[Curdle] comments on draft-ietf-curdle-ssh-kex-sha2-05

[Daniel Migault <[e-mail]>]

Hi,

Please find some comments of draft-ietf-curdle-ssh-kex-sha2-05.

Yours,
Daniel

I have the impression that only RFC4253 provided some recommendations, in
which case I would be incline to say that the current draft only updates
this document. The other RFC only defines new suites.

I suggest we either use MUST/SHOULD/MAY or REQUIRE/RECOMMEND/OPTIONAL but
not both. Note that if the recommendations for ipsec
[draft-ietf-ipsecme-rfc4307bis] we also introduced some additional notation
such as SHOULD+/- to specify whether the SHOULD is expect to raise its
status or that SHOULD is only here for interoperability.

Note that recommendations are not the purpose of IANA, so I would probably
change the title of the section. The IANA only adds the code points. It is
god that you mentioned the IANA link. I would encourage you to have the URL
as an informative  reference.

Recommendations should regularly updated so implementations have the time
to introduce new suites or remove old suites while still providing
interoperability. If the starting point is RFC4253, then we have:

      diffie-hellman-group1-sha1 REQUIRED
      diffie-hellman-group14-sha1 REQUIRED

and all other suites are OPTIONAL or MAY. Correct me if I am wrong, At
least I believe that that appendix section would be useful to comment on
the update with the previous recommendations.

       curve25519-sha256                    ssh-curves MUST

Maybe a MUST statement may be to strong as curves have just been defined.
Maybe that could be SHOULD+ mentioning it is expected to become a MUST next
time. In fact it is usually hard to move from MAY to MUST. If you do so,
reasons should be provided in the text. Currently it seems it is
implemented in libssh and OpenSSH, not sure it is sufficient for a MUST.

        curve448-sha512                      ssh-curves MAY
By default, the suites with MAY status are not mentioned.

        diffie-hellman-group-exchange-sha1   RFC4419    SHOULD NOT
SHA1 is probably at MUST NOT, so I am expected any suites to be MUST NOT.
Because it represents a threat you are likely to move to MUST NOT directly.

        diffie-hellman-group-exchange-sha256 RFC4419    MAY
        diffie-hellman-group1-sha1           RFC4253    SHOULD NOT
If group 1 is 768-bit MODP Group , I would consider there are two reasons
to have this as MUST NOT.

        diffie-hellman-group14-sha1          RFC4253    SHOULD
My understanding is that this one is kept for interoperability. However,
the text should make it clear this suite will be deprecated soon.

        diffie-hellman-group14-sha256        new-modp   MUST
        diffie-hellman-group15-sha512        new-modp   MAY
        diffie-hellman-group16-sha512        new-modp   SHOULD
        diffie-hellman-group17-sha512        new-modp   MAY
        diffie-hellman-group18-sha512        new-modp   MAY
        ecdh-sha2-nistp256                   RFC5656    SHOULD
        ecdh-sha2-nistp384                   RFC5656    SHOULD
        ecdh-sha2-nistp521                   RFC5656    SHOULD

The current trend is also to reduce the number of suites implementation. DO
we want to have these three suites as SHOULD. We should also explain what
the next step is expected to be.


        ecdh-sha2-*                          RFC5656    MAY
        ecmqv-sha2                           RFC5656    SHOULD NOT
        gss-gex-sha1-*                       RFC4462    SHOULD NOT
        gss-group1-sha1-*                    RFC4462    SHOULD NOT
        gss-group14-sha1-*                   RFC4462    SHOULD
        gss-group14-sha256-*                 new-modp   SHOULD
        gss-group15-sha512-*                 new-modp   MAY
        gss-group16-sha512-*                 new-modp   SHOULD
        gss-group17-sha512-*                 new-modp   MAY
        gss-group18-sha512-*                 new-modp   MAY
        gss-*                                RFC4462    MAY

        rsa1024-sha1                         RFC4432    SHOULD NOT
Maybe we could set it as MUST NOT both for key size and SHA1.

        rsa2048-sha256                       RFC4432    MAY