[Ssh] Re: I-D Action: draft-ietf-sshm-cert-00.txt

[Simon Tatham <[e-mail]>]

> [e-mail] <[e-mail]> writes:
>> This document presents a simple certificate format

Peter Gutmann <pgut001=[e-mail]> wrote:
> What's the purpose of this document?

A major purpose of this WG is to publish documents specifying things
that have been deployed in practice for many years, so that people
wanting to interoperate with existing implementations can find proper
documentation of how to do it.

This _has_ been deployed in practice for many years, and therefore it
needs documenting.

Your criticisms of it seem like the kind one would expect on seeing a
first draft of a _proposed_ specification, before any implementations
exist. (Particularly the way you say it "introduces", present tense, an
opportunity to repeat old mistakes.) A good time to make criticisms of
this specification on that kind of basis would have been at least
sixteen years ago.

I'm not saying this state of affairs is a _good_ thing, exactly. A great
weakness of SSH's vendor-namespace system is that it encourages a
workflow of unilateral deployment by one vendor, followed by de-facto
adoption by others, followed by it being too late to change anything
without breaking compatibility with all the existing implementations.
Multilateral discussion about the design questions _before_ there's a
weight of history behind one set of answers is missing from our system.

But the time to start on that is when we're introducing new pieces of
SSH that _haven't_ been around for decades already, like (some of) the
PQ algorithms. Even if there were consensus that we should develop an
entirely different certificate system starting now, the old one would
_still_ need documenting.

Cheers,
Simon

-- 
for k in [pow(x,37,0x1a1298d262b49c895d47f) for x in [0x50deb914257022de7fff,
0x213558f2215127d5a2d1, 0x90c99e86d08b91218630, 0x109f3d0cfbf640c0beee7,
0xc83e01379a5fbec5fdd1, 0x19d3d70a8d567e388600e, 0x534e2f6e8a4a33155123]]:
 print("".join([chr(32+3*((k>>x)&1))for x in range(79)])) # <[e-mail]>