From bounces-ietf-ssh-owner-secsh-tyoxbijeg7-archive=lists.ietf.org@NetBSD.org Sun Sep 4 18:14:35 2011 Return-Path: X-Original-To: ietfarch-secsh-tyoxbijeg7-archive@ietfa.amsl.com Delivered-To: ietfarch-secsh-tyoxbijeg7-archive@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9CF9E21F874E for ; Sun, 4 Sep 2011 18:14:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.549 X-Spam-Level: X-Spam-Status: No, score=-1.549 tagged_above=-999 required=5 tests=[AWL=-1.050, BAYES_00=-2.599, J_CHICKENPOX_23=0.6, J_CHICKENPOX_32=0.6, J_CHICKENPOX_81=0.6, MIME_8BIT_HEADER=0.3] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9XHO-8H2rVEW for ; Sun, 4 Sep 2011 18:14:34 -0700 (PDT) Received: from mail.netbsd.org (ns.NetBSD.org [IPv6:2001:4f8:3:7::53]) by ietfa.amsl.com (Postfix) with ESMTP id 9851F21F8751 for ; Sun, 4 Sep 2011 18:14:34 -0700 (PDT) Received: by mail.netbsd.org (Postfix, from userid 605) id CB86E14A181; Mon, 5 Sep 2011 01:16:13 +0000 (UTC) Delivered-To: ietf-ssh@netbsd.org Received: from localhost (localhost [127.0.0.1]) by mail.netbsd.org (Postfix) with ESMTP id 67C0214A17E for ; Mon, 5 Sep 2011 01:16:09 +0000 (UTC) X-Virus-Scanned: amavisd-new at NetBSD.org Received: from mail.netbsd.org ([127.0.0.1]) by localhost (mail.NetBSD.org [127.0.0.1]) (amavisd-new, port 10025) with ESMTP id erhLRiTCG7hP for ; Mon, 5 Sep 2011 01:16:08 +0000 (UTC) Received: from natsu.mindrot.org (natsu.mindrot.org [116.66.166.108]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.netbsd.org (Postfix) with ESMTPS id 2716C14A178 for ; Mon, 5 Sep 2011 01:16:08 +0000 (UTC) Received: by natsu.mindrot.org (Postfix, from userid 1000) id 88590C4AA9; Mon, 5 Sep 2011 11:16:05 +1000 (EST) Received: from localhost (localhost [127.0.0.1]) by natsu.mindrot.org (Postfix) with ESMTP id 81F9FC4AA7; Mon, 5 Sep 2011 11:16:05 +1000 (EST) Date: Mon, 5 Sep 2011 11:16:05 +1000 (EST) From: Damien Miller To: =?ISO-8859-2?Q?Ond=F8ej_Sur=FD?= cc: ietf-ssh@netbsd.org Subject: Re: Fwd: Support for ECDSA and SHA-2 (SHA-256) in the SSHFP record In-Reply-To: Message-ID: References: User-Agent: Alpine 2.00 (BSO 1167 2008-08-23) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: ietf-ssh-owner@NetBSD.org List-Id: ietf-ssh.NetBSD.org Precedence: list Did anyone on this list have any comment on https://tools.ietf.org/html/draft-os-ietf-sshfp-ecdsa-sha2 It seemed pretty reasonable to me, and I'd like to move ahead implementing it in OpenSSH particularly for the ECDSA support. -d On Sat, 30 Jul 2011, Ond?ej Sur? wrote: > > On 30. 7. 2011, at 14:21, Damien Miller wrote: > > > >> Thanks for starting work on this - SSHFP records for ECDSA keys were on > >> my TODO list, but I haven't yet got around to them. > > > >> I briefly skimmed your draft - one question I have is whether it is > >> better to roll up all the ECDSA key types under one SSHFP RR type. > >> It would be quite ugly to have to allocate SSHFP RR type numbers for > >> each possible ECDSA curve type, but using a single one might make > >> exploitation of SHA256 preimage attacks easier. > > > > My knowledge of cryptography is not so strong, so that's probably good question for security area advisory group