Subject: suggestion for new ssh maintenance wg (was: Re: [Curdle] SSH crypto updates / Re: Call for Adoption)

From: Stephen Farrell <[email-masked]>
Date: Thu, 14 Jan 2016 11:50:15 +0000

(Dropping the curdle list for just this question.)

Hiya,

Denis identified a few topics (below) where he figures
there's scope for an ssh maintenance wg but where those
topics don't clearly fit in the curdle wg.

If there are other folks who'd like to see that work
get done in an ssh maintenance wg then please say so
on this list. And please say if you'd be willing to
write documents or to review documents or if you'd be
implementing.

If you've another relevant topic please also respond
with information (ideally a draft) about that.

If you think such an ssh maintenance wg is a bad plan,
please also do say that and why you think that.

>From my POV, I'd be happy to help such a wg be formed
if there seems to be sufficient qualified support and
folks likely to implement and victims^H^H^H^H^H^H^Hvolunteers
to chair it:-)

Cheers,
S.

PS: If a new ssh wg gets sufficient support, we can then
figure out whether or not some of the stuff that does
fit curdle could be better done in an ssh wg, but let's
leave that aside for now and allow ssh work in curdle
proceed without this process stuff slowing that down.

PPS: Note that this could be short-lived wg that never
needs to meet face-to-face, or maybe it'd not be like that,
but don't get fussed about having to go to IETF meetings
to get this work done - if it's maintenance then that may
well not be needed.

On 14/01/16 06:57, denis bider wrote:
[... probably curdle relevant stuff deleted...]

> This is an extension to SSH that's not directly crypto related, but
> comes hand in hand with the new RSA signature algorithms - it's
> infrastructure that allows for their efficient discovery without
> incurring authentication penalties:
> 
> Extension negotiation for SSH: 
> https://datatracker.ietf.org/doc/draft-ssh-ext-info
> 
> In addition to the above, I very much agree that [email-masked]
> needs standardization.
> 
> I would welcome either all of the above being adopted by the Curdle
> group; or else, a new WG being created specifically to perform
> maintenance on SSH.
> 
> Among other things, the erstwhile SSH working group never finalized
> the SFTP spec due to lack of consensus. We now have two SFTP specs,
> version 3 implemented by OpenSSH, and version 6 implemented by most
> everyone else.
> 
> It seems to me there's plenty of work that could be done by a new SSH
> working group, if it were founded. If Curdle doesn't want to adopt
> some of the above things, then these things would properly belong
> into a new SSH working group.
> 
> However, there isn't one, currently.
> 
> denis
> 
> 
> ----- Original Message ----- From: Watson Ladd Sent: Wednesday,
> January 13, 2016 10:40 To: Daniel Migault Cc: [email-masked] ;
> Curdle Chairs ; Curdle ; [email-masked] Subject: Re: [Curdle]
> Call for Adoption
> 
> On Wed, Jan 13, 2016 at 8:31 AM, Daniel Migault 
> <[email-masked]> wrote:
>> Hi,
>> 
>> Thanks for the suggestion. I think it falls into the scope of the
>> WG.
>> 
>> The question I would have is whether it would make sense to extend
>> the document to the crypto suites others than DH - i.e. encryption
>> mac. This would result in a document providing cryptographic 
>> recommendations for SSH and have this document regularly updated
>> as crypto evolves. Any opinion ?
> 
> I'd prefer to prioritize the already deployed Curve25519 and Ed25519 
> work over crypto recommendations which other groups can develop. We 
> also should consider [email-masked] to be added as this
> addresses a corner case in the spec which makes AEAD complex.
> 
>> 
>> BR, Daniel
>> 
>> -----Original Message----- From: [email-masked]
>> [mailto:[email-masked]] Sent: Wednesday, January 13, 2016 10:40
>> AM To: Curdle Chairs Cc: Curdle; [email-masked] Subject: Re:
>> [Curdle] Call for Adoption
>> 
>> Hi,
>> 
>> Over on the [email-masked] list, Stephen Farrell suggested
>> that I see if I could add
>> 
>> https://datatracker.ietf.org/doc/draft-baushke-ssh-dh-group-sha2
>> 
>> under the curdle charter.
>> 
>> The draft deprecates a Secure Shell (SSH) key exchange algorithm
>> (Diffie-Hellman group1 - a 768-bit MODP group) and recommends
>> replacement with stronger Diffie-Hellman MODP groups (groups 14,
>> 15, 16).
>> 
>> The draft does have two interoperable implementations that have
>> implemented it.
>> 
>> Does it fit well enough into the curdle charter to be added here?
>> 
>> Thank you, -- Mark
>> 
>> ------- forwarded message ------- From: Stephen Farrell
>> <[email-masked]> Date: Wed, 13 Jan 2016 10:34:05 +0000 
>> Subject: Re: draft-baushke-ssh-dh-group-sha2-01 (was Re: DH group
>> exchange)
>> 
>> Hiya,
>> 
>> On 13/01/16 09:21, Mark D. Baushke wrote:
>>> Hi,
>>> 
>>> URL:
>>> https://datatracker.ietf.org/doc/draft-baushke-ssh-dh-group-sha2
>>> 
>>> I believe that OpenSSH and Dropbear SSH have both implemented 
>>> interoperable versions using the current 01 version at this point
>>> in time.
>>> 
>>> I would be interested in hearing if any other implementations
>>> have adopted these new DH groups.
>>> 
>>> Are there any additional comments or changes needed for the
>>> draft before we can move to the next step in the process?
>>> 
>>> Hmmm... What is next? Getting 'AD is watching' or is it getting
>>> a document shepherd?
>> 
>> There's no active SSH WG, but there is the curdle WG. Its charter
>> [1] however is limited in terms of what it's allowed to add to
>> protocols. OTOH, this is not defining any new groups, just updating
>> codepoints, including deprecating one (to NOT RECOMMENDED). So the
>> draft could fit there on that basis I guess. So I'd say send a mail
>> to the curdle list and suggest this be adopted there.
>> 
>> If that doesn't work I can look at AD sponsoring it, but since one
>> of the reasons to setup curdle was to avoid too many of these being
>> AD sponsored, please try there first.
>> 
>> Cheers, S.
>> 
>> [1] https://tools.ietf.org/wg/curdle
>> 
>>> 
>>> Thank you, -- Mark
>> 
>> _______________________________________________ Curdle mailing
>> list [email-masked] https://www.ietf.org/mailman/listinfo/curdle
> 
> 
> 
> 
> 
> _______________________________________________ Curdle mailing list 
> [email-masked] https://www.ietf.org/mailman/listinfo/curdle
>

