Subject: Re: [Curdle] Roman Danyliw's No Objection on draft-ietf-curdle-gss-keyex-sha2-09: (with COMMENT)

From: Simo Sorce <[email-masked]>
Date: Mon, 01 Jul 2019 13:02:57 -0400

On Mon, 2019-06-24 at 07:38 -0700, Roman Danyliw via Datatracker wrote:
> ** Section 5.1.  The various variable (e.g., V_C, V_S) are introduced early in
> the algorithm to construct H and the messages in page 6, but they aren’t
> described until the end of page 7.  I wasn’t following the narrative until I
> hit that section.

On Mon, 2019-06-24 at 20:41 -0700, Adam Roach via Datatracker wrote:
> §5.1: 
> >  To verify the integrity of the handshake, peers use the Hash Function
> >  defined by the selected Key Exchange method to calculate H:
> > 
> >  H = hash(V_C || V_S || I_C || I_S || K_S || Q_C || Q_S || K).
> 
> Please indicate that these variables and the "||" operator will be described
> later in this section.

You both indicate these are described in later section, and although we
do, we have a reference right at the start of 5.1:
   "This section reuses much of the scheme defined in section 2.1 of
   RFC4462"
that reference contains explicit definitions of the symbols used and
the preamble to that referenced section also points to "Section 8 of
[SSH-TRANSPORT]" which also `have definitions.

That reference is required pre-requisite to understand 5.1 fully so I
think we have enough in place, however if you think I should move the
later section 7 text up in to this already overlong paragraph I will.

Simo.

-- 
Simo Sorce
RHEL Crypto Team
Red Hat, Inc

---

From: Simo Sorce <[email-masked]>
Date: Mon, 01 Jul 2019 13:30:49 -0400

On Mon, 2019-06-24 at 07:38 -0700, Roman Danyliw via Datatracker wrote:
> ** Section 5.1, Per “The exchange hash SHOULD be kept secret”, when should it
> not be (i.e., why isn’t this a MUST?)?

This is the same text that appears in both 4253 and 4462, it is a
SHOULD because revealing the exchange hash may help an attacker to gain
some information about the exchange but it is not in itself a problem
if it happens.

Simo.

-- 
Simo Sorce
RHEL Crypto Team
Red Hat, Inc