Re: [secdir] secdir review of draft-ietf-curdle-gss-keyex-sha2-07

[Jeffrey Hutzelman <[e-mail]>]

Actually, this is not an issue. The value H is the SSH exchange hash, which is a common element across all key exchange methods. It is discussed in detail on the following page, which I think makes it clear that the hash is over a concatenation of a number of items of type 'string', except for K, which is an mpint. These types and their representations are described in RFC4251 section 5. In particular, 'string' is a counted string, so no, the cases you describe do not result in the same value for H.


-- Jeff


________________________________
From: secdir <[e-mail]> on behalf of David Mandelberg <david=[e-mail]>
Sent: Tuesday, January 1, 2019 3:33 PM
To: Simo Sorce; [e-mail]; [e-mail]; [e-mail]
Subject: Re: [secdir] secdir review of draft-ietf-curdle-gss-keyex-sha2-07

On 1/1/19 9:06 AM, Simo Sorce wrote:
> On Mon, 2018-12-31 at 14:57 -0500, David Mandelberg wrote:
>> Section 5.1: When calculating H, are the boundaries between each
>> concatenated thing clear? E.g., would V_C = "1.21" V_S = "0.1" and V_C =
>> "1.2" V_S = "10.1" result in the same value for H?
>
> All else equal I think it would

Ok. I don't have any specific attacks in mind, but that seems like a
potential weak point. This probably isn't the right document to change
that in though.