Subject: Re: Fwd: Re: [saag] Fwd: Last Call: <draft-moonesamy-sshfp-ed25519-01.txt> (Using ED25519 in SSHFP Resource Records) to Informational RFC

From: S Moonesamy <[email-masked]>
Date: Fri, 02 May 2014 10:44:15 -0700

Hi Rene,
At 09:05 01-05-2014, Rene Struik wrote:
>I had a brief look at the draft document
>draft-moonesamy-sshfp-ed25519-01. Please find my comments below:

Thanks for the review.  I'll acknowledge you in the draft.

>Section 1 & 2:
>The paper [Ed25519] defines a set of signature algorithms, but also
>specifies a concrete instantiation Ed25519-SHA512 (see Section 2 of the
>paper). It is not clear whether the draft wants to use
>Ed25519-SHA512 or that scheme with another hash function. A disadvantage

I'll suggest the following text change to Section 1 to clarify what 
has been implemented:

   The Ed25519 [Ed25519] signature algorithm, specifically Ed25519-SHA-512,
   has been implemented in OpenSSH.

>of using Ed25519-SHA512 is that this may require implementation of both
>SHA-256 and SHA-512 (witness Section 2 of the internet draft). Would it

Yes.

>make sense to use, e.g., SHA-512/256 for fingerprinting instead of
>SHA-256 (or get rid of SHA-512, at the expense of having to tweak
>Ed25519 somewhat). Tweaking Ed25519 could be done as follows: for

Section 2 mentions a SHA-256 fingerprint as an example as the current 
implementation uses existing code for that.  The draft does not 
specify the fingerprint type to be used.  It may make sense to use 
SHA-512.  However, that would have to be done in a Standards Track 
RFC to cover the public key algorithms which have already been 
registered.  There are also some other changes which have been 
suggested during the discussions about this draft.

>ephemeral private keys one can simply use as hash function SHA-256
>(since the curve has very close to a power of two number of elements
>biases are close to zero, so Bleichenbacher-style attacks do not apply);
>instead of using SHA-512(k) use SHA-256(k,0) || SHA-256(k,1). The use of
>hash functions for generation of ephemeral and static private keys does
>not influence interoperability; only the choice of hash function for the
>Schnorr-style signing equation does, since affecting the signature
>component s.

I'll discuss the above with the people who wrote the code.

>Section 6.2:
>Please replace the informative reference [Ed25519]
><http://ed25519.cr.yp.to/ed25519-20110926.pdf> by the permanent reference
>[Ed25519] D. Bernstein, T. Lange, P. Schwabe, B-Y. Yang, High-Speed
>High-Security Signatures, J. of Cryptographic Engineering, Vol. 2,
>September 26, 2011.

There was a short discussion about the reference on the ietf-ssh 
mailing list.  I'll switch to the above with some minor edits.

Regards,
S. Moonesamy

---

From: S Moonesamy <[email-masked]>
Date: Fri, 02 May 2014 23:31:00 -0700

Hi Rene,
>Schnorr-style signing equation does, since affecting the signature

I am following up on the above.  I discussed the above with OpenSSH 
people.  The feature was introduced in January (see 
http://www.openssh.com/txt/release-6.5 ).  A significant 
consideration is that the proposed change will create an 
incompatibility with what has already been deployed [1][2].

Regards,
S. Moonesamy

1. https://launchpad.net/ubuntu/+source/openssh/1:6.5p1-1
2. 
http://docs.freebsd.org/cgi/getmsg.cgi?fetch=2522509+0+/usr/local/www/db/text/2014/svn-ports-all/20140209.svn-ports-all

---

From: Rene Struik <[email-masked]>
Date: Thu, 01 May 2014 12:04:19 -0400

Dear colleagues:

Section 1 & 2:

Section 6.2:

Best regards, Rene

On 5/1/2014 11:02 AM, Stephen Farrell wrote:
> FYI, this was discussed briefly here and has been
> discussed on the old secsh (ssh) WG mailing list.
>
> IETF LC has started.
>
> S
>
>
> -------- Original Message --------
> Subject: Last Call: <draft-moonesamy-sshfp-ed25519-01.txt> (Using
> ED25519 in SSHFP Resource Records) to Informational RFC
> Date: Thu, 01 May 2014 07:57:35 -0700
> From: The IESG <[email-masked]>
> Reply-To: [email-masked]
> To: IETF-Announce <[email-masked]>
>
>
> The IESG has received a request from an individual submitter to consider
> the following document:
> - 'Using ED25519 in SSHFP Resource Records'
>    <draft-moonesamy-sshfp-ed25519-01.txt> as Informational RFC
>
> The IESG plans to make a decision in the next few weeks, and solicits
> final comments on this action. Please send substantive comments to the
> [email-masked] mailing lists by 2014-05-29. Exceptionally, comments may be
> sent to [email-masked] instead. In either case, please retain the
> beginning of the Subject line to allow automated sorting.
>
> Abstract
>
>
>     The Ed25519 signature algorithm has been implemented in OpenSSH.
>     This document updates the IANA "SSHFP RR Types for public key
>     algorithms" registry by adding an algorithm number for Ed25519.
>
>
>
> The file can be obtained via
> http://datatracker.ietf.org/doc/draft-moonesamy-sshfp-ed25519/
>
> IESG discussion can be tracked via
> http://datatracker.ietf.org/doc/draft-moonesamy-sshfp-ed25519/ballot/
>
>
> No IPR declarations have been submitted directly on this I-D.
>
> Note that there is no current standardised format for the input
> to the hash function here, but there are two implementations
> of this so a codepoint is needed and useful. A standard public
> key format is likely to be developed in future (but could take
> some time) at which point it may make sense to assign another
> codepoint, but there are no issues with codepoint scarcity here
> so that seems like it will work given the implemeners seem ok
> with it, even if its not ideal.
>
>
>
>
>
>
> _______________________________________________
> saag mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/saag

-- 
email: [email-masked] | Skype: rstruik
cell: +1 (647) 867-5658 | US: +1 (415) 690-7363