Subject: [Curdle] Review of draft-ietf-curdle-ssh-dh-group-exchange

From: Daniel Migault <[email-masked]>
Date: Sat, 10 Jun 2017 15:50:02 -0400

Hi,

Thank you for writing the draft. The draft is pretty clear and it is nice
you provided explicitly the sections that needs to be updated. I believe
the document is ready for WGLC.

Yours,
Daniel

Please find my comments below:

COMMENT A)

I suggest to have the motivations of raising the minimum value in the
introduction instead of in the content of the document.

I suggest something around the following lines for the introduction:

   Recent research [LOGJAM] strongly suggests that DH groups that are
   1024 bits can be broken by state actors, and possibly an organization
   with enough computing resources.  The authors show how they are able
   to break 768 bits DH group and extrapolate the attack to 1024 bits DH
   groups.  In their analysis, they show that breaking 1024 bits can be
   done with enough computing resources.

   [RFC4419] specifies a recommended minimum size of 1024 bits for k,
   which is the modulus length of the DH Group.  It also suggests that
   in all cases, the size of the group needs be at least 1024 bits.
   This document updates [RFC4419] so that the minimum recommended size
   be 2048 bits.

COMMENT B)

I suggest the document expresses a recommendation outside the scope of the
update, and that updates of 4419 are left as informational. Of course in
our case, the main recommendation is similar to one update.

I expect the main message of the document to be:

Servers and clients SHOULD support groups with a modulus length of k
   bits, where 2048 <= k <= 8192.

So, I suggest something around the following lines for the section 2:

   Servers and clients SHOULD support groups with a modulus length of k
   bits where 2048 <= k <= 8192.

   This document updates [RFC4419] as described below:
   * section 3 Paragraph 9 is updated as follows: Servers and clients
   SHOULD support groups with a modulus length of k bits where
   2048 <= k <= 8192.  The recommended minimum values for min and max
   are 2048 and 8192, respectively.

   * Section 3 Paragraph 11 is updated as follows: In all cases, the size
   of the group SHOULD be at least 2048 bits.

---

From: Daniel Migault <[email-masked]>
Date: Sun, 11 Jun 2017 14:17:28 -0400

Hi,

I believe it would also be appreciated the text also details
interoperability with existing implementation using/proposing 1024 < k <
2048.

Yours,
Daniel

On Sat, Jun 10, 2017 at 3:50 PM, Daniel Migault <[email-masked]
> wrote: