Re: [saag] Possible backdoor in RFC 5114

["Mark D. Baushke" <[e-mail]>]

Tero Kivinen <[e-mail]> writes:

> Yoav Nir writes:
> > So for the three useful groups in 5114 you didn’t need it (as 4753)
> > already existed, and you don’t need it now, as 5903 exists. I don’t
> > see anything standing in the way of moving to historic or obsoleting
> > it. 
> 
> This is true for IPsec. I am not sure if it is true for TLS, SSH and
> S/MIME.

For SSH, the IANA document URL:

  http://www.iana.org/assignments/ssh-parameters/ssh-parameters.xhtml 

does not have any reference to RFC 5114.

To the best of my understanding, SSH has never really supported anything
other than safe-primes (Sophie Germain primes at that?) Diffie-Hellman
key exchange. Although it is possible to implement Lim-Lee primes with
RFC 4419, only g,p are sent over the wire. For ECDH, SSH has RFC 5656,
so once more there is no need to keep RFC 5114 for anything SSH uses.
I do not know of any other uses of ECP groups for SSH.

> RFC4753 and 5903 only covers the IKE and IKEv2 cases, RFC5114 also
> covers other protocols, and I do not know what if they use 5114 or
> not, and if the NIST ECP group references in there are to 5114 or to
> something else.
> 
> For IPsec I think we are good, because we have separate document
> specifying the mandatory to implement algorithms, and that some
> document also specifies MUST NOTs and SHOULD NOTs.

For SSH, I have an IETF draft
https://datatracker.ietf.org/doc/draft-ietf-curdle-ssh-kex-sha2/
to cover the 'SHOULD NOT' values for key exchagne.

Perhaps we need to have a similar document for TLS and S/MIME as well?

	-- Mark