IETF Logo Mail Archive

Re: [Curdle] draft-ietf-curdle-ssh-modp-dh-sha2 & draft-ietf-curdle-ssh-kex-sha2

"Mark D. Baushke" <mdb@juniper.net> Tue, 13 September 2016 19:23 UTC

Return-Path: <bounces-ietf-ssh-owner-secsh-tyoxbijeg7-archive=lists.ietf.org@NetBSD.org>
X-Original-To: ietfarch-secsh-tyoxbijeg7-archive@ietfa.amsl.com
Delivered-To: ietfarch-secsh-tyoxbijeg7-archive@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 73F5012B4F2 for <ietfarch-secsh-tyoxbijeg7-archive@ietfa.amsl.com>; Tue, 13 Sep 2016 12:23:06 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -5.708
X-Spam-Level:
X-Spam-Status: No, score=-5.708 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, RCVD_IN_DNSWL_MED=-2.3, RP_MATCHES_RCVD=-1.508, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=junipernetworks.onmicrosoft.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2hQ5VSgFOIE7 for <ietfarch-secsh-tyoxbijeg7-archive@ietfa.amsl.com>; Tue, 13 Sep 2016 12:23:05 -0700 (PDT)
Received: from mail.netbsd.org (mail.NetBSD.org [IPv6:2001:470:a085:999::25]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 42D1712B056 for <secsh-tyoxbijeg7-archive@lists.ietf.org>; Tue, 13 Sep 2016 12:23:05 -0700 (PDT)
Received: by mail.netbsd.org (Postfix, from userid 605) id 10C0885EC8; Tue, 13 Sep 2016 19:23:04 +0000 (UTC)
Delivered-To: ietf-ssh@NetBSD.org
Received: from localhost (localhost [127.0.0.1]) by mail.netbsd.org (Postfix) with ESMTP id EA6DE85EC5 for <ietf-ssh@NetBSD.org>; Tue, 13 Sep 2016 19:23:00 +0000 (UTC)
X-Virus-Scanned: amavisd-new at netbsd.org
Authentication-Results: mail.netbsd.org (amavisd-new); dkim=pass (1024-bit key) header.d=junipernetworks.onmicrosoft.com
Received: from mail.netbsd.org ([IPv6:::1]) by localhost (mail.netbsd.org [IPv6:::1]) (amavisd-new, port 10025) with ESMTP id 8U1JAS_diNSe for <ietf-ssh@netbsd.org>; Tue, 13 Sep 2016 19:23:00 +0000 (UTC)
Received: from NAM03-BY2-obe.outbound.protection.outlook.com (mail-by2nam03on0109.outbound.protection.outlook.com [104.47.42.109]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.netbsd.org (Postfix) with ESMTPS id E622F85E25 for <ietf-ssh@NetBSD.org>; Tue, 13 Sep 2016 19:22:59 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=junipernetworks.onmicrosoft.com; s=selector1-juniper-net; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=2RQSMdU0QT44vXK0/VG0g02w2/lN/EEt+e6ZuQzJHTU=; b=SJDMw4QUyf7shjMfJe5/lFW+/oI1VroUPHp5zGrmuZajBTuGigcEGLYoz+DFVFOgaNB2dC0edrAHCDJuJ2QBdzD/sTF4ij6H11lx4n7353tdC+DsXSfxS6fOEtq4uRpdvqSVq8OInk/NSrPhwmktgqllia+EklJ61npk3XXtpnc=
