Re: [saag] SSH & Ntruprime

On Wed, 27 Mar 2024 at 07:09, Michael Richardson <mcr+ietf@sandelman.ca> wrote:
>
>
> Orie Steele <orie@transmute.industries> wrote:
>     > 1. Publish SSH related specifications as RFCs
>     > 2. Support the review process from RFC9519 (We're working to resolve the
>     > issue with the list, thanks for reporting it)
>
>     > I don't think using IDs to document SSH algorithms and then never
>     > publishing those drafts helps either community.
>
> It's a lot of effort and money to publish a document for an algorithm that
> some say isn't as secure as claimed, and perhaps shouldn't be widely implemented.
>
Hi Michael,

I asked about the security of ntru prime back in December 2022:

https://mailarchive.ietf.org/arch/msg/cfrg/AX9WGbiNpNmRpe9KJ1DEc7vi6ss/

Are you aware of weaknesses in ntruprime now ?
Can you please share if such is the case ?

> a) anyone can register foobar@example.com in the SecSH ecosystem, and openssh
>    has done exactly that, and really, it's done.
>
> b) if someone wants "foobar", I'm fine with *any stable web page* (including
>    ietf.org/archive/foobar).  That's what **Specifications Required** means, and
>    please let's not raise the bar here.
>    If necessary, we can loop it through archive.org, which is what the RPC
>    is doing for other references in RFCs.
>
> c) If you are bothered by the IANA Considerations, then write a document to
>    change them.
>
> {yeah, I worked for SSH.com 25 years ago, but never on SSH}
>
> --
> Michael Richardson <mcr+IETF@sandelman.ca>, Sandelman Software Works
>  -= IPv6 IoT consulting =-                      *I*LIKE*TRAINS*
>
>
>
> _______________________________________________
> saag mailing list
> saag@ietf.org
> https://www.ietf.org/mailman/listinfo/saag