Subject: Re: [Gen-art] review of draft-os-ietf-sshfp-ecdsa-sha2-04.txt

From: Francis Dupont <[email-masked]>
Date: Fri, 27 Jan 2012 13:18:47 +0100

In your previous mail you wrote:

>  > Minor issues: not a real issue but I am not convinced there is a real
>  > crypto reason to give up SHA-1. At the first view the attack against
>  > SSHFP is a pre-image one, but:
>  > - I leave the question to cryptographers of the security directorate
>  > - there are many not-crypto reasons to move from SHA-1 to SHA-256
>  
>  Hi,
>  
>  I have added some text there:
>  
>            ECDSA public key fingerprints MUST use the SHA-256 algorithm
>            for the fingerprint as using the SHA-1 algorithm would
>            weaken the security of the key, which itself can use only
>            SHA-2 family of algorithms RFC 5656 (Section 3.1.1).

=> I am afraid it is another not-crypto reason...

>  But I am also not a cryptographer,

=> I am not a cryptographer too (I just worked with cryptographers,
military cryptographers exactly, i.e., the worst kind of
cryptographers :-)

>  so it's just my guts telling me
>  that if a key is allowed to use only SHA-2, we should keep it in sync
>  here.

=> the 2 ideas are:
 - keep the requirement (i.e., it is the right one and even there could
  be no good crypto reasons)
 - get a wording for the justification which doesn't make cryptographers
  too unhappy (they won't be really happy anyway: this is a part of
  being cryptographers :-)

Of course for the second part the best should be to get a feedback
from the crypto (oops, the security) directorate.

Thanks

[email-masked]

---

From: Ondřej Surý <[email-masked]>
Date: Fri, 27 Jan 2012 09:23:16 +0100

On 15. 12. 2011, at 17:39, Francis Dupont wrote:

> I am the assigned Gen-ART reviewer for this draft. For background on 
> Gen-ART, please see the FAQ at 
> <http://wiki.tools.ietf.org/area/gen/trac/wiki/GenArtfaq>.
> 
> Please resolve these comments along with any other Last Call comments 
> you may receive.
> 
> Document: draft-os-ietf-sshfp-ecdsa-sha2-04.txt
> Reviewer: Francis Dupont
> Review Date: 20111210
> IETF LC End Date: 20120103
> IESG Telechat date: unknown
> 
> Summary: Ready
> 
> Major issues: None
> 

Hi,

But I am also not a cryptographer, so it's just my guts telling me
that if a key is allowed to use only SHA-2, we should keep it in sync
here.

> - IMHO the 'OpenSSH' format is just the PEM format

I have added a reference to RFC 4716 there.

> - 3.2.1 page 4: this is the MUST I am not convinced by the justification
> (BTW I suggest to fix the justification if it is too wrong, and
>  to keep the MUST)

Well, I don't think I have received secdir review, I'll solve it there
if you don't mind.

> - 7 page 8: BTW I like the disclaimer:
>   ... Regardless of whether or not the attacks on SHA-1 will
>   affect SSHFP, it is believed (at the time of this writing) that SHA-
>   256 is the better choice for use in SSHFP records.

Well, thanks goes to authors of RFC 5702 :)

> [...]
All your other comments not mentioned here are fixed.

--
 Ondřej Surý
 vedoucí výzkumu/Head of R&D department
 -------------------------------------------
 CZ.NIC, z.s.p.o.    --    Laboratoře CZ.NIC
 Americka 23, 120 00 Praha 2, Czech Republic
 mailto:[email-masked]    http://nic.cz/
 tel:+420.222745110       fax:+420.222745112
 -------------------------------------------

---

From: Ondřej Surý <[email-masked]>
Date: Fri, 27 Jan 2012 14:46:53 +0100

Hi,

>>           SHA-2 family of algorithms RFC 5656 (Section 3.1.1).

I have removed it from the draft version -06 and kept only the part in
Implementation Considerations:

4.1.  Support for SHA-256 fingerprints

   SSHFP-aware Secure Shell implementations SHOULD support the SHA-256
   fingerprints for verification of the public key.  Secure Shell
   implementations which support SHA-256 fingerprints MUST prefer a SHA-
   256 fingerprint over SHA-1 if both are available for a server.  If
   the SHA-256 fingerprint is tested and does not match the key SSH
   public key received from the SSH server key, then the key MUST be
   rejected rather than testing the alternative SHA-1 fingerprint.

and Security Considerations

   Users of SSHFP are encouraged to deploy SHA-256 as soon as
   implementations allow for it.  SHA-2 family of algorithms is widely
   believed to be more resilient to attack than SHA-1, and confidence in
   SHA-1's strength is being eroded by recently announced attacks [IACR
   2007/474].  Regardless of whether or not the attacks on SHA-1 will
   affect SSHFP, it is believed (at the time of this writing) that SHA-
   256 is the better choice for use in SSHFP records.

I believe that now all concerns are solved, but I haven't got the review
from secdir yet.

O.

---

From: <[email-masked]>
Date: Fri, 27 Jan 2012 18:31:29 +0100

Thank you!

Lionel 

-----Message d'origine-----
De : Ondřej Surý [mailto:[email-masked]] 
Envoyé : vendredi 27 janvier 2012 14:47
À : Francis Dupont; MORAND Lionel RD-CORE-ISS; Peter Koch; Daniel Black
Cc : Elwyn Davies; Stephen Farrell; [email-masked]; [email-masked]; [email-masked]
Objet : Updated draft-os-ietf-sshfp-ecdsa-sha2-06.txt 

Hi,

O.