Subject: [Curdle] I-D Action: draft-ietf-curdle-ssh-ext-info-09.txt

From: [email-masked]
Date: Mon, 12 Jun 2017 21:25:54 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the CURves, Deprecating and a Little more Encryption of the IETF.

        Title           : Extension Negotiation in Secure Shell (SSH)
        Author          : Denis Bider
	Filename        : draft-ietf-curdle-ssh-ext-info-09.txt
	Pages           : 11
	Date            : 2017-06-12

Abstract:
  This memo updates RFC 4252, RFC 4253, and RFC 4254 to define a
  mechanism for SSH clients and servers to exchange information about
  supported protocol extensions confidentially after SSH key exchange.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-curdle-ssh-ext-info/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-curdle-ssh-ext-info-09
https://datatracker.ietf.org/doc/html/draft-ietf-curdle-ssh-ext-info-09

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-curdle-ssh-ext-info-09

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: denis bider <[email-masked]>
Date: Mon, 12 Jun 2017 22:38:03 -0600

Hello everyone,

it has come to my attention that a widely used SSH implementation that
supports EXT_INFO contains an oversight (uses an incorrect string decoding
function) which imposes undesirable restrictions on the content of
"extension-value".

Regretfully, this oversight makes it so that the "delay-compression"
extension cannot be sent to current versions of this application. The
application does not understand the extension, but will choke on the null
bytes contained in the extension-value.

I trust that this was unintentional, and that the implementers will fix the
oversight.

This behavior was previously already against the spec, but the language
that dictated this was subtle and in a different section than the
definition of "extension-value". I have made the language much more overt
to help implementers avoid this problem in the future.

denis

On Mon, Jun 12, 2017 at 10:25 PM, <[email-masked]> wrote:

> _______________________________________________
> Curdle mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/curdle
>