Received: from CY1PR05CA0004.namprd05.prod.outlook.com (10.166.186.142) by BN3PR0501MB1186.namprd05.prod.outlook.com (10.160.113.18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384_P384) id 15.1.629.6; Tue, 13 Sep 2016 19:22:44 +0000
Received: from BN1AFFO11FD039.protection.gbl (2a01:111:f400:7c10::154) by CY1PR05CA0004.outlook.office365.com (2a01:111:e400:c5a4::14) with Microsoft SMTP Server (version=TLS1_0, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384) id 15.1.629.6 via Frontend Transport; Tue, 13 Sep 2016 19:22:43 +0000
Authentication-Results: spf=softfail (sender IP is 66.129.239.18) smtp.mailfrom=juniper.net; ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=none action=none header.from=juniper.net;
Received-SPF: SoftFail (protection.outlook.com: domain of transitioning juniper.net discourages use of 66.129.239.18 as permitted sender)
Received: from p-emfe01a-sac.jnpr.net (66.129.239.18) by BN1AFFO11FD039.mail.protection.outlook.com (10.58.52.243) with Microsoft SMTP Server (version=TLS1_0, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA_P384) id 15.1.619.6 via Frontend Transport; Tue, 13 Sep 2016 19:22:42 +0000
Received: from p-mailhub01.juniper.net (10.160.2.17) by p-emfe01a-sac.jnpr.net (172.24.192.21) with Microsoft SMTP Server (TLS) id 14.3.123.3; Tue, 13 Sep 2016 12:21:57 -0700
Received: from eng-mail01.juniper.net (eng-mail01.juniper.net [172.17.28.114]) by p-mailhub01.juniper.net (8.14.4/8.11.3) with ESMTP id u8DJLtIZ005412; Tue, 13 Sep 2016 12:21:55 -0700 (envelope-from mdb@juniper.net)
Received: from eng-mail01.juniper.net (localhost [127.0.0.1]) by eng-mail01.juniper.net (Postfix) with ESMTP id 45C6F1144E; Tue, 13 Sep 2016 12:21:55 -0700 (PDT)
To: Damien Miller <djm@mindrot.org>
CC: Curdle <curdle@ietf.org>, IETF SSH <ietf-ssh@NetBSD.org>
Subject: Re: [Curdle] draft-ietf-curdle-ssh-modp-dh-sha2 & draft-ietf-curdle-ssh-kex-sha2
In-Reply-To: <alpine.BSO.2.20.1609140340320.58455@natsu.mindrot.org>
References: <41049.1473653352@eng-mail01.juniper.net> <alpine.BSO.2.20.1609140340320.58455@natsu.mindrot.org>
Comments: In-reply-to: Damien Miller <djm@mindrot.org> message dated "Wed, 14 Sep 2016 03:47:20 +1000."
From: "Mark D. Baushke" <mdb@juniper.net>
X-Phone: +1 408 745-2952 (Office)
X-Mailer: MH-E 8.6; nmh 1.2; GNU Emacs 24.3.1
X-Face: #8D_6URD2G%vC.hzU<dI&#Y9szHj$'mGtUq&d=rXy^L$-=G_-LmZ^5!Fszk:yXZp$k\nTF? 8Up0!v/%1Q[(d?ES0mQW8dRCXi18gK)luJu)loHk, }4{Vi`yX?p?crF5o:LL{6#eiO:(E:YMxLXULB k|'a*EjN.B&L+[J!PhJ*aX0n:5/
Date: Tue, 13 Sep 2016 12:21:53 -0700
Message-ID: <38090.1473794513@eng-mail01.juniper.net>
MIME-Version: 1.0
Content-Type: text/plain
X-EOPAttributedMessage: 0
X-MS-Office365-Filtering-HT: Tenant