---

From: denis bider <[email-masked]>
Date: Thu, 14 Jan 2016 06:57:37 +0000

Hello,

> I'd prefer to prioritize the already deployed Curve25519 and
> Ed25519 work over crypto recommendations which other
> groups can develop.

the current practical issue is, for SSH, there aren't such other working groups.

Currently, SSH needs a significant amount of maintenance just to keep up with the cryptography landscape alone. Part of this maintenance belongs under the Curdle WG, but other parts currently have no home (unless Curdle adopts them).

Parts currently falling under Curdle:

  Ed25519 for SSH:
  https://datatracker.ietf.org/doc/draft-bjh21-ssh-ed25519

  Curve25519 for SSH:
  https://tools.ietf.org/html/draft-josefsson-ssh-curves-00

Crypto updates to SSH that currently have no home unless Curdle adopts them:

  Stronger DH groups for SSH:
  https://datatracker.ietf.org/doc/draft-baushke-ssh-dh-group-sha2

  RSA signatures with SHA-2 for SSH:
  https://datatracker.ietf.org/doc/draft-rsa-dsa-sha2-256

This is an extension to SSH that's not directly crypto related, but comes hand in hand with the new RSA signature algorithms - it's infrastructure that allows for their efficient discovery without incurring authentication penalties:

In addition to the above, I very much agree that [email-masked] needs standardization.

I would welcome either all of the above being adopted by the Curdle group; or else, a new WG being created specifically to perform maintenance on SSH.

Among other things, the erstwhile SSH working group never finalized the SFTP spec due to lack of consensus. We now have two SFTP specs, version 3 implemented by OpenSSH, and version 6 implemented by most everyone else.

