[Curdle] Erratum ID #5502

[Rebecca VanRheenen <[e-mail]>]

Hi Deb and Paul,

Mark Baushke, one of the authors of RFC 8270, sent an email today regarding Erratum ID #5502 (https://www.rfc-editor.org/errata/eid5502) 

This erratum was originally marked as editorial, but I changed the Type to “Technical”. As Stream Approver, please review and set the Status and Type accordingly (see the definitions at https://www.rfc-editor.org/errata-definitions/) Note that I’m sending this to you both as ADs of the Security Area as the curdle WG has concluded.

Mark recommends rejecting the erratum:

> https://www.rfc-editor.org/errata/eid5502 proposes to change section 5 to allow for operating systems with rate limiting logging in some cases. I have no strong objection to this suggestion. I suppose that the notes for this errata could be added to section 5 as clarification of when an administrator may wish to use rate limited logging, but that was not suggested by Eugene Adell (the author or this errata). The important point is that the administrator understand the attack vector risk involved in this logging. However, it is not clear what course of action an administrator has when seeing such log messages, so the usefulness of this kind of logging seems marginal at best and the security considerations advice to just silently drop these connections without logging them still seems best.
...
> My current opinion is that … eid5502 … be marked as REJECTED.


I also searched for previous emails about this erratum and found the following:

Mark Baushke (2018-09-21):
> For myself, given that RFC 8270 is moving from 1024-bit DH groups as a
> minimum to 2048-bit DH groups as a minimum, I believe that ignoring any
> group which is not at least 2048-bits is likely to be the correct
> behavior regardless of any rate-limited logging behavior which might be
> available for some implementations of the SSH protocol.
> 
> If the proposed DH group does not meet the new minimum, then the
> connection should fail. I do not see an immediate need to add possible
> mitigations to the security considerations section.

Ben Kaduk (2018-09-23):
> Such mitigations would be outside the scope of an erratum anyway, as I see
> it.



You may review the report at: 
https://www.rfc-editor.org/errata/eid5502

Information on how to verify errata reports can be found at: 
https://www.rfc-editor.org/how-to-verify/

Further information on errata can be found at: 
https://www.rfc-editor.org/errata.php

Thank you,
RFC Editor/rv