as well. > > > >> The latter is a theoretical concern, so I think a single RR type is > >> probably correct. > > > > I'll be happy to accept any changes to the draft. I already had the different ECDSA curves in the draft, but it was suggested by my fellow AD that one is probably enough. > > > >> It would probably be best to continue discussion of this on the IETF SSH > >> list. > > > > I thought that secsh was concluded, but it seems that the mailing list is still up. Ccing there as well. > > > > Anyone who responds please get rid of openssh-unix-dev list when replying, so we don't spam them with ietf flames :) > > > > O. > > > >> On Thu, 28 Jul 2011, Ond?ej Sur? wrote: > >> > >>> Hi, > >>> > >>> I was sure I sent this to openssh@openssh.com, but cannot find that email now in my Sent mailbox, so I am sending it to the developers list. > >>> > >>> I took a liberty and wrote an I-D with accompanying patch (with contributions from Ondrej Caletka) to support ECDSA in the SSHFP DNS resource record. > >>> > >>> The I-D is here: https://tools.ietf.org/html/draft-os-ietf-sshfp-ecdsa-sha2 (and the source XML here: https://git.nic.cz/redmine/projects/ietf/repository/revisions/master/changes/draft-os-ietf-sshfp-ecdsa-sha2-00.xml) > >>> > >>> The patch to vanilla 5.8 here: https://git.nic.cz/redmine/projects/ietf/repository/revisions/master/changes/ssh-sshfp-ecdsa.patch > >>> > >>> Please Cc: me as I am not (and don't intend to be) subscribed to the list. I will check the archives occasionally, but Cc: would be appreciated. > >>> > >>> Thanks, > >>> O. > >>> -- > >>> Ond?ej Sur? > >>> vedouc? v?zkumu/Head of R&D department > >>> ------------------------------------------- > >>> CZ.NIC, z.s.p.o. -- Laborato?e CZ.NIC > >>> Americka 23, 120 00 Praha 2, Czech Republic > >>> mailto:ondrej.sury@nic.cz http://nic.cz/ > >>> tel:+420.222745110 fax:+420.222745112 > >>> ------------------------------------------- > >>> > >>> _______________________________________________ > >>> openssh-unix-dev mailing list > >>> openssh-unix-dev@mindrot.org > >>> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev > >>> > > > > -- > > Ond?ej Sur? > > vedouc? v?zkumu/Head of R&D department > > ------------------------------------------- > > CZ.NIC, z.s.p.o. -- Laborato?e CZ.NIC > > Americka 23, 120 00 Praha 2, Czech Republic > > mailto:ondrej.sury@nic.cz http://nic.cz/ > > tel:+420.222745110 fax:+420.222745112 > > ------------------------------------------- > > > > -- > Ond?ej Sur? > vedouc? v?zkumu/Head of R&D department > ------------------------------------------- > CZ.NIC, z.s.p.o. -- Laborato?e CZ.NIC > Americka 23, 120 00 Praha 2, Czech Republic > mailto:ondrej.sury@nic.cz http://nic.cz/ > tel:+420.222745110 fax:+420.222745112 > ------------------------------------------- > > From bounces-ietf-ssh-owner-secsh-tyoxbijeg7-archive=lists.ietf.org@NetBSD.org Sun Sep 4 23:10:35 2011 Return-Path: X-Original-To: ietfarch-secsh-tyoxbijeg7-archive@ietfa.amsl.com Delivered-To: ietfarch-secsh-tyoxbijeg7-archive@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 161BD21F8ABE for ; Sun, 4 Sep 2011 23:10:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.1 