Subject: Adding ssh-rsa to the transport draft...

From: "Jeff P. Van Dyke" <[email-masked]>
Date: Thu, 10 Aug 2000 21:34:48 -0600

During the working group meeting in Pittburgh, I believe
it was decided that ssh-rsa would be added as a public
key algorithm to the next rev of the transport draft.

  http://www.ietf.org/internet-drafts/draft-ietf-secsh-transport-07.txt

Currently, the transport draft has the following text
for ssh-dss:

--- 
The "ssh-dss" key format has the following specific encoding:

  uint32    length
  string    "ssh-dss"
  mpint     p
  mpint     q
  mpint     g
  mpint     y

Here the "p", "q", "g", and "y" parameters form the signature key blob.

Signing and verifying using this key format are done according to the
Digital Signature Standard [FIPS-186] using the SHA-1 hash. A
description can also be found in [Schneier].

The resulting signature is encoded as:

  uint32    length
  string    "ssh-dss"
  string    dss_signature_blob

dss_signature_blob is encoded as string containing "r" followed by "s"
(which are 160 bits long integers, without lengths or padding, unsigned
and in network byte order).
---

What is the current practice for encoding an ssh-rsa key?

Will text describing this be included in the next rev of
the transport draft?

Thank you.

Jeff P. Van Dyke
[email-masked]

---

From: Sami Lehtinen <[email-masked]>
Date: Fri, 11 Aug 2000 12:31:12 +0300 (EEST)

Jeff P. Van Dyke, on August 10. 2000, wrote:
  : What is the current practice for encoding an ssh-rsa key?

I will have this modification to the draft peer reviewed today, and I
will send it to the list after that. Sound OK?

  : Will text describing this be included in the next rev of
  : the transport draft?

Yes.

-- 
[[email-masked]          --  Sami J. Lehtinen  --           [email-masked]]
[work:+358 9 85657425][gsm:+358 50 5170 258][http://www.iki.fi/~sjl]
[SSH Communications Security Corp               http://www.ssh.com/]

---

From: "Jeff P. Van Dyke" <[email-masked]>
Date: Fri, 11 Aug 2000 05:46:07 -0600

> will send it to the list after that. Sound OK?

Excellent.

thanks.

Jeff P. Van Dyke
[email-masked]

---

From: Markus Friedl <[email-masked]>
Date: Fri, 11 Aug 2000 17:47:22 +0200

On Fri, Aug 11, 2000 at 01:29:56PM +0200, Markus Friedl wrote:
> i tried to send this before but it did not appear on the list:
> 
>          A RSA Key and Signature Encoding for the SSH Protocol

here's a draft for "ssh-rsa"

http://wwwcip.informatik.uni-erlangen.de/~msfriedl/ssh/ssh-rsa.txt

comments?

---

From: Markus Friedl <[email-masked]>
Date: Fri, 11 Aug 2000 13:29:56 +0200

Network Working Group                                      Markus Friedl
INTERNET-DRAFT                                       The OpenBSD Project
Expires in six months                                          July 2000

Status of this Memo

   This document is an Internet-Draft and is in full conformance with
   all provisions of Section 10 of RFC2026.

   Please direct comments to one of the authors (for the authors contact
   information, see the end of this document).

   Internet Drafts are working documents of the Internet Engineering
   Task Force (IETF), its areas, and its working Groups.  Note that
   other groups may also distribute working documents as Internet
   Drafts.

   Internet-Drafts draft documents are valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress".

   The list of current Internet-Drafts can be accessed at
   http://www.ietf.org/ietf/1id-abstracts.txt

   The list of Internet-Draft Shadow Directories can be accessed at
   http://www.ietf.org/shadow.html.

   Distribution of this memo is unlimited.

Abstract

   The SSH Transport Layer Protocol [SSH-TRANS] defines several
   encodings for Public Key Algorithms.  However, it fails to provide a
   specifications for the widely used RSA algorithm.  This document
   specifies both how RSA keys and RSA signatures are encoded.

The Encoding

   The name for this public key encoding method is "ssh-rsa".  The
   encoding for RSA keys and signatures is similar to the "ssh-dss" key
   format defined in the SSH Transport Layer Protocol document [SSH-
   TRANS].  The used data types are specified in the SSH Protocol
   Architecture document [SSH-ARCH].

Friedl                                                          [Page 1]

INTERNET-DRAFT                                                 July 2000

   The "ssh-rsa" key format has the following specific encoding:

           uint32    length
           string    "ssh-rsa"
           mpint     e
           mpint     n

   The parameters "e" and "n" are the public key for the RSA algorithm.
   They are used to verify signatures created by the corresponding
   private key.

   The PKCS#1 standard [RFC 2437] describes signature and verification
   operations for RSA.  Signing and verifying using the "ssh-rsa" key
   format are done according to the RSASSA-PKCS1-v1_5 scheme defined in
   [RFC 2437] using the SHA-1 hash.  The SHA-1 hash is recommended in
   [RFC 2437].

           uint32    length
           string    "ssh-rsa"
           string    "RSASSA-PKCS1-v1_5"
           string    rsa_signature_blob

   rsa_signature_blob is an octet string of length k, where k is the
   length in octets of the modulus n.  The encoding for the
   rsa_signature_blob is defined in [RFC 2437].

Discussion

   [RFC 2437] defines PKCS#1 v2.0.

