Subject: Re: Updated RSA SHA-2 draft / New draft: SSH Extension Negotiation

From: denis bider <[email-masked]>
Date: Fri, 13 Nov 2015 15:24:18 +0000

I think it's appropriate as an explicit clarification of the behavior the RFC intended, and which most implementations implement (but some don't).

I don't think It's too late because errant implementations can correct this, and in time new versions of these implementations will be used.

Don't think in 2-3 years time, think in 10 years time. Internet protocols tend to hang around for a while. SMTP has been around for 33 years...

Jeffrey Hutzelman <[email-masked]> , 11/13/2015 3:12 PM:
On November 13, 2015 9:39:23 AM EST, denis bider <[email-masked]> wrote: 
>Much agreed. 
> 
>If the IETF will accept an erratum with a clarification, here's a 
>proposed wording: 
> 
> 
>"Servers and clients may or may not be aware of a future extension to 
>this RFC that specifies a use for the KEXINIT reserved field. 
> 
>Servers and clients that are NOT aware of such an extension: 
>- MUST send the reserved field with the value zero (indicating 
>unawareness); 
>- MUST NOT act on any value of this field when received, whether zero 
>or non-zero; 
>- in key exchange, MUST properly hash the actual received value of this 
>field. 
> 
>This behavior is REQUIRED to allow use of this field in future protocol 
>extension." 
 
It certainly was a mistake not to specify this to begin with.  However, this represents a change to the protocol, not correction of a technical inaccuracy in the document.  Nor is it a change to reflect common, consistent actual practice which differs from the specified protocol.  So, I don't think it's appropriate for an erratum.  Further, it's too late: this behavior is only useful if older implementations follow it; you can't add extensibility after the fact. 
 
-- Jeff

---

From: denis bider <[email-masked]>
Date: Fri, 13 Nov 2015 15:04:28 +0000

I have submitted this erratum. We will see how it's received.

denis bider <[email-masked]> , 11/13/2015 2:28 PM:
Much agreed.

If the IETF will accept an erratum with a clarification, here's a proposed wording:

"Servers and clients may or may not be aware of a future extension to this RFC that specifies a use for the KEXINIT reserved field.

Servers and clients that are NOT aware of such an extension:
- MUST send the reserved field with the value zero (indicating unawareness);
- MUST NOT act on any value of this field when received, whether zero or non-zero;
- in key exchange, MUST properly hash the actual received value of this field.

This behavior is REQUIRED to allow use of this field in future protocol extension."

----- Original Message -----
From: Niels "Möller" 
Sent: Friday, November 13, 2015 02:37
To: Peter Gutmann 
Cc: denis bider ; [email-masked] ; Jeffrey Hutzelman ; Mark D. Baushke ; [email-masked] ; [email-masked] ; [email-masked] ; Max Horn 
Subject: Re: Updated RSA SHA-2 draft / New draft: SSH Extension Negotiation

Peter Gutmann <[email-masked]> writes:

> Niels Möller <[email-masked]> writes:
>
>>Send 0, ignore received value, would have made it actually useful.
>
> Can we get any figures on what effect making it nonzero would have?

I think my implementation will disconnect.

Anyway, if we do a general smallish update, it would make sense to fix
this (not sure in which form, note in the algorithms update rfc, or an
errate on hte old rfc). And simply say that until any of the future
extensions are specified, implementations should accept and ignore
non-zero values for this field.

That will make our lives a little easier a few years from now.

Regards,
/Niels

-- 
Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26.
Internet email is subject to wholesale government surveillance.

---

From: [email-masked] (Niels Möller)
Date: Fri, 13 Nov 2015 19:13:04 +0100

Jeffrey Hutzelman <[email-masked]> writes:

> So, I don't think it's appropriate for an erratum.

What's the correct process, then?

> Further, it's too late: this behavior is only useful if older
> implementations follow it; you can't add extensibility after the fact.

I'd expect a correction published now will get widely implemented within
a decade. So I think it's a useful thing to do.

Regards,
/Niels

---

From: denis bider <[email-masked]>
Date: Fri, 13 Nov 2015 14:39:23 +0000

Much agreed.

----- Original Message -----
From: Niels "Möller" 
Sent: Friday, November 13, 2015 02:37
To: Peter Gutmann 
Cc: denis bider ; [email-masked] ; Jeffrey Hutzelman ; Mark D. Baushke ; [email-masked] ; [email-masked] ; [email-masked] ; Max Horn 
Subject: Re: Updated RSA SHA-2 draft / New draft: SSH Extension Negotiation

Regards,
/Niels