Subject: Re: [Curdle] Diffie-Hellman modulus sizing in Kerberos PKINIT

From: Robbie Harwood <[email-masked]>
Date: Mon, 02 Aug 2021 13:13:37 -0400

"Mark Baushke (ietf)" <[email-masked]> writes:

> Hi Robbie,
>
> I made a few mistakes in my last message.

No worries.  To be sure I understand, though, please let me know if this
matches what you're suggesting:

    - 1k: MUST NOT (matches the draft)
    - 2k: SHOULD NOT (strengthen the draft's MAY)
    - 4k: MUST (matches the draft)
    - 6k/8k: MAY (not present in draft)

I'm probably fine to add larger groups like the 6k and 8k you suggest at
MAY.  If I read right, Heimdal implements MODP 6k and 8k already.

For completeness: Heimdal also implements 3072-, 1636-, and 768-bit
MODP.  It seems worth taking a position on those groups as well.  I
imagine that position would be imagine would be:

    - 3072: MAY
    - 1636: SHOULD NOT
    - 768: MUST NOT

(though it may be cleaner to adjust the language to address sizes rather
than specific groups at that point).

Be well,
--Robbie

---

From: mbaushke ietf <[email-masked]>
Date: Mon, 2 Aug 2021 15:09:04 -0500

Hi Robbie,

A 3k group is 128 bit of security strength and I have no issues selecting such to be either SHOULD or MAY.

For example, the 3072-bit MODP group 15 is reasonable for use with 128 bit symmetric ciphers such as aes128-{ctr,gcm} or chch20-poly1305.

For the rest, yes, I agree.

        Enjoy!
        -- Mark

[Sent from my iPhone -- Please pardon
any auto-fix created typos.]

> On Aug 2, 2021, at 12:14 PM, Robbie Harwood <[email-masked]> wrote:
>

---

From: Robbie Harwood <[email-masked]>
Date: Fri, 06 Aug 2021 14:23:26 -0400

I have uploaded a -02 that hopefully provides the changes you were
looking for.

I was mistaken earlier about what Heimdal supports: while they test
their DH implementation with many other groups, the built-in support is
limited to 1k and 2k groups.  So I've elected to make minimum size
guidance rather than standardizing the intermediate groups, and limit
the additions to 6k and 8k.

Be well,
--Robbie

---

From: "Mark Baushke (ietf)" <[email-masked]>
Date: Fri, 6 Aug 2021 13:50:26 -0700

Hi Robbie,

> On Aug 6, 2021, at 11:23 AM, Robbie Harwood <[email-masked]> wrote:
> 

I think you meant to type -01 as 

   https://datatracker.ietf.org/doc/draft-harwood-krb-pkinit-dh-upsize/01/ <https://datatracker.ietf.org/doc/draft-harwood-krb-pkinit-dh-upsize/01/>

aka

   https://www.ietf.org/archive/id/draft-harwood-krb-pkinit-dh-upsize-01.txt <https://www.ietf.org/archive/id/draft-harwood-krb-pkinit-dh-upsize-01.txt>

is the latest version of the draft.

> the additions to 6k and 8k.

This seems reasonable to me.

I have reviewed draft-harwood-krb-pkinit-dh-upsize-01.txt <https://www.ietf.org/archive/id/draft-harwood-krb-pkinit-dh-upsize-01.txt> and it looks good to me.

> --Robbie

        Be safe, stay healthy,
        -- Mark