   The first draft for PKCS#1 v2.1 defines an additional 'signature
   scheme with appendix' called RSASSA-PSS and notes:

           Two signature schemes with appendix are specified in this
           document:  RSASSA-PKCS1-v1_5 and RSASSA-PSS.  Although no
           attacks are known against RSASSA-PKCS1-v1_5, in the interest
           of increased robustness, RSASSA-PSS is recommended for
           eventual adoption in new applications.  RSASSA-PKCS1-v1_5
           is included for compatibility with existing applications,
           and while still appropriate for new applications, a gradual
           transition to RSASSA-PSS is encouraged.

   RSASSA-PSS employs an encoding method based on Bellare and Rogawayas
   Probabilistic Signature scheme.  Once PKCS#1 v2.1 is published
   signatures may be encoded as:

Friedl                                                          [Page 2]

INTERNET-DRAFT                                                 July 2000

           uint32    length
           string    "ssh-rsa"
           string    "RSASSA-PSS"
           string    rsa_signature_blob

Security Considerations

   Security considerations are discussed in this memo.

References

   [SSH-TRANS] Ylonen, T., et al, "SSH Transport Layer Protocol",
   Internet Draft, draft-ietf-secsh-transport-07.txt

   [SSH-ARCH] Ylonen, T., et al, "SSH Protocol Architecture", Internet
   Draft, draft-ietf-secsh-architecture-05.txt

   [RFC 2437] B. Kaliski, J. Staddon, PKCS #1: RSA Cryptography
   Specifications Version 2.0.

Author's  Address:

   Markus Friedl
   [email-masked]
   The OpenBSD Project
   Munich, Germany

Friedl                                                          [Page 3]

---

From: Sami Lehtinen <[email-masked]>
Date: Wed, 16 Aug 2000 01:54:54 +0300 (EEST)

Your proposal:

Markus Friedl, on August 11. 2000, wrote:
  :    The "ssh-rsa" key format has the following specific encoding:
  : 
  :            uint32    length
  :            string    "ssh-rsa"
  :            mpint     e
  :            mpint     n
  : 
[SNIP]
  :            uint32    length
  :            string    "ssh-rsa"
  :            string    "RSASSA-PKCS1-v1_5"
  :            string    rsa_signature_blob
[SNIP]
  :            uint32    length
  :            string    "ssh-rsa"
  :            string    "RSASSA-PSS"
  :            string    rsa_signature_blob

Our proposal (excerpt from draft (not yet submitted)):
--snip--
The "ssh-rsa" key format has the following specific encoding:

  string    "ssh-rsa"
  mpint     e
  mpint     n

Here the "e" and "n" parameters form the signature key
blob.

Signing and verifying using this key format is done according to
[Schneier] and [PKCS1] using the SHA-1 hash.

The resulting signature is encoded as follows:

  string    "ssh-rsa"

rsa_signature_blob is encoded as a string containing "t1"
(which is an integer, without lengths or padding, unsigned and in
network byte order).
--snap--

In my, and Tatu's (among others), opinion, the extra field specifying
the signature scheme should not be put to the draft, as it would be
inconsistent with the "ssh-dss" method, and with the overall spirit in
declaring these key formattings and signature formats.

If, at some point in the future, the "RSASSA-PSS" method is
standardized and we (as a community) want to start using it in SSH 2
protocol, we can describe a format "ssh-rsa-v2" or something to that
effect, which doesn't pollute the draft. (this would apply to
"ssh-dss" as well, of course)

Regards,

---

From: Markus Friedl <[email-masked]>
Date: Fri, 11 Aug 2000 13:29:56 +0200

Status of this Memo

Abstract

The Encoding

Friedl                                                          [Page 1]

INTERNET-DRAFT                                                 July 2000

           uint32    length
           string    "ssh-rsa"
           mpint     e
           mpint     n

           uint32    length
           string    "ssh-rsa"

Discussion

Friedl                                                          [Page 2]

INTERNET-DRAFT                                                 July 2000

           uint32    length
           string    "ssh-rsa"
           string    "RSASSA-PSS"

Security Considerations

References

Author's  Address:

   Markus Friedl
   [email-masked]
   The OpenBSD Project
   Munich, Germany

Friedl                                                          [Page 3]

---

From: [email-masked] (Niels M�ller)
Date: 22 Aug 2000 16:36:43 +0200

>   :    The "ssh-rsa" key format has the following specific encoding:

I think the length field is redundant and should be deleted (just as
for ssh-dss). Likewise for the signature encodings.

> Here the "e" and "n" parameters form the signature key

I also prefer this simpler format.

> (which is an integer, without lengths or padding, unsigned and in

This is not clear enough. What is t1? I have read PKCS#1.5 (aka RFC
2437) a few times, and I have actually implemented it before, but I
find the document a lot messier and harder to understand than the
secsh drafts.

The way I interpret this, you first build a DER-encoded DigestInfo
containing the sha1 OBJECT IDENTIFIER and the hash of the data to be
signed (this usually implies double hashing, just like for ssh-dss,
right?). This is converted to an integer and padded (as described in
RFC 2437, section 9.2.1), and raised to the secret exponent.

As the signature blob is simply the encoding of an integer, I think it
would be better to encode it as a bignum, for consistency with the
secsh-architecture document. I.e. I would propose the following
encoding of signatures:

   string    "ssh-rsa"
   bignum    rsa_signature_blob

> declaring these key formattings and signature formats.

I agree. One identifier to identify and algorithm and algorithm
variant should be enough (it's possible to use the same key pair for
several variants; in lsh the same key can be used for both both "spki"
and "ssh-dss").

As for name of the algorithm, I think "rsa-pkcs1" or "rsa-pkcs1-sha1"
would be more descriptive than "ssh-rsa", even if we only use the
pkcs#1 signature mechanism and not its encodings of keys.

/Niels