Re: [Curdle] Second AD Review: draft-ietf-curdle-ssh-curves.

["Mark D. Baushke" <[e-mail]>]

Benjamin Kaduk <[e-mail]> writes:

> I took over as responsible AD for this draft from Eric, but I don't
> see any response to this second round of review comments.  Luckily there's
> mot much left, so hopefully we can get a new rev out quickly and move the
> document forward.

I do owe the AD a response to the comments and a new draft.
I regret that other commitments have prevented me from this.

	-- Mark

> Thanks,
> 
> Ben
> 
> On Mon, Dec 24, 2018 at 02:16:24PM -0800, Eric Rescorla wrote:
> > Thanks for addressing my comments.
> > 
> > IMPORTANT
> > S 3.
> >    
> > >      received public keys are not the expected lengths, or if the
> > >      derived shared secret only consists of zero bits. No further
> > >      validation is required beyond what is discussed in [RFC7748].
> > >      The derived shared secret is 32 bytes when Curve25519 is used
> > >      and 56 bytes when Curve448 is used. The encodings of all
> > >      values are defined in [RFC7748]. The hash used is SHA-256 for
> > >      Curve25519 and SHA-512 for Curve448.
> > 
> > This is true if you use the 7748 algorithm, but not necessarily
> > otherwise.
> > 
> > Here is some OK language (from tcpcrypt)
> > 
> >    Key-agreement schemes ECDHE-Curve25519 and ECDHE-Curve448 perform
> >    the Diffie-Helman protocol using the functions X25519 and X448,
> >    respectively. Implementations SHOULD compute these functions
> >    using the algorithms described in [RFC7748]. When they do so,
> >    implementations MUST check whether the computed Diffie-Hellman
> >    shared secret is the all-zero value and abort if so, as described
> >    in Section 6 of [RFC7748]. Alternative implementations of these
> >    functions SHOULD abort when either input forces the shared secret
> >    to one of a small set of values, as discussed in Section 7 of
> >    [RFC7748].
> >
> > COMMENTS
> > S 1.
> > >      key exchange protocol described in [RFC4253] supports an extensible
> > >      set of methods.  [RFC5656] describes how elliptic curves are
> > >      integrated in SSH, and this document reuses those protocol messages.
> > >
> > >      This document describes how to implement key exchange based on
> > >      Curve25519 and Ed448-Goldilocks [RFC7748] in SSH.  For Curve25519
> > 
> > 7748 calls this Curve448 and you do so later, so please be consistent.

	-- Mark