X-Spam-Level: X-Spam-Status: No, score=-1.1 tagged_above=-999 required=5 tests=[AWL=-0.601, BAYES_00=-2.599, J_CHICKENPOX_23=0.6, J_CHICKENPOX_32=0.6, J_CHICKENPOX_81=0.6, MIME_8BIT_HEADER=0.3] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HoZVNsflnfIy for ; Sun, 4 Sep 2011 23:10:19 -0700 (PDT) Received: from mail.netbsd.org (ns.NetBSD.org [IPv6:2001:4f8:3:7::53]) by ietfa.amsl.com (Postfix) with ESMTP id 383CC21F8744 for ; Sun, 4 Sep 2011 23:09:24 -0700 (PDT) Received: by mail.netbsd.org (Postfix, from userid 605) id CA3AC14A1CF; Mon, 5 Sep 2011 06:11:03 +0000 (UTC) Delivered-To: ietf-ssh@netbsd.org Received: from localhost (localhost [127.0.0.1]) by mail.netbsd.org (Postfix) with ESMTP id 918F514A1CA for ; Mon, 5 Sep 2011 06:10:57 +0000 (UTC) X-Virus-Scanned: amavisd-new at NetBSD.org Authentication-Results: mail.NetBSD.org (amavisd-new); dkim=pass header.i=@nic.cz Received: from mail.netbsd.org ([127.0.0.1]) by localhost (mail.NetBSD.org [127.0.0.1]) (amavisd-new, port 10025) with ESMTP id iSdrDvofHye4 for ; Mon, 5 Sep 2011 06:10:56 +0000 (UTC) Received: from mail.nic.cz (mail.nic.cz [IPv6:2001:1488:800:400::400]) by mail.netbsd.org (Postfix) with ESMTP id 5A7A614A1B4 for ; Mon, 5 Sep 2011 06:10:56 +0000 (UTC) Received: from [10.0.0.4] (247.78.broadband13.iol.cz [90.180.78.247]) by mail.nic.cz (Postfix) with ESMTPSA id 0D4D02A0599; Mon, 5 Sep 2011 08:10:54 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nic.cz; s=default; t=1315203054; bh=ILnFeFv4NRUgQ/c952jNuwDsOKBWT67UkypAEw9/v10=; h=Subject:Mime-Version:Content-Type:From:In-Reply-To:Date:Cc: Content-Transfer-Encoding:Message-Id:References:To; b=XBq2axj7BGVM1WE6LoZzd4JNhI9sJoNlqKhKe5flyXwP9Va3TDIgwhtKC13WWhsET Ze7SvQjg8FHGeKPR2yEw2VQgFdjmn7rmmyg5S8AAxYAwUuyJM9QJx5HdqeFZBLwNDQ MXuTPia1j5HuWp2yDSwZ2ACFp2jeALntKDhpsEnU= Subject: Re: Support for ECDSA and SHA-2 (SHA-256) in the SSHFP record Mime-Version: 1.0 (Apple Message framework v1244.3) Content-Type: text/plain; charset=utf-8 From: =?utf-8?Q?Ond=C5=99ej_Sur=C3=BD?= In-Reply-To: Date: Mon, 5 Sep 2011 08:10:53 +0200 Cc: ietf-ssh@netbsd.org Content-Transfer-Encoding: quoted-printable Message-Id: References: To: Damien Miller X-Mailer: Apple Mail (2.1244.3) X-Virus-Scanned: clamav-milter 0.96.5 at mail X-Virus-Status: Clean Sender: ietf-ssh-owner@NetBSD.org List-Id: ietf-ssh.NetBSD.org Precedence: list Hi Damien, the implementation for OpenSSH is already done and working (see the link = to git named patch for vanilla 5.8 below in the first mail). Ondrej On 5. 9. 2011, at 3:16, Damien Miller wrote: >=20 > Did anyone on this list have any comment on=20 > https://tools.ietf.org/html/draft-os-ietf-sshfp-ecdsa-sha2 >=20 > It seemed pretty reasonable to me, and I'd like to move ahead = implementing > it in OpenSSH particularly for the ECDSA support. >=20 > -d >=20 > On Sat, 30 Jul 2011, Ond?ej Sur? wrote: >=20 >>> On 30. 7. 