[Curdle] RSA key transport for SSH (RFC 4432) and forward secrecy

[Benjamin Kaduk <[e-mail]>]

While reviewing draft-ietf-curdle-ssh-kex-sha2, I followed many of the
references, which included RFC 4432, which defines the "rsa1024-sha1"
(getting deprecated for SHA-1 usage) and "rsa2048-sha256" (which is not)
key exchange methods.  While the specific construction is claimed to still
produce contributory behavior in practice (due to the client-contributed
key only ever being used in combination with the hash of server-provided
data), it seems to still be the case that if the RSA private key is
revealed, the session key is revealed, which is mostly the standard
non-forward-secret behavior.

Things are perhaps better if you buy into the theory that "it may be a
transient key generated solely for this SSH connection, or it may be
re-used for several connections" is supposed to prevent indefinite reuse of
the RSA keypair, which seems ... not very reassuring.

While it's not clear to me that there's specific reason to (say) move the
whole RFC to Historic status or claim that it is obsoleted by some
more-modern key-exchange method, it does seem likely to me that we could
get IETF consensus that actually using rsa2048-sha256 is generally a bad
idea.  (Or maybe we could get consensus to move it to Historic.)  Perhaps
an RFC 2026 Applicability Statement would be an appropriate tool for this
case?

But most likely the best place to start would be to ask how widely it's
implemented and if it's known to be in use anywhere...does anyone have
data?

Thanks,

Ben