X-Forefront-Antispam-Report: CIP:66.129.239.18; IPV:NLI; CTRY:US; EFV:NLI; SFV:NSPM; SFS:(10019020)(6009001)(7916002)(2980300002)(199003)(189002)(5660300001)(626004)(7126002)(76506005)(92566002)(69596002)(50986999)(68736007)(5003940100001)(106466001)(7696004)(97736004)(76176999)(230783001)(8676002)(50226002)(8936002)(105596002)(117636001)(53416004)(81166006)(110136003)(81156014)(47776003)(2906002)(4326007)(305945005)(87936001)(2810700001)(2950100001)(356003)(50466002)(86362001)(48376002)(77096005)(189998001)(586003)(11100500001)(42262002); DIR:OUT; SFP:1102; SCL:1; SRVR:BN3PR0501MB1186; H:p-emfe01a-sac.jnpr.net; FPR:; SPF:SoftFail; PTR:InfoDomainNonexistent; A:1; MX:1; LANG:en;
X-Microsoft-Exchange-Diagnostics: 1; BN1AFFO11FD039; 1:tVGU+buO9b0OApGPo3c5son33REa/9/JKqe3VEplDLs2fwddkEsI29QIwmKF9lnb6s7eJHRLheBhw/VP9ghy+k+221Cx22KgM3BhG949fFvMtgIoK1IxPpR8tV+nqn0infcUzojxDLkp1uMdqg4UQEEhCG9/g6US1JWMYjR+OjHWijdE4rxhuJ9z7Te6RiP8dfrIXWeivQ7NMqsaz4WXod1CtOdiLCUXNq0Dgs7i572A+NpCav31IV7JW4+9h2MB5VtC6zC9NpCF5mV7SdQd07OqsGcasZR2y6ktpaqRk6fEPY74SbUhk1YJls/wcF/iDmd0fNm1L3Lfjj4uC4Z1FxitJAYqkxq4NQGnF0UnktvV0vL647aqGIaxdg4Z8prhP981jlACYqQqzvMHDU3UC6epzJqNGPoqOW/6Xlcu1YHLSam4+94ZUkwDGO/tcVGeEuhIRTRB2XTOzOiEZomMMcHbMA9/zsfWl9deLXDb0/R/xaAptmjmLITuZ+P9hUR8QuhoQPgISDrv2TD012LHDYmb3qq+hbaXdlb6BwlJS7eatsAX0STOeHCGUJAAqDkS
X-MS-Office365-Filtering-Correlation-Id: 1ec459ca-b952-42e0-3eda-08d3dc0b555d
X-Microsoft-Exchange-Diagnostics: 1; BN3PR0501MB1186; 2:17O2J50syYQ5JfL8IzabnZoPT5J2ZX62cNUInOT/Y8CA708YWAJRNY75N8TkGx1gHxHGZzKnSKMU/tpmskG4KRABgLpfku984YESJHYhBzdou+Lwn5ifOwf022blH+O9WE84rbmls8db1KeN+Z1dnoyENh0fdR3HLSqCmOAcB4aLryTLRaUlX6KcvkOtjsVW; 3:LOSZLrDLNqYxdWHrihi+rcap6cqj0oxIZO35GG1swjApcn+tALu0+M9NLVfW2VhFYaaqkXlCocZSBKYDSh10vc/qd5Y1WNXu7wX0r1nReVlQcMuyO8B+wNfbCe4YeVizUbAIPPsVilYxuniUmTbN8IorufV3l8fE4NL2KUmO+quCYTlPUA2dnkwliMUY+caZMEDPlDzQgfkHC/Ue4+hRykKPMC5XWEowCcwFNtUt5ZU=; 25:OUEQOpsmWTc2Foy1DefkFmD6IS4rT7ToVRtDAUIVB6nD8Q9IhCOO4MV1VjP28ouRZ2+e0Py+qW+WlP7Qe3AfgyFNaJFhgy/IB48AGJ/rtbUliBKWm/RhLcd6nlakz0FlN8LZkPeRaZ2vKB9tkAtPP+/HcuPFc/bSxzx59E8gJt7A6OEPXAV+Y+ksE1KtS7YIv1dXep+VdVlZbtdBOVvK1CPmONj3rOQDMIRdKnLHv9+FoCtcbuKkm6rZTJc3VaVhYea/s82M32+Ci18/b/Ac1vktUBiI1hnfky6urPZirWZMQ7d7sHEFGr3kTKQYkSEh91y7JP37FW3IROxjHYkmK6/BGu+2ANJv8GwyrqQw7j3jT11Rcy+EoiSHq63FVUMlV0PLa/mUwiUBRlGXLDpAtHWYuUOxWVPPgICEjTNTq18=
X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:BN3PR0501MB1186;
