Subject: Re: Fwd: Support for ECDSA and SHA-2 (SHA-256) in the SSHFP record

From: Damien Miller <[email-masked]>
Date: Mon, 5 Sep 2011 11:16:05 +1000 (EST)

Did anyone on this list have any comment on 
https://tools.ietf.org/html/draft-os-ietf-sshfp-ecdsa-sha2

It seemed pretty reasonable to me, and I'd like to move ahead implementing
it in OpenSSH particularly for the ECDSA support.

-d

On Sat, 30 Jul 2011, Ond?ej Sur? wrote:

> > On 30. 7. 2011, at 14:21, Damien Miller wrote:
> > 
> >> Thanks for starting work on this - SSHFP records for ECDSA keys were on
> >> my TODO list, but I haven't yet got around to them.
> > 
> >> I briefly skimmed your draft - one question I have is whether it is
> >> better to roll up all the ECDSA key types under one SSHFP RR type.
> >> It would be quite ugly to have to allocate SSHFP RR type numbers for
> >> each possible ECDSA curve type, but using a single one might make
> >> exploitation of SHA256 preimage attacks easier.
> > 
> > My knowledge of cryptography is not so strong, so that's probably good question for security area advisory group as well.
> > 
> >> The latter is a theoretical concern, so I think a single RR type is
> >> probably correct.
> > 
> > I'll be happy to accept any changes to the draft.  I already had the different ECDSA curves in the draft, but it was suggested by my fellow AD that one is probably enough.
> > 
> >> It would probably be best to continue discussion of this on the IETF SSH
> >> list.
> > 
> > I thought that secsh was concluded, but it seems that the mailing list is still up.  Ccing there as well.
> > 
> > Anyone who responds please get rid of openssh-unix-dev list when replying, so we don't spam them with ietf flames :)
> > 
> > O.
> > 
> >> On Thu, 28 Jul 2011, Ond?ej Sur? wrote:
> >> 
> >>> Hi,
> >>> 
> >>> I was sure I sent this to [email-masked], but cannot find that email now in my Sent mailbox, so I am sending it to the developers list.
> >>> 
> >>> I took a liberty and wrote an I-D with accompanying patch (with contributions from Ondrej Caletka) to support ECDSA in the SSHFP DNS resource record.
> >>> 
> >>> The I-D is here: https://tools.ietf.org/html/draft-os-ietf-sshfp-ecdsa-sha2 (and the source XML here: https://git.nic.cz/redmine/projects/ietf/repository/revisions/master/changes/draft-os-ietf-sshfp-ecdsa-sha2-00.xml)
> >>> 
> >>> The patch to vanilla 5.8 here: https://git.nic.cz/redmine/projects/ietf/repository/revisions/master/changes/ssh-sshfp-ecdsa.patch
> >>> 
> >>> Please Cc: me as I am not (and don't intend to be) subscribed to the list.  I will check the archives occasionally, but Cc: would be appreciated.
> >>> 
> >>> Thanks,
> >>> O.
> >>> --
> >>> Ond?ej Sur?
> >>> vedouc? v?zkumu/Head of R&D department
> >>> -------------------------------------------
> >>> CZ.NIC, z.s.p.o.    --    Laborato?e CZ.NIC
> >>> Americka 23, 120 00 Praha 2, Czech Republic
> >>> mailto:[email-masked]    http://nic.cz/
> >>> tel:+420.222745110       fax:+420.222745112
> >>> -------------------------------------------
> >>> 
> >>> _______________________________________________
> >>> openssh-unix-dev mailing list
> >>> [email-masked]
> >>> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
> >>> 
> > 
> > --
> > Ond?ej Sur?
> > vedouc? v?zkumu/Head of R&D department
> > -------------------------------------------
> > CZ.NIC, z.s.p.o.    --    Laborato?e CZ.NIC
> > Americka 23, 120 00 Praha 2, Czech Republic
> > mailto:[email-masked]    http://nic.cz/
> > tel:+420.222745110       fax:+420.222745112
> > -------------------------------------------
> > 
> 
> --
>  Ond?ej Sur?
>  vedouc? v?zkumu/Head of R&D department
>  -------------------------------------------
>  CZ.NIC, z.s.p.o.    --    Laborato?e CZ.NIC
>  Americka 23, 120 00 Praha 2, Czech Republic
>  mailto:[email-masked]    http://nic.cz/
>  tel:+420.222745110       fax:+420.222745112
>  -------------------------------------------
> 
>

