Subject: [Curdle] call for adoption for draft-mu-curdle-ssh-xmss-00

From: Daniel Migault <[email-masked]>
Date: Wed, 20 Nov 2019 22:38:13 +0800

Hi,

This mail starts a call for adoption for draft-mu-curdle-ssh-xmss-00 XMSS
public key algorithms for the Secure Shell (SSH) protocol. Please state on
the mailing list whether you support the adoption of the draft or if you
have any objection by December 5.

Yours,
Rich and Daniel

[1] https://datatracker.ietf.org/doc/draft-mu-curdle-ssh-xmss/

---

From: denis bider <[email-masked]>
Date: Wed, 20 Nov 2019 11:33:21 -0600

I support the adoption of this draft. I think it's a great initiative.

I welcome the implementation work already done by OpenSSH and look forward
to successful standardization.

On Wed, Nov 20, 2019 at 8:38 AM Daniel Migault <daniel.migault=
[email-masked]> wrote:

> _______________________________________________
> Curdle mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/curdle
>

---

From: "Panos Kampanakis (pkampana)" <[email-masked]>
Date: Wed, 20 Nov 2019 17:46:58 +0000

I support the adoption of this draft.

I would like to see the addition of LMS along with XMSS in it. It is trivial to add both stateful HBS schemes in the draft.

I recommend more explicit and clear language in the Security Considerations regarding state management (HSMs, other techniques [1]). And an informative reference to NIST’s upcoming SP on Stateful HBS and [2]. Implementers need to be very careful with managing state of these signatures and the draft needs to make it clear. Also the security considerations need to make clear that SSH makes a good use-case for these signatures because SSH tunnels are usually not established in a “quick and short” fashion which would make stateful HBS even more risky because of the state management requirement.

Rgs,
Panos

[1]: https://eprint.iacr.org/2016/357.pdf
[2] https://csrc.nist.gov/Projects/Stateful-Hash-Based-Signatures

From: Curdle <[email-masked]> On Behalf Of Daniel Migault
Sent: Wednesday, November 20, 2019 9:38 AM
To: curdle <[email-masked]>
Subject: [Curdle] call for adoption for draft-mu-curdle-ssh-xmss-00

Hi,

This mail starts a call for adoption for draft-mu-curdle-ssh-xmss-00 XMSS public key algorithms for the Secure Shell (SSH) protocol. Please state on the mailing list whether you support the adoption of the draft or if you have any objection by December 5.

Yours,
Rich and Daniel

---

From: denis bider <[email-masked]>
Date: Wed, 20 Nov 2019 12:18:02 -0600

SSH sessions are frequently established in a quick and short manner. Common
examples:
- Git over SSH will establish a separate SSH session for each remote Git
command.
- There exist file transfer clients (part of business applications and/or
scripts) that will initiate a separate SSH session for each file they
transfer via SFTP.
- There exist file transfer applications that will e.g. connect every 5-15
minutes to check for new files.

SSH is rife with short, ad-hoc sessions in practical usage; as well as long
sessions that can last many days.

On Wed, Nov 20, 2019 at 11:47 AM Panos Kampanakis (pkampana) <
[email-masked]> wrote:

> I would like to see the addition of LMS along with XMSS in it. It is
> trivial to add both stateful HBS schemes in the draft.
>
>
>
> I recommend more explicit and clear language in the Security
> Considerations regarding state management (HSMs, other techniques [1]). And
> an informative reference to NIST’s upcoming SP on Stateful HBS and [2].
> Implementers need to be very careful with managing state of these
> signatures and the draft needs to make it clear. Also the security
> considerations need to make clear that SSH makes a good use-case for these
> signatures because SSH tunnels are usually not established in a “quick and
> short” fashion which would make stateful HBS even more risky because of the
> state management requirement.
>
>
>
> Rgs,
>
> Panos
>
>
>
> *From:* Curdle <[email-masked]> *On Behalf Of *Daniel Migault
> *Sent:* Wednesday, November 20, 2019 9:38 AM
> *To:* curdle <[email-masked]>
> *Subject:* [Curdle] call for adoption for draft-mu-curdle-ssh-xmss-00
>
>
>
> Hi,
>
>
>

---

From: "Panos Kampanakis (pkampana)" <[email-masked]>
Date: Wed, 20 Nov 2019 21:37:20 +0000

Good points Denis. I hadn’t thought of these usecases.
These can increase the state management risk. We may be opening a can of worms by plainly adding Stateful HBS in SSH.

From: denis bider <[email-masked]>
Sent: Wednesday, November 20, 2019 1:18 PM
To: Panos Kampanakis (pkampana) <[email-masked]>
Cc: Daniel Migault <daniel.migault=[email-masked]>; curdle <[email-masked]>
Subject: Re: [Curdle] call for adoption for draft-mu-curdle-ssh-xmss-00

SSH sessions are frequently established in a quick and short manner. Common examples:
- Git over SSH will establish a separate SSH session for each remote Git command.
- There exist file transfer clients (part of business applications and/or scripts) that will initiate a separate SSH session for each file they transfer via SFTP.
- There exist file transfer applications that will e.g. connect every 5-15 minutes to check for new files.

SSH is rife with short, ad-hoc sessions in practical usage; as well as long sessions that can last many days.

On Wed, Nov 20, 2019 at 11:47 AM Panos Kampanakis (pkampana) <[email-masked]<mailto:[email-masked]>> wrote:
I support the adoption of this draft.

Rgs,
Panos

From: Curdle <[email-masked]<mailto:[email-masked]>> On Behalf Of Daniel Migault
Sent: Wednesday, November 20, 2019 9:38 AM
To: curdle <[email-masked]<mailto:[email-masked]>>
Subject: [Curdle] call for adoption for draft-mu-curdle-ssh-xmss-00

Hi,

Yours,
Rich and Daniel

_______________________________________________
Curdle mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/curdle

---

From: "Salz, Rich" <[email-masked]>
Date: Thu, 21 Nov 2019 21:38:52 +0000

Speaking as an individual, I am opposed to adoption of this draft.

The IETF has pretty much decided to wait until the NIST post-quantum crypto process is finished.

  *   SSH is rife with short, ad-hoc sessions in practical usage; as well as long sessions that can last many days.

Yes, and  for this reason, and because NIST explicit said that this will be part of the PQ process, adoption is premature. The NIST link mentioned (https://csrc.nist.gov/Projects/Stateful-Hash-Based-Signatures) explicitly talks about the problems and concerns of managing the state.

                /r$

---

From: Daniel Migault <[email-masked]>
Date: Fri, 29 Nov 2019 17:27:45 -0500

Hi,

As suggested by Stephen, we are adding the ietf-ssh mailing list to get
more feed backs regarding the adoption of draft-mu-curdle-ssh-xmss-00 "XMSS
public key algorithms for the Secure Shell (SSH) protocol". If you have any
opinion, please provide your feed back. The end of the adoption call is
December 5.

Yours,
Rich and Daniel

---------- Forwarded message ---------
From: Daniel Migault <[email-masked]>
Date: Wed, Nov 20, 2019 at 9:38 AM
Subject: call for adoption for draft-mu-curdle-ssh-xmss-00
To: curdle <[email-masked]>

Hi,

Yours,
Rich and Daniel