Subject: [Curdle] Adam Roach's No Objection on draft-ietf-curdle-ssh-curves-11: (with COMMENT)

From: Adam Roach via Datatracker <[email-masked]>
Date: Tue, 03 Sep 2019 21:12:44 -0700

Adam Roach has entered the following ballot position for
draft-ietf-curdle-ssh-curves-11: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-curdle-ssh-curves/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thanks for the work on documenting this key exchange method.

I'm a little surprised that there is no discussion of deployment considerations
for deploying "curve25519-sha256" into an environment in which
"[email-masked]" is already well-established (as described in the
introduction), or of sunsetting the vendor-specific version. Some advice on
which algorithms to offer and which ones to accept would probably be
worthwhile, especially if there is any long-term hope of retiring the
"[email-masked]" designator in favor of the standard one.

---

From: "Mark D. Baushke" <[email-masked]>
Date: Tue, 3 Sep 2019 23:09:35 -0700

Hi Adam,

> I'm a little surprised that there is no discussion of deployment

I suspect most implementations would just make the
[email-masked] be an alias for the new
curve25519-sha256 official name.

This is what happened with the SSHv1 Cipher [email-masked]
which eventually was made into an alias for aes128-cbc by most
implementations. I will note that [email-masked] was
originally an extension to SSH version 1 and carried over in many
implementations of SSH version 2.

Many implementations have only recently removed the
[email-masked] Cipher (in the last year or so).

I am not sure, but I expect it may take at least a few years for the
[email-masked] cipher offering to disappear after
curve25519-sha256 comes into widespread usage as a KEX.

> Some advice on which algorithms to offer and which ones to accept
> would probably be worthwhile, especially if there is any long-term
> hope of retiring the "[email-masked]" designator in
> favor of the standard one.

As to writing a survey of the existing KEX echanges and a desire to
deprecate older ones, I would still like update

  https://datatracker.ietf.org/doc/draft-ietf-curdle-ssh-kex-sha2

and see about depreacation of these Key Exchange algorithms:

  diffie-hellman-group-exchange-sha1
  diffie-hellman-group1-sha1
  gss-gex-sha1-*
  gss-group1-sha1-*
  rsa1024-sha1

but that can wait until after this draft is published.

	-- Mark