---

From: Ondřej Surý <[email-masked]>
Date: Mon, 5 Sep 2011 08:10:53 +0200

Hi Damien,

the implementation for OpenSSH is already done and working (see the link to git
named patch for vanilla 5.8 below in the first mail).

Ondrej

--
 Ondřej Surý
 vedoucí výzkumu/Head of R&D department
 -------------------------------------------
 CZ.NIC, z.s.p.o.    --    Laboratoře CZ.NIC
 Americka 23, 120 00 Praha 2, Czech Republic
 mailto:[email-masked]    http://nic.cz/
 tel:+420.222745110       fax:+420.222745112
 -------------------------------------------

---

From: Damien Miller <[email-masked]>
Date: Mon, 5 Sep 2011 16:13:05 +1000 (EST)

On Mon, 5 Sep 2011, Ond?ej Sur? wrote:

> Hi Damien,
> 
> the implementation for OpenSSH is already done and working (see the
> link to git named patch for vanilla 5.8 below in the first mail).

sure, I noticed that in the original mail but I don't want to go ahead
and merge it if other implementers have objections to the I-D.

-d

---

From: Ben Laurie <[email-masked]>
Date: Mon, 5 Sep 2011 11:02:35 +0100

> https://tools.ietf.org/html/draft-os-ietf-sshfp-ecdsa-sha2

Makes sense to me _except_ it refers to RFC 4255 for the format of the
resource record, and implicitly for the calculation of the
fingerprint. RFC 4255 refers to RFC 4253 for the fingerprint
calculation. However, 4253 doesn't mention fingerprints at all. Or I'm
missing something.

Anyway, bottom line is I don't know how to calculate the fingerprint :-)

---

From: Ondřej Surý <[email-masked]>
Date: Mon, 5 Sep 2011 12:11:56 +0200

Hi Ben,

> calculation. However, 4253 doesn't mention fingerprints at all. Or I'm

I think that 4255 refers to 4253 for "public key blob" and not calculating
the fingerprint.

> Anyway, bottom line is I don't know how to calculate the fingerprint :-)

Looks like the RFC4255 #3.1.3 could be more clearer than:

   The message-digest algorithm is presumed to produce an opaque octet
   string output, which is placed as-is in the RDATA fingerprint field.

But the question is - is it worth updating in this particular I-D?  Isn't
this more an errata for RFC4255 type of update?

I don't mind adding a paragraph or two about the calculation of the fingerprint,
but it seems to be awfully close to our legislation process when you can update
non-related law as an attachment to an different law.  And this scares me.

Ccing Jakob as an author of RFC4255.

O.

---

From: Ben Laurie <[email-masked]>
Date: Mon, 5 Sep 2011 12:12:43 +0100

> I think that 4255 refers to 4253 for "public key blob" and not calculating

Well, OK, but "public key blob" does not appear in 4253 either. And
even if it did, it would not be completely obvious how to calculate
the fingerprint from it (presumably just feed the bytes to the hash
algorithm, but...)

> this more an errata for RFC4255 type of update?

Yes.

---

From: Ondřej Surý <[email-masked]>
Date: Mon, 5 Sep 2011 13:21:09 +0200

>> this more an errata for RFC4255 type of update?

Yes what? :)

Yes to update it in ECDSA I-D?

or

Yes to do an errata / bis of RFC4255?

O.

---

From: Ben Laurie <[email-masked]>
Date: Mon, 5 Sep 2011 12:25:42 +0100

> Yes to do an errata / bis of RFC4255?

The latter.