Subject: Re: New drafts (TODO)

From: Bill Sommerfeld <[email-masked]>
Date: Thu, 16 Nov 2000 19:29:18 -0500

>     Should concatenated string encoding specify length of each string?
> 		    (transport, section 6)
> 		    - [chair couldn't find context; will take to list]

Ok, I found the context:

    Date: Mon, 24 Aug 1998 09:28:38 +0000
    From: Sigurdur Asgeirsson <[email-masked]>

    3. Sections 4 and 6 of the Authentication Protocol document both contain
    the following paragraph:
    --
    Signature is a signature with the private host key of the following
    data, in this order:
    o  session identifier, and
    o  packet payload without the signature.
    --
      Is the signature performed over the raw data of the session identifier
    and the packet payload or are the two perhaps supposed to be converted
    into strings (length prepended) before signing, like in section 6 of the
    Transport Layer document (Diffie-Hellman Key Exchange)?

It appears that this was revised subsequent to this message but the
text is still somewhat vague; userauth-07 says (identical text in
sections 4 and 6):

    Signature is a signature with the private host key of the following
    data, in this order:

    o  session identifier (encoded as string), and

    o  packet payload without the signature.

This could be expressed a bit less ambiguously as something like:

Signature is a signature with the ... key over the following message:

	  string    session identifier
	  byte      SSH_MSG_USERAUTH_REQUEST
	  string    user name
	  string    service
	  string    "publickey"
	  boolean   TRUE
	  string    public key algorithm name
	  string    public key to be used for authentication

>     DH parameter selection clarification
> 		    - [chair couldn't find context; will take to list]

The context for this issue appears to be:

   Date: Thu, 25 Feb 1999 09:28:01 +0000
   From: Sigurdur Asgeirsson <[email-masked]>

     2. Section 5.2, "Output from Key Exchange" contains the following
   text:

   "The key exchange produces two values: a shared secret K, and an
   exchange hash H."

     Section 6, "Diffie-Hellman Key Exchange" then goes to great lengths to
   specify excactly how the exchange hash "H" is computed, but fails to
   specify the format of "K", which is used in key derivation.
     I suggest that section 6 specify that the binary format of K, the
   shared secret, be mpint (as in the ssh reference implementation).

It appears that transport-07 still leaves this unspecified.

						- Bill

---

From: [email-masked] (Niels M�ller)
Date: 20 Nov 2000 18:45:34 +0100

>     3. Sections 4 and 6 of the Authentication Protocol document both contain

...

> 	  string    public key to be used for authentication

I believe this is the right encoding. However, it would be nice to
also let the spec spell out that it *is* just the session id (as a
string) prepended to the packet payload (without signature).

>    shared secret, be mpint (as in the ssh reference implementation).

For some key exchange methods (e.g. most DH variants), K is naturally
an integer, and it makes sense to encode it as an integer. However,
for other methods (e.g. methods that obtain K by hashing some data),
it is more natural to think about K as a string. So I think it is best
to leave the specification of the format of K to the definition of
each keyexchange method.

As the only difference between the string and the mpint encoding is
whether or not leading zero octets are stripped (or sometimes added),
all that means in practice is that some keyexchange methods will
provide a K that is a fix length string (e.g. a 20 octet sha1 hash
value), while other methods will provide a variable length octet
string that is canonicalized accordning to the rules for encoding ssh
mpints.

I agree that the definition of diffie-hellman keyexchange should say
that K is an mpint.

/Niels