X-Microsoft-Exchange-Diagnostics: 1; BN3PR0501MB1186; 31:suMrBHhgM+Qt6rw3JOu/UjqnPD8VY6n+vRKCciwiLfrVsFmOEIBL9N9O2dnE8IraqidMjo//+Tr3ZFzxFk0teiZGEDnMLgBsGJFcrLrmPhItWM/XA1llsgt2VpOHiiqDcIrT3Vl6tGQf0Ds+cTiwF/xYeDEVlA89WYj80qnk7MnEZdmhAfjy3QfX47OdZuCS1/5xcYY4pdkl87HzBGBYqrqRbNyCQ43rHRuHSLQYSD0=; 20:6CpvnAs91Vq3qey/sz0thwtafjCW69BwXfVj71J5TCPqIxVf1BybFkIrlDGqkpPYfOiEw2vuzRMXt0HNNzOE2V7sZFVmltpLU+jnAqKlsiHmptlLM8pG/OH6XpWlvNOobFjL6Y01iueTuVOHWL4stFut+2mcwPtD5g9nu2EFPROoGZR3Otoxot3Ys3X3q+P49TbEDj9X1viX6bTA0eIFe+ohTfoXf8+sDoN9c4tsUERNHxTYV4YtO4xTMRO7tYG25Ptk4Gf7cIOToRXiIkytCJohOMUXk9rU6D0spaw4qyjSrLau04qksyxkboAedG1VRxmYhTFSOrsqMG51A9YH/TfREjuDiFCYLkdPy/xI0ZI6W9N4xHR6zqWVs85pvlknB8ujIi936Czl/aPwJAiaUyh7fl12kPelJE/K82bZt4kb1CvOCA5wzxlmn/lghrc9SVcIgUA5mbx3si11WbozSanVCCneDLtr4HRi7wOHiG8DHReeistAsInxsoQd96zd
X-Microsoft-Antispam-PRVS: <BN3PR0501MB11867293142D78BCFC6DE855BFFE0@BN3PR0501MB1186.namprd05.prod.outlook.com>
X-Exchange-Antispam-Report-Test: UriScan:;
X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(6040176)(601004)(2401047)(13015025)(13017025)(13024025)(13018025)(13023025)(8121501046)(5005006)(3002001)(10201501046)(6055026); SRVR:BN3PR0501MB1186; BCL:0; PCL:0; RULEID:; SRVR:BN3PR0501MB1186;
X-Microsoft-Exchange-Diagnostics: 1; BN3PR0501MB1186; 4:8XwhmNSHXr+g9iCl9GrfGu3eKrhnqfSip2HWjRMPVEfD481wTnHguK8pWdtx4Ro8eqLNB6W2GfMfTdRqKay7177KL4oQJkDLTA6dOPh4ZRiYVfPSgN5AA/u2xXwqjBDvz+YzYZCVXojHqXBtfXI1ZxhKNHK5SaIPyCSnJ2rVI3vRP5SZSHXqZ3FK6zMtaf1tLOAYCN+yub9ws+CGgDnmOFlQv22/mldsSNcCm9jlNDo4DkVfvN4zc7Du4aUJ5oDovozKxtjOK9Suq2NS0X1yFDYrjwKSR1PkCWZ6IMMggpbT+zSZrvgBZ0Tqiy/E7qEZ7qtGEyk+5XzU+EAB284v8bIjce/w5ZNXFOaNrQwwMkGiwyoU+Z376+yuE94mLXfM7S9O8rkqrjDOpn5ML3Zk1QQw7XsEWbscJAJsuqN+YGSh4nJ7lv7XIE933h7ZhFfeDmeGatb3LqQx1BVdryAOSuNC2bB9fxcVdW+RQZdp46QuDst4+Pn/FBUItplXPs53
X-Forefront-PRVS: 0064B3273C
X-Microsoft-Exchange-Diagnostics: 1; BN3PR0501MB1186; 23:Fgn8tWoU93tHtK4LdP58RiKlaRfpG0Xcdac10klrBY4YNIOVloBrTJ+g551HrEjLOzeAhGGMkWsAJ83P398JnPi9tUmMec+xLv75t+y2KAXPQLk4blSCBS8jkoXLPKKaMxlZvM+h2cZa3jcQMnnorJh1qgjTkaRaQt5jPdtU8B3xkv4m+NgTNzSlgXKG20OJILoRRtzJCSZFVj+qdpgk2V21pw5KoM15UURJMPqsKNjrNsnQb6isyd0RvKCrnPfcmmPjHhhiSocpTgFIzUE76zOWYBkPMS+QiIOXnvucyRnfBTccMarSQ4ORdm9ErcN6Tnc0d9E3F9JatvxUVs9yaCyvpEll+cBvSW9yIbV3vbr0EbGUuHiMmEephQ0UkOp4sjpMOKnrJF3ngacFZPF/Imzfzz54AVBlS6CdW4FjTtEBVaGRpNuCu7LfKuGWMt0qa85otShdVrtxTqt5L0Fr6yLGlYfORsR7YBC0PAUchaZQ4SIQVAcsu5Oq/OvsIrLqEVfeunpF5s2uexSm60qFNh1XVr06eke7y+mdAwjwzcOhURFpeAMb8cPhhiml7+RCvGZsIc1bhsQx5QdXzBg9uptbu+i3zZN9bCNv8/1KKPhzQ/UY4VkdaWasHOP74G3tEyYl3Y9wiMV6fJgLmLJf46slRAdGaUj7RfB8K3e19O+GIWRDnb3KY4yA7fIKhLZKdCGQFqO7mVPHJj3pikuxnRVLMsrTTy8Uoq82d7CgZ6fKo5/keiyDyOJeSPkZFZg09SpxGIMGTcRxgSm8EVPYlCYNH5eSuAFxcW5Enemf7U0xI1TIaFeYMdIhfw+1yZ7uxnGRlR3aGSjJY9J+Shuh3g3uiSCkiRazHSEfcItknqw57cqhso+Mk9sz2YfAOeWE7/oxkIEt5bk5YXeWLE/4XvD3VtcYxLCy4bRBqLU55ZDaE34MsX84kWmrSr9lfkIOa45FIYCLOPOWe4h8sl2Po1IYMdy4XtKrk24d7zcrB3YVfocheo9q4yR7jgrQkbJndxtE1bSFOlGcOqm9MqfZesc4Kxjxk7klln3Je9noa4sIYI/u8K4EtEdiS8OefB6q
