Re: [Curdle] Second AD Review: draft-ietf-curdle-ssh-curves.

I believe the easiest way to do is to let Mark update the draft when time
permits. Thanks you Ben and Mark for moving these documents forward.
Yours,
Daniel

On Tue, Jul 30, 2019 at 7:13 PM Benjamin Kaduk <kaduk@mit.edu> wrote:

> On Tue, Jul 30, 2019 at 03:23:22PM -0700, Mark D. Baushke wrote:
> > Benjamin Kaduk <kaduk@mit.edu> writes:
> >
> > > I took over as responsible AD for this draft from Eric, but I don't
> > > see any response to this second round of review comments.  Luckily
> there's
> > > mot much left, so hopefully we can get a new rev out quickly and move
> the
> > > document forward.
> >
> > I do owe the AD a response to the comments and a new draft.
> > I regret that other commitments have prevented me from this.
>
> I completely understand; my main goal is to ensure that *I* was not the one
> holding things up, as there are quite a few things for which that is the
> case at the moment.
>
> (BTW, if anyone feels there is some urgency to getting these documents
> published, the chairs can appoint a new document editor to handle the
> mechanical text juggling and document submission.  That might be less
> feasible for the other document, though, given the volume of comments Eric
> made.)
>
> -Ben
>
> >
> > > Thanks,
> > >
> > > Ben
> > >
> > > On Mon, Dec 24, 2018 at 02:16:24PM -0800, Eric Rescorla wrote:
> > > > Thanks for addressing my comments.
> > > >
> > > > IMPORTANT
> > > > S 3.
> > > >
> > > > >      received public keys are not the expected lengths, or if the
> > > > >      derived shared secret only consists of zero bits. No further
> > > > >      validation is required beyond what is discussed in [RFC7748].
> > > > >      The derived shared secret is 32 bytes when Curve25519 is used
> > > > >      and 56 bytes when Curve448 is used. The encodings of all
> > > > >      values are defined in [RFC7748]. The hash used is SHA-256 for
> > > > >      Curve25519 and SHA-512 for Curve448.
> > > >
> > > > This is true if you use the 7748 algorithm, but not necessarily
> > > > otherwise.
> > > >
> > > > Here is some OK language (from tcpcrypt)
> > > >
> > > >    Key-agreement schemes ECDHE-Curve25519 and ECDHE-Curve448 perform
> > > >    the Diffie-Helman protocol using the functions X25519 and X448,
> > > >    respectively. Implementations SHOULD compute these functions
> > > >    using the algorithms described in [RFC7748]. When they do so,
> > > >    implementations MUST check whether the computed Diffie-Hellman
> > > >    shared secret is the all-zero value and abort if so, as described
> > > >    in Section 6 of [RFC7748]. Alternative implementations of these
> > > >    functions SHOULD abort when either input forces the shared secret
> > > >    to one of a small set of values, as discussed in Section 7 of
> > > >    [RFC7748].
> > > >
> > > > COMMENTS
> > > > S 1.
> > > > >      key exchange protocol described in [RFC4253] supports an
> extensible
> > > > >      set of methods.  [RFC5656] describes how elliptic curves are
> > > > >      integrated in SSH, and this document reuses those protocol
> messages.
> > > > >
> > > > >      This document describes how to implement key exchange based on
> > > > >      Curve25519 and Ed448-Goldilocks [RFC7748] in SSH.  For
> Curve25519
> > > >
> > > > 7748 calls this Curve448 and you do so later, so please be
> consistent.
> >
> >       -- Mark
>
> _______________________________________________
> Curdle mailing list
> Curdle@ietf.org
> https://www.ietf.org/mailman/listinfo/curdle
>