Subject: Re: deaft-gree-sedsh-ecc-08: small correction

From: Damien Miller <[email-masked]>
Date: Fri, 3 Sep 2010 10:46:18 +1000 (EST)

On Fri, 13 Aug 2010, Damien Miller wrote:

> I'm thinking of implementing the ECDH and ECDSA parts of the draft when
> I return from the USA. Is anyone interested in some interop testing?

FYI, -current OpenSSH now supports ECDH and ECDSA. If anyone else has
implemented these and wants to interop test, then you can use snapshots
from http://www.mindrot.org/openssh_snap/ dated 20100901 or later.

Note that our implementation does not accept compressed points. I think
that is was a mistake to allow these as optional in the RFC, because
there is no way of recovering if one side does not accept them.

-d

---

From: Peter Gutmann <[email-masked]>
Date: Fri, 03 Sep 2010 15:59:15 +1200

Damien Miller <[email-masked]> writes:

>Note that our implementation does not accept compressed points. I think that
>is was a mistake to allow these as optional in the RFC, because there is no
>way of recovering if one side does not accept them.

>From experience with TLS and S/MIME I don't think there's any danger of anyone
every using compressed points, so in practice it probably won't be an issue.
Still, it'd be useful to have errata for the RFC that removes them or at least
makes them a SHOULD NOT.

Peter.

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Fri, 03 Sep 2010 14:07:30 -0400

--On Friday, September 03, 2010 03:59:15 PM +1200 Peter Gutmann 
<[email-masked]> wrote:

> From experience with TLS and S/MIME I don't think there's any danger of
> anyone every using compressed points, so in practice it probably won't be
> an issue. Still, it'd be useful to have errata for the RFC that removes
> them or at least makes them a SHOULD NOT.

That's really not within the scope of something that can be done in errata. 
Errata can be used to point out errors in the document, where it is unclear 
or doesn't say what it was intended to say.  They cannot be used as a means 
of changing an IETF consensus protocol with a lighter-weight process than 
obtaining an IETF consensus to make the change.  Removing support for 
compressed points or changing the requirements level that applies would 
require an update in the form of a new RFC.

That said, I've no objection to the change itself.

-- Jeff

---

From: Nicolas Williams <[email-masked]>
Date: Fri, 3 Sep 2010 15:58:13 -0500

On Fri, Sep 03, 2010 at 02:07:30PM -0400, Jeffrey Hutzelman wrote:
> That's really not within the scope of something that can be done in
> errata. Errata can be used to point out errors in the document,
> where it is unclear or doesn't say what it was intended to say.
> They cannot be used as a means of changing an IETF consensus
> protocol with a lighter-weight process than obtaining an IETF
> consensus to make the change.  Removing support for compressed
> points or changing the requirements level that applies would require
> an update in the form of a new RFC.
> 

Or make the use of compressed points a separately negotiable feature (by
using different KEX alg names for that).

Nico
--

---

From: Peter Gutmann <[email-masked]>
Date: Sun, 05 Sep 2010 01:54:12 +1200

Jeffrey Hutzelman <[email-masked]> writes:

>Errata can be used to point out errors in the document, 

If the protocol can end up in an irrecoverable state when point compression is 
used then it sounds like an error :-).  I agree with your point though, it can 
probably be addressed in a future rev of the RFC.

(Had anyone actually implemented this before it was published as an RFC?  It's
quite possible that further issues needing correcting will be discovered if
the spec hasn't been evaluated experimentally yet anyway).

Peter.