Subject: [Curdle] AD Review: draft-ietf-curdle-ssh-ext-info-00.txt

From: Eric Rescorla <[email-masked]>
Date: Sat, 17 Jun 2017 12:37:50 -0700

S 2.1.
  The indicator names inserted by the client and server are different to
  ensure that these names will not produce a match, and will be neutral
  with respect to key exchange algorithm negotiation.

Can you explain what "neutral" means?

S 2.2.
If a client or server offers "ext-info-c" or "ext-info-s"
  respectively, it must be prepared to accept a SSH_MSG_EXT_INFO message
  from the peer.

Can a server send ext-info-s if it did not receive ext-info-c?

S 3.4.
  A client sends "y" to indicate its preference that the session should
  be elevated; "n" to not be elevated; and "d" for the server to use its
  default behavior. If a client does not send the "elevation" extension,
  the server SHOULD act as if "d" was sent.

You need a citation for "elevated."

---

From: denis bider <[email-masked]>
Date: Mon, 19 Jun 2017 10:13:19 -0600

> Can you explain what "neutral" means?

Rephrased as:

"The indicator names inserted by the client and server are different to ensure
these names will not produce a match, and therefore not affect the
algorithm chosen in key exchange algorithm negotiation."

> Can a server send ext-info-s if it did not receive ext-info-c?

Certainly. RFC 4253 makes no suggestions that either client or server
should wait for the other with their KEXINIT packet. The server is free to
send KEXINIT before receiving anything from the client.

I have made this clearer by elaborating Section 2.2.

> You need a citation for "elevated."

I have added the following paragraph:

"The terms "elevation" and "elevated" refer to an operating system mechanism
where an administrator user's logon session is associated with two security
contexts: one limited, and one with administrative rights. To "elevate"
such a session is to activate the security context with full administrative
rights. For more information about this mechanism on Windows, see also
[WINADMIN] and [WINTOKEN]."

The informative references are:

WINADMIN:
https://blogs.msdn.microsoft.com/winsdk/2013/03/22/how-to-launch-a-process-as-a-full-administrator-when-uac-is-enabled/

WINTOKEN:
https://msdn.microsoft.com/en-us/library/windows/desktop/bb530718.aspx

denis

On Sat, Jun 17, 2017 at 1:37 PM, Eric Rescorla <[email-masked]> wrote:

> _______________________________________________
> Curdle mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/curdle
>
>

---

From: Eric Rescorla <[email-masked]>
Date: Mon, 19 Jun 2017 10:12:20 -0700

Thanks. This all looks fine.

On Mon, Jun 19, 2017 at 9:13 AM, denis bider <[email-masked]>
wrote:

> where an administrator user's logon session is associated with two
> security contexts: one limited, and one with administrative rights. To
> "elevate" such a session is to activate the security context with full
> administrative rights. For more information about this mechanism on
> Windows, see also [WINADMIN] and [WINTOKEN]."
>
> https://blogs.msdn.microsoft.com/winsdk/2013/03/22/how-to-
> launch-a-process-as-a-full-administrator-when-uac-is-enabled/
>
> WINTOKEN: