Subject: draft-harris-ssh-rsa-kex-03

From: Ben Harris <[email-masked]>
Date: Sat, 16 Jul 2005 17:26:49 +0100 (BST)

Yet another RSA KEX draft has made it into the repository.  I hope this 
represents the final version of the protocol (apart from moving its name 
into the IETF namespace if it becomes an RFC), though probably not of the 
document.  This version:

1: goes back to using SHA-256 with 2048-bit RSA keys, since SHA-512 is
    ludicrously slow.

2: has the server send its host key to the client in SSH_MSG_KEXRSA_PUBKEY
    rather than in SSH_MSG_KEXRSA_DONE.  This prevents the server
    manipulating the exchange hash input by changing its public key.

I hope you like it.

<http://www.ietf.org/internet-drafts/draft-harris-ssh-rsa-kex-03.txt>

-- 
Ben Harris

---

From: Ben Harris <[email-masked]>
Date: Tue, 19 Jul 2005 21:27:47 +0100

In article <[email-masked]> you write:
>represents the final version of the protocol

Of course, saying that was a good way to expose silly mistakes like, for
instance, having SSH_MSG_RSAKEX_PUBKEY containing K_T||K_S and the exchange
hash including K_S||K_T.  This isn't a security hole, but it's going to
confuse implementors, so there'll be a -04 in August that changes the order
of SSH_MSG_RSAKEX_PUBKEY.  Sorry about that.

-- 
Ben Harris

 (apart from moving its name