Re: [Curdle] Martin Duke's No Objection on draft-ietf-curdle-ssh-kex-sha2-19: (with COMMENT)

[Benjamin Kaduk <[e-mail]>]

On Tue, Jul 06, 2021 at 11:48:19AM -0700, Martin Duke via Datatracker wrote:
> Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
> for more information about DISCUSS and COMMENT positions.
> 
> 
> The document, along with other ballot positions, can be found here:
> https://datatracker.ietf.org/doc/draft-ietf-curdle-ssh-kex-sha2/
> 
> 
> 
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
> 
> Two nits:
> 
> (1.1) this is optional, but
> 
> s/man in the middle/on-path attacker
> 
> Or other suitable synonym
> 
> (3.1.1) and (3.1.2) I cannot parse the sentences with the phrase "is a
> reasonable hash...", e.g.
> 
> SHA2-256 is a reasonable hash in both the KDF and integrity in both gss and
> non-gss uses of curve25519 key exchange methods.
> 
> Can you reword?

I had asked about this as well.  My current understanding is that
"integrity" is something of a term of art for ssh.  Roughly, there's a
transcript hash of the SSH handshake that's used as session identifier as
well as input to the key schedule, and this provides integrity protection
for the key exchange.  As a result, I don't have much of a position for
whether we should reword this.

-Ben