Subject: Guessed key exchange packets

From: "Joseph Galbraith" <[email-masked]>
Date: Wed, 4 Oct 2000 16:56:07 -0600

I'm a little confused about when a guessed key exchange
packet should be retransmitted.

Quote from section 5 of draft-ietf-secsh-transport-07.txt:

  Key exchange begins by each side sending lists of supported algorithms.
  Each side has a preferred algorithm in each category, and it is assumed
  that most implementations at any given time will use the same preferred
  algorithm.  Each side MAY guess which algorithm the other side is using,
  and MAY send an initial key exchange packet according to the algorithm
  if appropriate for the preferred method.  If all algorithms were guessed
  right, the optimistically sent packet MUST be handled as the first key
  exchange packet.  However, if the guess was wrong, and a packet was
  optimistically sent by one or both parties, such packets MUST be ignored
  (even if the error in the guess would not affect the contents of the
  initial packet(s)), and the appropriate side MUST send the correct
  initial packet.

  ...

  The first algorithm in each list MUST be the preferred (guessed)
  algorithm.  Each string MUST contain at least one algorithm name.

I am unclear as to when I should ignore a guessed key exchange
packet.  The SSH Communications clients are the only ones I know of that
guess packets... and I can't find any situation where they retransmit.

The way I first read this paragraph, the guessed packet should be
retransmitted if the first algorithm of each list isn't the same
for the client and server (for all algorithms negotiated in the
KEX_INIT packet.)

Then I read it again, and it seemed like maybe it would only be
retransmitted if the first algorithm in the guesser's list wasn't
chosen...

Can anyone clarify what the appropriate behavior is when I receive
a guessed packet?

In particular, when should I expect/require a retransmission?

Thanks,

Joseph Galbraith
[email-masked]

---

From: [email-masked] (Niels M�ller)
Date: 05 Oct 2000 11:37:01 +0200

> packet should be retransmitted.

The guessed packet MUST be discarded iff the guess was "wrong". The
problem is criteria for determining whether or not a guess is
considered correct or wrong.

The interpretations I can come up with, for defining "correct", are:

: 1. The first element of the server's kex_algorithms list equals the
:    first element of the client's kex_algorithms list. This has the
:    problem described above, and additional problems if the
:    first_kex_packet feature is used, and the contents of that packet
:    depends in any way on the host key algorithm.
: 
: 2. The first elements of the server's kex_algorithms and
:    server_host_key_algorithms lists equal the respective first
:    elements of the client's lists. This seems more reasonable, but it
:    still needs some extra conditions to deal with the example above.
: 
: 3. The first elements of "all" the server's lists equal the respective
:    first elements of the client's list. This is what the first
:    paragraph says, but it seems like a unneccessarily strict
:    criterion. I don't see much use to have the guessing mechanism
:    depend on a correct guess for the bulk encryption algorithms, and
:    even less use of it depending on a correct guess for the
:    compression algorithms.
: 
: 4. Interpret "all" algorithms to mean the kex_algorithms,
:    server_host_key_algorithms, encryption_algorithms and
:    mac_algorithms (but not compression_algorithms or languages).
: 

(from
<URL:http://www.lysator.liu.se/~nisse/doc/protocol-comments.txt>).

Also consider this example (where "foo" stands for some key exchange
method that requires an encryption-capable host key):

  Server:
    kex_algorithms:             "foo,diffie-hellman-group1-sha1"
    server_host_key_algorithms: "ssh-dss,rsa-encrypt"

  Client:
    kex_algorithms              "foo,diffie-hellman-group1-sha1"
    server_host_key_algorithms: "ssh-dss,elgamal-encrypt"

which demonstrates that it is not good enough that the first elements
of the respective preference lists match.

> retransmitted if the first algorithm in the guesser's list wasn't

That's a new interpretation to me. I don't read the spec that way. 

> Can anyone clarify what the appropriate behavior is when I receive

I agree that this has to be clarified.

/Niels