[secdir] secdir review of draft-moonesamy-sshfp-ed25519-01

"Joseph Salowey (jsalowey)" <jsalowey@cisco.com> Tue, 27 May 2014 04:35 UTC

Return-Path: <jsalowey@cisco.com>
X-Original-To: secdir@ietfa.amsl.com
Delivered-To: secdir@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com []) by ietfa.amsl.com (Postfix) with ESMTP id 7C7851A0363; Mon, 26 May 2014 21:35:51 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -15.152
X-Spam-Status: No, score=-15.152 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-0.651, SPF_PASS=-0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham
Received: from mail.ietf.org ([]) by localhost (ietfa.amsl.com []) (amavisd-new, port 10024) with ESMTP id PJIKEsKO-QNT; Mon, 26 May 2014 21:35:50 -0700 (PDT)
Received: from rcdn-iport-7.cisco.com (rcdn-iport-7.cisco.com []) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CB56C1A0360; Mon, 26 May 2014 21:35:49 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=1254; q=dns/txt; s=iport; t=1401165347; x=1402374947; h=from:to:subject:date:message-id:content-id: content-transfer-encoding:mime-version; bh=6JXGooNeysUORUVL00cRoL67qxq1JKjmTqmeYSnZUNs=; b=T5xIRMBOyuSs2EqV6Uj6ib391lMi/9mOrBwbPlsHJnlEKV6ZximzSIMP 6DCdu72sgy4eR17092SGkxVVhoxiD3kpuaYPYcRLF7XrQ3PGFZRVwMQUX kLblcvlicQwBj5Q31IQA9AF+3pFlXrBhUSew7EUw6yXZrH/BKtns2BbAE o=;
X-IronPort-Anti-Spam-Filtered: true
X-IronPort-Anti-Spam-Result: AhAFAMkVhFOtJA2B/2dsb2JhbABZgweBKsMiFnSCLDpRAT5CJwQBiFTUGReSBIEVBJlzkyeDOIIv
X-IronPort-AV: E=Sophos;i="4.98,916,1392163200"; d="scan'208";a="328100325"
Received: from alln-core-9.cisco.com ([]) by rcdn-iport-7.cisco.com with ESMTP; 27 May 2014 04:35:46 +0000
Received: from xhc-aln-x13.cisco.com (xhc-aln-x13.cisco.com []) by alln-core-9.cisco.com (8.14.5/8.14.5) with ESMTP id s4R4Zkqk026228 (version=TLSv1/SSLv3 cipher=AES128-SHA bits=128 verify=FAIL); Tue, 27 May 2014 04:35:46 GMT
Received: from xmb-rcd-x09.cisco.com ([]) by xhc-aln-x13.cisco.com ([]) with mapi id 14.03.0123.003; Mon, 26 May 2014 23:35:45 -0500
From: "Joseph Salowey (jsalowey)" <jsalowey@cisco.com>
To: IESG Secretary <iesg-secretary@ietf.org>, "<secdir@ietf.org>" <secdir@ietf.org>, "draft-moonesamy-sshfp-ed25519.all@tools.ietf.org" <draft-moonesamy-sshfp-ed25519.all@tools.ietf.org>
Thread-Topic: secdir review of draft-moonesamy-sshfp-ed25519-01
Thread-Index: AQHPeWUfo5K1BZN1JUqd29NR7Q9teQ==
Date: Tue, 27 May 2014 04:35:44 +0000
Message-ID: <2ACBFFE4-BCEB-4F6D-A2D3-861BADF543DE@cisco.com>
Accept-Language: en-US
Content-Language: en-US
x-originating-ip: []
Content-Type: text/plain; charset="us-ascii"
Content-ID: <DB5FAF37BA070A4599931DE51111D9DB@emea.cisco.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: http://mailarchive.ietf.org/arch/msg/secdir/oawAi5fddJnXMfFvs-9yfgrsOO0
Subject: [secdir] secdir review of draft-moonesamy-sshfp-ed25519-01
X-BeenThere: secdir@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Security Area Directorate <secdir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/secdir>, <mailto:secdir-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/secdir/>
List-Post: <mailto:secdir@ietf.org>
List-Help: <mailto:secdir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 27 May 2014 04:35:51 -0000

I have reviewed this document as part of the security directorate's 
ongoing effort to review all IETF documents being processed by the 
IESG.  These comments were written primarily for the benefit of the 
security area directors.  Document editors and WG chairs should treat 
these comments just like any other last call comments.

This document defines an SSHFP DNS record for ED25519 signature algorithm.  The document is ready with issues:

1)  This document describes how to store the fingerprint of a public key that can be used with the ed25519 signature algorithm.  I do not see any reference as to how to use the ed25519 signature algorithm in SSH.  Perhaps I am missing a reference somewhere, but it really seems that the use of the signature algorithm in SSH should be defined somewhere, preferably in an IETF document.  I so not see the point of publishing the SSHFP record document without some reference as to how it will be used. 

2)  The examples in RFC 6594 include the OpenSSH formatted key that is decoded and hashed to obtain the resulting fingerprint.  It would be better if the draft followed this aspect of 6594 and included the key used to generate the fingerprint.