Subject: [Curdle] Quantum Resistant SSH connections

From: Hubert Kario <[email-masked]>
Date: Thu, 01 Oct 2020 16:50:29 +0200

Hi everybody,

As it's fairly easy, and common, to configure Kerberos infrastructure to be
resistant against quantum computers, I'd like to submit a new key exchange
for SSH that leverages that quantum resistance to make quantum resistant 
SSH
connections.

While we have gssapi key exchange methods already defined, they all use 
FFDH
or ECDH to derive the shared secret and use gssapi/Kerberos just to
authenticate the other side, not for encrypt the transmitted keying 
material.

This new key exchange uses gssapi to transmit keying material
and thus builds on quantum resistance of protocols like Kerberos.

Please check:
https://tools.ietf.org/html/draft-kario-gss-qr-kex-00
https://datatracker.ietf.org/doc/draft-kario-gss-qr-kex/
-- 
Regards,
Hubert Kario
Senior Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 115, 612 00  Brno, Czech Republic

---

From: "Mark D. Baushke" <[email-masked]>
Date: Thu, 1 Oct 2020 09:06:57 -0700

Hi Hubert,

Hubert Kario <[email-masked]> writes:

> Hi everybody,
> 
> As it's fairly easy, and common, to configure Kerberos infrastructure
> to be resistant against quantum computers, I'd like to submit a new
> key exchange for SSH that leverages that quantum resistance to make
> quantum resistant SSH connections.
> 

Thank you for the pointers.

Related to Quantum-Resistant and Quantum-Safe algorithms, you may find
these pointers useful as well:

There is a github project under an MIT licesnse:

    https://github.com/open-quantum-safe/liboqs

which provides for various Quantum-Safe cryptographic algorithms.

There is also a paper published last year:

    Prototyping post-quantum and hybrid key exchange and authentication in
    TLS and SSH
    by Eric Crockett and Christian Paquin and Douglas Stebila
    URL: https://eprint.iacr.org/2019/858

which may be of interest as a hybrid mechanism may be more acceptable as
a transition to PQ than a direct move for some implementers.

	Be safe, stay healthy,
	-- Mark

---

From: Hubert Kario <[email-masked]>
Date: Thu, 01 Oct 2020 18:25:42 +0200

On Thursday, 1 October 2020 18:06:57 CEST, Mark D. Baushke wrote:
>> quantum resistant SSH connections. ...
>

Yes, I'm aware of those projects and this research.

The reason why I went with stright-up kerberos is becasue:
1. There is no single quantum safe algorithm widely agreed as the best
2. It may be good few years before we will get one
3. It may require few more years still before those algorithms become 
acceptable
   to national or international standard bodies (FIPS, PCI-DSS, Common
   Criteria, etc.)
4. Backporting completely new cryptographic algorithms to existing 
deployments
   is usually hard, if not impossible. Not to mention it may take years 
before
   we have something that's secure against side-channel attacks in 
practice.

This I-D proposes a mechanism that doesn't use any new cryptography and
requires minimal changes to a SSH implementation (and uses just two new 
methods
from GSSAPI). Which should make it very easy to add in new deployments and
isn't very hard to backport to old deployments.

In other words, I don't consider it a replacement for proper quantum-safe
kex, but a stepping stone that will tide us over until quantum-safe 
algorithms
are widely deployed.
-- 
Regards,
Hubert Kario
Senior Quality Engineer, QE BaseOS Security team
Web: www.cz.redhat.com
Red Hat Czech s.r.o., Purkyňova 115, 612 00  Brno, Czech Republic