Subject: Re: Transport I-D: KEXINIT reserved field needs description

From: [email-masked] (Peter Gutmann)
Date: Tue, 22 Jul 2003 22:29:37 +1200

Bill Sommerfeld <[email-masked]> writes:

>>>OpenSSH will accept non-zero values for the reserved uint32 value, but will
>>>not allow more data after this field.
>>
>>Same for cryptlib.
>
>What's the detailed behavior?  suddenly drop the connection?  drop the
>connection after sending an error packet?

Send a handshake-failed indication and drop the connection.

Peter.

---

From: [email-masked] (Peter Gutmann)
Date: Wed, 23 Jul 2003 16:20:12 +1200

"Paul Swartz" <[email-masked]> writes:
>On 22 Jul 2003 at 15:44, Nicolas Williams wrote:
>>For those whose implementations ignore additional data past the reserved
>>field, is that data included in the key exchange hash?
>
>Yes, Conch includes the entire packet, regardless of how much of the packet
>it parses.

Same with cryptlib (or at least it would if it didn't reject the packet for
having undefined extra data after the reserved field - if an extension
mechanism is defined in the future, it's a one-line change to accomodate it by
not rejecting the packet).

Speaking of extensions, it would be useful when/if these are defined to have a
per-extension flag indicating that an inability to process the extension
should be treated as a fatal error vs. simply ignoring the extension, which I
assume would be the default action.

Peter.