Subject: Re: [Curdle] Second AD Review: draft-ietf-curdle-ssh-curves.

From: Benjamin Kaduk <[email-masked]>
Date: Tue, 30 Jul 2019 16:47:02 -0500

I took over as responsible AD for this draft from Eric, but I don't
see any response to this second round of review comments.  Luckily there's
mot much left, so hopefully we can get a new rev out quickly and move the
document forward.

Thanks,

Ben

On Mon, Dec 24, 2018 at 02:16:24PM -0800, Eric Rescorla wrote:
> Thanks for addressing my comments.
> 
> IMPORTANT
> S 3.
> >      received public keys are not the expected lengths, or if the derived
> >      shared secret only consists of zero bits.  No further validation is
> >      required beyond what is discussed in [RFC7748].  The derived shared
> >      secret is 32 bytes when Curve25519 is used and 56 bytes when Curve448
> >      is used.  The encodings of all values are defined in [RFC7748].  The
> >      hash used is SHA-256 for Curve25519 and SHA-512 for Curve448.
> 
> This is true if you use the 7748 algorithm, but not necessarily
> otherwise.
> 
> Here is some OK language (from tcpcrypt)
> 
>  Key-agreement schemes ECDHE-Curve25519 and ECDHE-Curve448 perform the
>    Diffie-Helman protocol using the functions X25519 and X448,
>    respectively.  Implementations SHOULD compute these functions using
>    the algorithms described in [RFC7748].  When they do so,
>    implementations MUST check whether the computed Diffie-Hellman
> shared
>    secret is the all-zero value and abort if so, as described in
>    Section 6 of [RFC7748].  Alternative implementations of these
>    functions SHOULD abort when either input forces the shared secret
> to
>    one of a small set of values, as discussed in Section 7 of
> [RFC7748].
> COMMENTS
> S 1.
> >      key exchange protocol described in [RFC4253] supports an extensible
> >      set of methods.  [RFC5656] describes how elliptic curves are
> >      integrated in SSH, and this document reuses those protocol messages.
> >
> >      This document describes how to implement key exchange based on
> >      Curve25519 and Ed448-Goldilocks [RFC7748] in SSH.  For Curve25519
> 
> 7748 calls this Curve448 and you do so later, so please be consistent.

---

From: "Mark D. Baushke" <[email-masked]>
Date: Tue, 30 Jul 2019 15:23:22 -0700

> mot much left, so hopefully we can get a new rev out quickly and move the

I do owe the AD a response to the comments and a new draft.
I regret that other commitments have prevented me from this.

	-- Mark

> > >      received public keys are not the expected lengths, or if the
> > >      derived shared secret only consists of zero bits. No further
> > >      validation is required beyond what is discussed in [RFC7748].
> > >      The derived shared secret is 32 bytes when Curve25519 is used
> > >      and 56 bytes when Curve448 is used. The encodings of all
> > >      values are defined in [RFC7748]. The hash used is SHA-256 for
> > >      Curve25519 and SHA-512 for Curve448.
> > 
> >    Key-agreement schemes ECDHE-Curve25519 and ECDHE-Curve448 perform
> >    the Diffie-Helman protocol using the functions X25519 and X448,
> >    respectively. Implementations SHOULD compute these functions
> >    using the algorithms described in [RFC7748]. When they do so,
> >    shared secret is the all-zero value and abort if so, as described
> >    in Section 6 of [RFC7748]. Alternative implementations of these
> >    to one of a small set of values, as discussed in Section 7 of
> >    [RFC7748].
> >
> > COMMENTS
> > S 1.

	-- Mark

---

From: Benjamin Kaduk <[email-masked]>
Date: Tue, 30 Jul 2019 18:13:22 -0500

> I regret that other commitments have prevented me from this.

I completely understand; my main goal is to ensure that *I* was not the one
holding things up, as there are quite a few things for which that is the
case at the moment.

(BTW, if anyone feels there is some urgency to getting these documents
published, the chairs can appoint a new document editor to handle the
mechanical text juggling and document submission.  That might be less
feasible for the other document, though, given the volume of comments Eric
made.)

-Ben

---

From: Daniel Migault <[email-masked]>
Date: Tue, 30 Jul 2019 19:49:44 -0400

I believe the easiest way to do is to let Mark update the draft when time
permits. Thanks you Ben and Mark for moving these documents forward.
Yours,
Daniel

On Tue, Jul 30, 2019 at 7:13 PM Benjamin Kaduk <[email-masked]> wrote:

> _______________________________________________
> Curdle mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/curdle
>