Re: [netconf] Paul Wouters' Discuss on draft-ietf-netconf-ssh-client-server-38: (with DISCUSS and COMMENT)

[Paul Wouters <[e-mail]>]

On Mon, Mar 4, 2024 at 8:35 PM Kent Watsen <[e-mail]> wrote:

> Hi Paul,
>
> Something seems wrong with the quote-levels in your response.
> I added "[Paul writes]” to where I see your messages below.
>

Sorry. It's gmail. It takes billions of dollars to write a crappy web mail
client

This did not make it into draft-ietf-netconf-ssh-client-server-39 ?
>
>
> It will be in -40.   I was going to publish it today, but was waiting to
> hear back from other ADs first...
>

Ah okay. No problem. I was just trying to clear out my DISCUSS list.
[Paul writes]
>
> The MAC is internal to the AEAD. What this means though is that an
> encryption method that is an AEAD MUST NOT also specify a mac. And if you
> specify an AEAD and non-AEAD encryption algorithm, only the non-AEAD needs
> the mac entry. I am not entirely [sure] if the current syntax is good
> enough for these.
>
>
> I’m sorry this is taking too long, but can you please provide a concrete
> example?
>
> Is your comment related to
> https://datatracker.ietf.org/doc/html/rfc5647#section-5.1:
>
>      If AES-GCM is selected as the encryption algorithm for a given
>      tunnel, AES-GCM MUST also be selected as the Message Authentication
>      Code (MAC) algorithm.  Conversely, if AES-GCM is selected as the MAC
>      algorithm, it MUST also be selected as the encryption algorithm.
>
>
Oh interesting. I did not know SSH did it that way. With TLS, IKE and IPsec
the AEAD is specified
like a regular encryption algorithm and the mac is left empty. Since SSH
says to fill them in both,
I guess that resolves my issues of specifying none or leaving out the
field. So no changes needed
anymore. Thanks!


They will be in -40.   I was going to publish it today, but was waiting to
> hear back from other ADs first.   Sort of good thing too, since now we
> still have open the AEAD thread...
>

That's resolved now. So once -40 appears with the last minor update, I am
good to go.

Thanks for your work and quick turnaround on these!

Paul