[Ssh] Re: New draft: draft-miller-sshm-strict-kex

[Tero Kivinen <[e-mail]>]

Simon Josefsson writes:
> > So you say that someone has already implemented chacha20-poly1305 (non
> > vendor specific name) without implenenting "kex-strict" (non vendor
> > specific name)?
> 
> No.  Let's assume we have RFCs for chacha20-poly1305 that mandates
> kex-strict, and those RFCs do not mention the vendor names.  An
> implementer following those documents will not add support for the
> vendor names.  Their users will not be sufficiently protected.

I do not understand why?

If an implementation supports chacha20-poly1305 and kex-strict and
proposes them, and if other end also supports RFC versions, they
negotiate kex-strict and chacha20-poly1305.

If the other end does not support RFC versions, then they do not use
chacha20-poly1305 at all as they do not have common cipher, and use
some other cipher, which is still safe. 

> If we want RFCs to be engineering documents, they need to discuss
> reality even if that is not ideal. If we want RFCs to be ideal
> documents, implementers will need to go elsewhere for engineering
> documentation. I don't think the latter situation is a good one.

I do not see why implementors would need to go elsewhere even when we
write good and clean RFCs (or what you call ideal). I do not think
engineering documents need to be not-ideal, when we have option to do
that.

In this case it seems we do not have option so we have to accept this
situation. 
-- 
[e-mail]