Comments on draft-bider-ssh-quic

[David Schinazi <[e-mail]>]

Hi Denis,

Thanks for writing draft-bider-ssh-quic
<https://datatracker.ietf.org/doc/draft-bider-ssh-quic/>!
I've been thinking about SSH over QUIC but never found
the time to actually sit down and write anything.

I have some comments, mainly on QUIC (I know QUIC
better than I know SSH).

I don't think your plan to use QUIC short headers without
long headers is viable. In QUIC, we use long headers to
determine the QUIC version, and also connection IDs.
QUIC won't work without that. I see that you exchange that
information in SSH_QUIC_INIT/SSH_QUIC_REPLY but
that won't work with QUIC load balancers. You're also
reinventing something that already works, which will mean
additional implementation work.

I think it might be simpler to build something closer to
QUICv1. For example, you could reuse the QUIC
CRYPTO stream in INITIAL packets to perform the
SSH key exchange. This would provide multiple features:
- QUIC would handle retransmissions for you
- there is no longer a size limit on those packets

Regarding the obfuscated envelope, I think that's an
interesting feature, but it would be even more useful if
we could define it as an extension to QUIC in general.
That way other application protocols could benefit from it.

All in all, this is really great work, but perhaps it would
benefit from less changes from regular QUIC.

Cheers,
David