SHOULD
 curve448-sha512                      | MAY        | MAY        | MAY
 diffie-hellman-group-exchange-sha1   | SHOULD NOT | SHOULD NOT | MUST NOT
 diffie-hellman-group-exchange-sha256 | MAY        | MAY        | MAY
 diffie-hellman-group1-sha1           | SHOULD NOT | SHOULD NOT | MUST NOT
 diffie-hellman-group14-sha1          | SHOULD     | MAY        | MUST NOT
 diffie-hellman-group14-sha256        | MUST       | MUST       | MUST
 diffie-hellman-group15-sha512        | MAY        | MAY        | MAY
 diffie-hellman-group16-sha512        | SHOULD     | SHOULD     | SHOULD
 diffie-hellman-group17-sha512        | MAY        | MAY        | MAY
 diffie-hellman-group18-sha512        | MAY        | MAY        | MAY
 ecdh-sha2-*                          | MAY        | MAY        | MAY
 ecdh-sha2-nistp256                   | SHOULD     | SHOULD     | SHOULD
 ecdh-sha2-nistp384                   | SHOULD     | SHOULD     | SHOULD
 ecdh-sha2-nistp521                   | SHOULD     | SHOULD     | SHOULD
 ecmqv-sha2                           | MAY        | MAY        | MAY
 ext-info-c                           | SHOULD     | SHOULD     | MUST
 ext-info-s                           | SHOULD     | SHOULD     | MUST
 gss-*                                | MAY        | MAY        | MAY
 gss-curve25519-sha256-*              | SHOULD     | SHOULD     | SHOULD
 gss-curve448-sha512-*                | MAY        | MAY        | MAY
 gss-gex-sha1-*                       | SHOULD NOT | SHOULD NOT | MUST NOT
 gss-group1-sha1-*                    | SHOULD NOT | SHOULD NOT | MUST NOT
 gss-group14-sha256-*                 | SHOULD     | SHOULD     | MUST
 gss-group15-sha512-*                 | MAY        | MAY        | MAY
 gss-group16-sha512-*                 | SHOULD     | SHOULD     | SHOULD
 gss-group17-sha512-*                 | MAY        | MAY        | MAY
 gss-group18-sha512-*                 | MAY        | MAY        | MAY
 gss-nistp256-sha256-*                | SHOULD     | SHOULD     | SHOULD
 gss-nistp384-sha384-*                | SHOULD     | SHOULD     | SHOULD
 gss-nistp521-sha512-*                | MAY        | SHOULD     | SHOULD
 rsa1024-sha1                         | MUST NOT   | MUST NOT   | MUST NOT
 rsa2048-sha256                       | MAY        | MAY        | MAY