Subject: Re: [Curdle] I-D Action: draft-ietf-curdle-rsa-sha2-00.txt

From: denis bider <[email-masked]>
Date: Fri, 11 Mar 2016 17:22:40 +0000

Apologies for the lack of "ssh-" in the rsa-sha2 draft name. I can resubmit with improved name next time, with any other changes that might come up.

These drafts belong here because SSH is somewhat orphaned in terms of active working groups, and this is part of a necessary crypto update to SSH. It's covered under the "DLE" part of "CURDLE", which stands for "Deprecating and a Little more Encryption".

The new signature algorithms, rsa-sha2-256 and rsa-sha2-512, are needed to replace "ssh-rsa", which uses RSA with SHA-1. 

The SSH extension mechanism draft is needed for new signature algorithms to be usable. Servers exist which will penalize the client for using an unsupported signature algorithm. A mechanism is needed for clients to discover that the server supports rsa-sha2-256 or rsa-sha2-512.

The alternative to the extension mechanism would be to restrict use of the new signature algorithms to newly generated keys that would be incompatible with the "ssh-rsa" signature algorithm. This would create a hurdle for adoption. It would prevent use of rsa-sha2 signatures with existing RSA keys, and would prevent use of new RSA keys with other parties that implement only "ssh-rsa". Creating these hurdles would be unfortunate and unnecessary, given that there is no change to the underlying RSA algorithm or keys.

If there is another way we should be pursuing to standardize these new signature algorithms, and the extension mechanism they need, I'm open to any suggestions. The extension mechanism is ambitious, but it is part of the "Deprecating and a Little more Encryption" effort.

One thing we could do is, we can definitely cut some of the proposed extensions that don't fit this working group's goals. The "server-sig-algs" extension is the main one needed for the rsa-sha2 signature algorithms, and is the main one that is going to have multiple implementations initially. I am currently aware of OpenSSH, SmartFTP, and Bitvise implementing this.

----- Original Message -----
From: Paul Hoffman  Sent: Thursday, March 10, 2016 10:49 To: [email-masked]  Subject: Re: [Curdle] I-D Action: draft-ietf-curdle-rsa-sha2-00.txt   On 10 Mar 2016, at 1:14, [email-masked] wrote:   > A New Internet-Draft is available from the on-line Internet-Drafts   > directories. > This draft is a work item of the CURves, Deprecating and a Little more   > Encryption of the IETF. > >      Title           : Use of RSA Keys with SHA-2 256 and 512 in   > Secure Shell (SSH) >      Author          : Denis Bider > Filename        : draft-ietf-curdle-rsa-sha2-00.txt > Pages           : 6 > Date            : 2016-03-10 > > Abstract: > This memo defines an algorithm name, public key format, and  signature > format for use of RSA keys with SHA-2 512 for server and client > authentication in SSH connections.   The chairs (well, a chair) asked me to bring this discussion here.   1) Why is this draft even in this WG? It doesn't seem to be covered by   the charter, which is all about the new curves.   2) If for some reason we went to keep this in the WG, it should be  renamed to include "-ssh" in the file name so that people are clear it   has nothing to do with the other protocols that are being dealt with  here.   --Paul Hoffman   _______________________________________________ Curdle mailing list [email-masked] https://www.ietf.org/mailman/listinfo/curdle

---

From: "Paul Hoffman" <[email-masked]>
Date: Sat, 12 Mar 2016 09:20:32 -0800

On 11 Mar 2016, at 9:22, denis bider wrote:

> These drafts belong here because SSH is somewhat orphaned in terms of 
> active working groups, and this is part of a necessary crypto update 
> to SSH. It's covered under the "DLE" part of "CURDLE", which stands 
> for "Deprecating and a Little more Encryption".

And it seems to be directly prohibited by the last paragraph of the 
charter that was agreed to by the IETF:

"The CURDLE working group is not chartered to consider allocating new 
codepoints for any algorithms or modes other than those mentioned above. 
Should someone wish to propose such work, a re-charter will be required. 
At this time, there is no expectation that such a re-charter will be 
requested."

There is nothing preventing you from moving the RSA/SHA2 work as an 
Individual Submission; in fact, that would be a much better option than 
asking us to do a charter revision before we have started anything on 
the main work we agreed to do, namely the new curves and deprecating 
creaky crypto.

--Paul Hoffman

---

From: "Salz, Rich" <[email-masked]>
Date: Sat, 12 Mar 2016 17:37:43 +0000

> And it seems to be directly prohibited by the last paragraph of the charter
> that was agreed to by the IETF.

I think that you're right.   If the working group feels strongly that we should ask to amend the charter to include things such as "RSA with SHA2", or prefers to not expand in that area, please speak up here.

---

From: Stephen Farrell <[email-masked]>
Date: Sat, 12 Mar 2016 18:53:31 +0000

On 12/03/16 17:37, Salz, Rich wrote:
>> charter that was agreed to by the IETF.
> 
> I think that you're right.   If the working group feels strongly that
> we should ask to amend the charter to include things such as "RSA
> with SHA2", or prefers to not expand in that area, please speak up
> here.

FYI, if the WG don't want to take this on, then I'll be happy to
look at AD sponsoring it. So, saying "not in curdle" here is not
the same as saying "let's not do the work." (That said, I've not
read the draft yet.)

Cheers,
S.

> 
> _______________________________________________ Curdle mailing list 
> [email-masked] https://www.ietf.org/mailman/listinfo/curdle
>

---

From: Mark Baushke <[email-masked]>
Date: Sat, 12 Mar 2016 19:10:29 +0000

> On Mar 12, 2016, at 10:53 AM, Stephen Farrell <[email-masked]> wrote:
> 
> 
> 

For what it may be worth, draft-ietf-curdle-ssh-kex-sha2 also adds
three Diffie-Helman key exchange groups (code points) with sha2
as well as indicating the relative merits of the all of the current key
exchange methods including the new curve25519 and curve448
methods. So, that draft is sort of a hybrid for SSH and the WG.
If you want to separate out the two concepts into a WG draft and
an individual draft for SSH, let me know.

I have no objection to amending the charter if that is not too much
or a burden to the WG chairs and members.

> [email-masked]
> https://www.ietf.org/mailman/listinfo/curdle

	Enjoy!
	-- Mark

---

From: "Salz, Rich" <[email-masked]>
Date: Sat, 12 Mar 2016 19:54:31 +0000

> For what it may be worth, draft-ietf-curdle-ssh-kex-sha2 also adds three
> Diffie-Helman key exchange groups (code points) with sha2 as well as
> indicating the relative merits of the all of the current key exchange methods
> including the new curve25519 and curve448 methods. So, that draft is sort of
> a hybrid for SSH and the WG.
> If you want to separate out the two concepts into a WG draft and an
> individual draft for SSH, let me know.

Regardless of what happens, I think it makes sense to have two documents.  Small simple docs covering an individual "thing" make sense.

If you want to do it now, before many have read the existing one, great.  If you don't have time, that's also fine.