IETF Logo Mail Archive

Re: [kitten] [Curdle] Diffie-Hellman modulus sizing in Kerberos PKINIT

"Mark Baushke (ietf)" <mbaushke@gmail.com> Sat, 31 July 2021 13:34 UTC

Return-Path: <mbaushke@gmail.com>
X-Original-To: kitten@ietfa.amsl.com
Delivered-To: kitten@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D81C33A2662; Sat, 31 Jul 2021 06:34:00 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.097
X-Spam-Level:
X-Spam-Status: No, score=-2.097 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Pui37_Rw1yvf; Sat, 31 Jul 2021 06:33:56 -0700 (PDT)
Received: from mail-il1-x12b.google.com (mail-il1-x12b.google.com [IPv6:2607:f8b0:4864:20::12b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 00C3E3A265F; Sat, 31 Jul 2021 06:33:55 -0700 (PDT)
Received: by mail-il1-x12b.google.com with SMTP id c3so12253894ilh.3; Sat, 31 Jul 2021 06:33:55 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:mime-version:subject:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=YQedW9piQYPQxAt43y8vTfYYhMgfHBMYXh6bbIIsQ6g=; b=uiwFQKK3obtf18otBCtLoDYtfIqOtKXR8m9JiFRHjzPI+5sTlWpVbyUc+kUkoyJAwo LsKcgAY4wc/QFmcWwW7UtvPUYBqxPa4fV/lTU3zVwDwMEMmLdo4J01Dg9bqbNX25NOcK 7kupwBPFV8BqdIbGvMeLe/+AkztKDsSvG9vcaud6BSKoQAMYzhXrOOjC9mVIo5NKIWTa Mykr2hoMaYko9EmcbPo+Age1Mgbb98w8be8FIRtAauBWiteWnVznDAkbKkj4u1ex1WK6 5MW6js3MeSW94bss2JWXNnFMyJwKcc82hsoqLTv9uhAL96WSmv+DLcfpMh2OhnkPQJMF zNlA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:mime-version:subject:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=YQedW9piQYPQxAt43y8vTfYYhMgfHBMYXh6bbIIsQ6g=; b=mM5HAf1hivj5adCcu5Q7UAeIkDdlxgeY6f/MnR9NWZ/jU2eSVGs0Veze0SRXh62J9G q/hROmSLWGuzJdJCquX174juqc4VRR/12LlXeNDk/UhsYfIpm1DrfKnhalqXVYtnYl3s 00rGw8o4Ysjupe9+Ug6leYBcX1vig3rsA1VC2FATjW10zhx42lY95rz/BqLh10PLuwYA 2Y121SY+NoTFZOkr0mFLGIX0FUpUt03Q4K/i+PZlLfxp90kOux1qGJL0OEDLrwUIXCfr PlX4v52AhzxUhkjmoYLsVqJZbLFTsPh0501RDHzd2W00wlWVNpNaiSkl8euxYO7QdUm/ IgTw==
X-Gm-Message-State: AOAM533ZP5I1sqhPV/kaowYj50lyPNTtXzi4mvcvKdiIOhkntjzlDQ45 /1OWOKPlSkUHVRO4z/O6hdA=
X-Google-Smtp-Source: ABdhPJxMSgcs90/Ozzr9FG0/k9Lsc+phGP+lAE/sMxpLIzErDMgBkrryDbocUzXSndsvLVaQnMb+ww==
X-Received: by 2002:a05:6e02:1c2d:: with SMTP id m13mr4574692ilh.137.1627738433673; Sat, 31 Jul 2021 06:33:53 -0700 (PDT)
Received: from smtpclient.apple ([2601:246:4e04:9f90:d4ff:36e4:9380:72ed]) by smtp.gmail.com with ESMTPSA id y14sm2343025ilv.76.2021.07.31.06.33.52 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Sat, 31 Jul 2021 06:33:53 -0700 (PDT)
From: "Mark Baushke (ietf)" <mbaushke@gmail.com>
X-Google-Original-From: "Mark Baushke (ietf)" <mbaushke+ietf@gmail.com>
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 14.0 \(3654.100.0.2.22\))
In-Reply-To: <A3B7F66E-1724-4D8C-B888-E862D65448DF@sonic.net>
Date: Sat, 31 Jul 2021 06:33:52 -0700
Cc: curdle@ietf.org, kitten@ietf.org
Content-Transfer-Encoding: quoted-printable
Message-Id: <F3BE35A6-CFF7-4CBE-AB4C-291FF02557F4@gmail.com>
References: <jlgeebfzxe5.fsf@redhat.com> <A3B7F66E-1724-4D8C-B888-E862D65448DF@sonic.net>
To: Robbie Harwood <rharwood@redhat.com>
X-Mailer: Apple Mail (2.3654.100.0.2.22)
Archived-At: <https://mailarchive.ietf.org/arch/msg/kitten/KkjdVSvDAzJ15EUdLIqjWF0tYWg>
X-Mailman-Approved-At: Mon, 02 Aug 2021 07:21:30 -0700
Subject: Re: [kitten] [Curdle] Diffie-Hellman modulus sizing in Kerberos PKINIT
X-BeenThere: kitten@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Common Authentication Technologies - Next Generation <kitten.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/kitten>, <mailto:kitten-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/kitten/>
List-Post: <mailto:kitten@ietf.org>
List-Help: <mailto:kitten-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/kitten>, <mailto:kitten-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sat, 31 Jul 2021 13:34:01 -0000

Hi Robbie,

I made a few mistakes in my last message.

> On Jul 30, 2021, at 12:07 PM, Mark D Baushke <mdb@sonic.net> wrote:
> 
> Hi Robbie,
> 
> To summarize:
> 
> DH Parameter Set.             RFC 4556 Guidance.   Draft Guidance
> 1024-bit MODP group 2   - MUST                           MUST NOT
> 2048-bit MODP group 14 - MUST                           MAY
> 4096-bit MODP group 16 - SHOULD                      MUST
> 
> I would have thought going from a Mandatory to Implement (MTI) as a MUST to disallowed (MUST NOT) for the 1024-bit MODP group 2 as the logical path, but moving to deprecated with a MAY is defensible. 

I meant to say SHOULD NOT rather than MAY to make It deprecated.
On further reflection, I like the MUST NOT better.

> 
> I would suggest moving from MTI  for 2048-bit MODP group 14 moves to SHOULD for now that there is a good period of interoperability.
> 
> I think is may also be desirable to add either 6144-bit MODP group 17 or 8192-bit MODP group 18 to the list as a MAY for forward looking groups that are larger than 4096-bit MODP MUST.

I should have written that it would be desirable to have a stronger MODP group available that MAY be used. I regret that the sentence was confusing.

        Be safe, stay healthy
        -- Mark

v2.8.7 | Report a Bug | By Email