X-Microsoft-Exchange-Diagnostics: 1; BN3PR0501MB1186; 6:0ONJjJjcYIHTvlwyenZUjcr1OOJ3aQMzHX57UbgEgbEqJncNSq7NXiYofztV3ggdAlTh935GV65+fhDGxvYkcju4pqk1zILsfBxZIFVbjNqYk8C6zA8P+QStR9SOyGD5Gj6GhYzLAiAQEQJ6vaBbcXl6oJju0Iamxf3WQAEF3FQq6YwDAr4AvCeutsh+Se/X9aDSXwGjKM25WZ7aHyMZ/iJ87dJp+vVkMulh45CEQgzQQlq4oKvt5ix+JOt5hJxyZe86zTEIIByqwTgGgATkrpLG4zP2ppoqREYPFu4qGLEQ7ADSeIANjuJncthryH4yj1xzMt1Sv8ek7suS2AkVnw==; 5:7nWqIYwNQ0UaZ7EFCIel9Ihb4WPYAbbJ7skBlUGCsJZSQiDTSg5hb+RYyIg+Zrqr/laB0QeycuvcO2G803B2d0cKMMVA6wY4CCFQq3r/awFR68YOueX2VAitoEAKCF5H89A2m45X6EjjVBIl8KpgKQ==; 24:EZxCZ5PEnN+X863h1J6phJr+b9v2DJPX4kCD5G690oJLczO+VjiXAfj7Ay0Fi0iRxWQVUz/29H5zMz4nkjOsrlVA+0C06hbS92igXX3PRiE=; 7:h7W2bgs6G4ppVXoPl/0mEwJGH6ys7QF3/zJl15G/Ym9lYhY0Bjpo4FhvEzftD7C1SNx9zJKwxk1fyiwg1oZ6s/LWxqf+kENByh6Ib5EvrTzslkyXbi2Ftxve7qOGKRyVUZhMLFFyDfTBKB7qaTXDmLkg0cg6Ti4+iBSFB7jh5FkLTvmKjrUj/4+J1KSKixTgZ9Y0KyJZBnhQOR1f2szfypqT6yIV2S9Eyc8EovMqaPDS3asdJr/ibkF+v7uZt7TX
SpamDiagnosticOutput: 1:99
SpamDiagnosticMetadata: NSPM
X-OriginatorOrg: juniper.net
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 Sep 2016 19:22:42.0553 (UTC)
X-MS-Exchange-CrossTenant-Id: bea78b3c-4cdb-4130-854a-1d193232e5f4
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=bea78b3c-4cdb-4130-854a-1d193232e5f4; Ip=[66.129.239.18]; Helo=[p-emfe01a-sac.jnpr.net]
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN3PR0501MB1186
Sender: ietf-ssh-owner@NetBSD.org
List-Id: ietf-ssh.NetBSD.org
Precedence: list

Damien writes:

> Has anyone ever implemented this? AFAIK the motivation for this was
> MQV being included in NSA Suite B at the time, but it was subsequently
> dropped. IMO if nobody is using it then it should be recommended
> against. I.e. SHOULD NOT

Hmmm... ecmqv-sha2 is mentioned in defined in RFC 5656 and mentioned in
RFC 6187. I see a JIRA request to add it to MINA SSHD, but I am unaware of
any implementations of it. 

I have no problems moving ecmqv-sha2 to SHOULD NOT if no one has
implemented it. However, I guess I should ask that of the ietf-ssh list
first.

> > gss-group14-sha1-*                    RFC4462       SHOULD
> > gss-group14-sha256-*                  new-modp      SHOULD
> 
> IMO these two should be MAY. Most implementations don't support
> GSSAPI key exchange at all.

Perhaps I need a paragraph like this one:

     If GSS-API methods are available, then the RFC4462 REQUIRED
     gss-group14-sha1-* method SHOULD be retained for compatibility
     with older Secure Shell implementations and the
     gss-groups14-sha256-* method SHOULD be added as for "sha1".

	-- Mark

v2.23.0 | Report a Bug | By Email