It seems to me there's plenty of work that could be done by a new SSH working group, if it were founded. If Curdle doesn't want to adopt some of the above things, then these things would properly belong into a new SSH working group.

denis

----- Original Message -----
From: Watson Ladd 
Sent: Wednesday, January 13, 2016 10:40
To: Daniel Migault 
Cc: [email-masked] ; Curdle Chairs ; Curdle ; [email-masked] 
Subject: Re: [Curdle] Call for Adoption

On Wed, Jan 13, 2016 at 8:31 AM, Daniel Migault
<[email-masked]> wrote:
>  Hi,
>
>  Thanks for the suggestion. I think it falls into the scope of the WG.
>
>  The question I would have is whether it would make sense to extend the
>  document to the crypto suites others than DH - i.e. encryption mac.
>  This would result in a document providing cryptographic
>  recommendations for SSH and have this document regularly updated as
>  crypto evolves. Any opinion ?

I'd prefer to prioritize the already deployed Curve25519 and Ed25519
work over crypto recommendations which other groups can develop. We
also should consider [email-masked] to be added as this addresses
a corner case in the spec which makes AEAD complex.

>
>  BR,
>  Daniel
>
> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]
> Sent: Wednesday, January 13, 2016 10:40 AM
> To: Curdle Chairs
> Cc: Curdle; [email-masked]
> Subject: Re: [Curdle] Call for Adoption
>
> Hi,
>
> Over on the [email-masked] list, Stephen Farrell suggested that I see if I could add
>
> The draft deprecates a Secure Shell (SSH) key exchange algorithm (Diffie-Hellman group1 - a 768-bit MODP group) and recommends replacement with stronger Diffie-Hellman MODP groups (groups 14, 15, 16).
>
> The draft does have two interoperable implementations that have implemented it.
>
>         Thank you,
>         -- Mark
>  ------- forwarded message -------
> From: Stephen Farrell <[email-masked]>
> Date: Wed, 13 Jan 2016 10:34:05 +0000
> Subject: Re: draft-baushke-ssh-dh-group-sha2-01 (was Re: DH group exchange)
>
> Hiya,
>
>> URL: https://datatracker.ietf.org/doc/draft-baushke-ssh-dh-group-sha2
>>
>> interoperable versions using the current 01 version at this point in time.
>>
>> I would be interested in hearing if any other implementations have
>> adopted these new DH groups.
>>
>> Are there any additional comments or changes needed for the draft
>> before we can move to the next step in the process?
>>
>> Hmmm... What is next? Getting 'AD is watching' or is it getting a
>> document shepherd?
>
> There's no active SSH WG, but there is the curdle WG. Its charter [1] however is limited in terms of what it's allowed to add to protocols. OTOH, this is not defining any new groups, just updating codepoints, including deprecating one (to NOT RECOMMENDED). So the draft could fit there on that basis I guess. So I'd say send a mail to the curdle list and suggest this be adopted there.
>
> If that doesn't work I can look at AD sponsoring it, but since one of the reasons to setup curdle was to avoid too many of these being AD sponsored, please try there first.
>
> Cheers,
> S.
>
>>       Thank you,
>>       -- Mark
> [email-masked]
> https://www.ietf.org/mailman/listinfo/curdle

-- 
"Man is born free, but everywhere he is in chains".
--Rousseau.

---

From: [email-masked] (Niels Möller)
Date: Fri, 29 Jan 2016 22:34:20 +0100

> please also do say that and why you think that.

There's definitely some work that needs to be done. I'm not very
familiar with ietf processes, so I'm not sure a new working group would
make it easier to make progress. I guess what's needed is either an
active wg chair, or an active area director, or someone informally
accepting (and being accepted) in a similar role.

> to get this work done - if it's maintenance then that may

Don't worry about IETF meetings. I felt I was deeply involved during the
work on the ssh rfc:s. And I've never been to a secsh wg meeting, only
on the mailing list. (I've actually been to one ietf meeting in my life,
but the secsh wg didn't meet that time).

>> https://datatracker.ietf.org/doc/draft-ssh-ext-info

An extension mechanism makes sense to me, but I find most of the
proposed extensions questionable and/or hard to get right.

>> In addition to the above, I very much agree that [email-masked]

I think the single issue that might motivate forming a new wg is how to
properly negotiate the use of aead crypt in ssh. There should be no
difference between aes-gcm (which I'm not very fond of) and
chacha-poly1305.
 
>> version 3 implemented by OpenSSH, and version 6 implemented by most

I honestly doubt we'll see much progress there, wg or not. It was a bit
too much of second system syndrome. But if some others have the energy
to revive it, I can't object, of course.

Regards,
/Niels

-- 
Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26.
Internet email is subject to wholesale government surveillance.