Re: [Curdle] draft-ietf-curdle-ssh-kex-sha2 and diffie-hellman-group1-sha1 (1024-bit DH)

[Russ Housley <[e-mail]>]

I agree with Tero.  However, I like the use of SHOULD+ and MUST- to signal to project and product planners what is coming.  

Russ


> On Jul 17, 2017, at 6:06 AM, Tero Kivinen <[e-mail]> wrote:
> 
> I think it is bad idea to go from MUST to implement algorithm to MUST
> NOT implement in one step. Especially as this will make all current
> ssh implementations non-conforming as they do still implement
> diffie-hellman-group1-sha1 even when it might be disabled by default.
> 
> We are defining here a MUST implement and MUST not implement, not MUST
> use and MUST NOT use recommendations.
> 
> In IPsec we moved from MUST to SHOULD NOT just because that reason,
> i.e., we didn't want to make all implementations non-conforming, and
> forbid backwards compatibility with old implementations which might
> only support previous MUST implement algorithm.
> 
> Also I guess there is quite a lot of ssh implementations in routers
> and other devices which might not get updates very quickly, and they
> might only support diffie-hellman-group1-sha1, and with this change,
> new implementations cannot talk to them, as new implementations MUST
> NOT implement diffie-hellman-group1-sha1.
> 
> I would suggest changing it to SHOULD NOT and say that in future it
> might be changed to MUST NOT.
> -- 
> [e-mail]