[Ssh] Re: chacha20 update

[Niels Möller <[e-mail]>]

Simon Josefsson <simon=[e-mail]> writes:

> I still think chacha20 with poly1305 is state-of-the-art authenticated
> stream cipher, or are there other alternatives to consider?  We should
> consider using RFC 7539/8439 now, but possible use the original 64-bit
> counter because a 256GB limit is problematic.

I think it would be valuable with a spec on how to plugin and use any
AEAD in a good way in ssh (in the spirit of my old draft on that topic).
But I'm not able to put in much effort at this time.

> Full-transcript signing is basic hygiene today.  It would be nice to
> start exploring ways to get there.  Can we achieve it without a
> full-blown SSH protocol version increment?

I guess it should be doable for a new kex method to specify a different
way of hashing the previous messages into the session hash signature.
Might break the spirit of the original protocol, and add a little
implementation complexity (so we should *not* have each kex method
invent its own way), but it would give a reasonable upgrade path.

Regards,
/Niels

-- 
Niels Möller. PGP key CB4962D070D77D7FCB8BA36271D8F1FF368C6677.
Internet email is subject to wholesale government surveillance.