2011, at 14:21, Damien Miller wrote: >>>=20 >>>> Thanks for starting work on this - SSHFP records for ECDSA keys = were on >>>> my TODO list, but I haven't yet got around to them. >>>=20 >>>> I briefly skimmed your draft - one question I have is whether it is >>>> better to roll up all the ECDSA key types under one SSHFP RR type. >>>> It would be quite ugly to have to allocate SSHFP RR type numbers = for >>>> each possible ECDSA curve type, but using a single one might make >>>> exploitation of SHA256 preimage attacks easier. >>>=20 >>> My knowledge of cryptography is not so strong, so that's probably = good question for security area advisory group as well. >>>=20 >>>> The latter is a theoretical concern, so I think a single RR type is >>>> probably correct. >>>=20 >>> I'll be happy to accept any changes to the draft. I already had the = different ECDSA curves in the draft, but it was suggested by my fellow = AD that one is probably enough. >>>=20 >>>> It would probably be best to continue discussion of this on the = IETF SSH >>>> list. >>>=20 >>> I thought that secsh was concluded, but it seems that the mailing = list is still up. Ccing there as well. >>>=20 >>> Anyone who responds please get rid of openssh-unix-dev list when = replying, so we don't spam them with ietf flames :) >>>=20 >>> O. >>>=20 >>>> On Thu, 28 Jul 2011, Ond?ej Sur? wrote: >>>>=20 >>>>> Hi, >>>>>=20 >>>>> I was sure I sent this to openssh@openssh.com, but cannot find = that email now in my Sent mailbox, so I am sending it to the developers = list. >>>>>=20 >>>>> I took a liberty and wrote an I-D with accompanying patch (with = contributions from Ondrej Caletka) to support ECDSA in the SSHFP DNS = resource record. >>>>>=20 >>>>> The I-D is here: = https://tools.ietf.org/html/draft-os-ietf-sshfp-ecdsa-sha2 (and the = source XML here: = https://git.nic.cz/redmine/projects/ietf/repository/revisions/master/chang= es/draft-os-ietf-sshfp-ecdsa-sha2-00.xml) >>>>>=20 >>>>> The patch to vanilla 5.8 here: = https://git.nic.cz/redmine/projects/ietf/repository/revisions/master/chang= es/ssh-sshfp-ecdsa.patch >>>>>=20 >>>>> Please Cc: me as I am not (and don't intend to be) subscribed to = the list. I will check the archives occasionally, but Cc: would be = appreciated. >>>>>=20 >>>>> Thanks, >>>>> O. >>>>> -- >>>>> Ond?ej Sur? >>>>> vedouc? v?zkumu/Head of R&D department >>>>> ------------------------------------------- >>>>> CZ.NIC, z.s.p.o. -- Laborato?e CZ.NIC >>>>> Americka 23, 120 00 Praha 2, Czech Republic >>>>> mailto:ondrej.sury@nic.cz http://nic.cz/ >>>>> tel:+420.222745110 fax:+420.222745112 >>>>> ------------------------------------------- >>>>>=20 >>>>> _______________________________________________ >>>>> openssh-unix-dev mailing list >>>>> openssh-unix-dev@mindrot.org >>>>> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev >>>>>=20 >>>=20 >>> -- >>> Ond?ej Sur? >>> vedouc? v?zkumu/Head of R&D department >>> ------------------------------------------- >>> CZ.NIC, z.s.p.o. -- Laborato?e CZ.NIC >>> Americka 23, 120 00 Praha 2, Czech Republic >>> mailto:ondrej.sury@nic.cz http://nic.cz/ >>> tel:+420.222745110 fax:+420.222745112 >>> ------------------------------------------- >>>=20 >>=20 >> -- >> Ond?ej Sur? >> vedouc? v?zkumu/Head of R&D department >> ------------------------------------------- >> CZ.NIC, z.s.p.o. -- Laborato?e CZ.NIC >> Americka 23, 120 00 Praha 2, Czech Republic >> mailto:ondrej.sury@nic.cz http://nic.cz/ >> tel:+420.222745110 fax:+420.222745112 >> ------------------------------------------- >>=20 >>=20 -- Ond=C5=99ej Sur=C3=BD vedouc=C3=AD v=C3=BDzkumu/Head of R&D department ------------------------------------------- CZ.NIC, z.s.p.o. -- Laborato=C5=99e CZ.NIC Americka 23, 120 00 Praha 2, Czech Republic mailto:ondrej.sury@nic.cz http://nic.cz/ tel:+420.222745110 fax:+420.222745112 ------------------------------------------- From bounces-ietf-ssh-owner-secsh-tyoxbijeg7-archive=lists.ietf.org@NetBSD.org Sun Sep 4 23:11:28 2011 Return-Path: X-Original-To: ietfarch-secsh-tyoxbijeg7-archive@ietfa.amsl.com Delivered-To: ietfarch-secsh-tyoxbijeg7-archive@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 484D921F8541 for ; Sun, 4 Sep 2011 23:11:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.624 X-Spam-Level: X-Spam-Status: No, score=-1.624 tagged_above=-999 required=5 tests=[AWL=0.075, BAYES_00=-2.599, J_CHICKENPOX_32=0.6, MIME_8BIT_HEADER=0.3] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id c-gBzpjMnYxG for ; Sun, 4 Sep 2011 23:11:27 -0700 (PDT) Received: from mail.netbsd.org (ns.NetBSD.org [IPv6:2001:4f8:3:7::53]) by ietfa.amsl.com (Postfix) with ESMTP id 59EA421F8511 for ; Sun, 4 Sep 2011 23:11:27 -0700 (PDT) Received: by mail.netbsd.org (Postfix, from userid 605) id A125D14A1D8; Mon, 5 Sep 2011 06:13:09 +0000 (UTC) Delivered-To: ietf-ssh@netbsd.org Received: from localhost (localhost [127.0.0.1]) by mail.netbsd.org (Postfix) with ESMTP id 867EB14A1B4 for ; Mon, 5 Sep 2011 06:13:08 +0000 (UTC) X-Virus-Scanned: amavisd-new at NetBSD.org Received: from mail.netbsd.org ([127.0.0.1]) by localhost (mail.NetBSD.org [127.0.0.1]) (amavisd-new, port 10025) with ESMTP id p18hYKpNVUPu for ; Mon, 5 Sep 2011 06:13:08 +0000 (UTC) Received: from natsu.mindrot.org (natsu.mindrot.org [116.66.166.108]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.netbsd.org (Postfix) with ESMTPS id DFAFD14A1A5 for ; Mon, 5 Sep 2011 06:13:07 +0000 (UTC) Received: by natsu.mindrot.org (Postfix, from userid 1000) id CAECDC4AA9; Mon, 5 Sep 2011 16:13:05 +1000 (EST) Received: from localhost (localhost [127.0.0.1]) by natsu.mindrot.org (Postfix) with ESMTP id C5DFDC4AA7; Mon, 5 Sep 2011 16:13:05 +1000 (EST) Date: Mon, 5 Sep 2011 16:13:05 +1000 (EST) From: Damien Miller To: =?ISO-8859-2?Q?Ond=F8ej_Sur=FD?= cc: ietf-ssh@netbsd.org Subject: Re: Support for ECDSA and SHA-2 (SHA-256) in the SSHFP record In-Reply-To: Message-ID: References: User-Agent: Alpine 2.00 (BSO 1167 2008-08-23) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: ietf-ssh-owner@NetBSD.org List-Id: ietf-ssh.NetBSD.org Precedence: list On Mon, 5 Sep 2011, Ond?ej Sur? wrote: > Hi Damien, > > the implementation for OpenSSH is already done and working (see the > link to git named patch for vanilla 5.8 below in the first mail). sure, I noticed that in the original mail but I don't want to go ahead and merge it if other implementers have objections to the I-D. -d From bounces-ietf-ssh-owner-secsh-tyoxbijeg7-archive=lists.ietf.org@NetBSD.org Mon Sep 5 03:00:59 2011 Return-Path: X-Original-To: ietfarch-secsh-tyoxbijeg7-archive@ietfa.amsl.com Delivered-To: ietfarch-secsh-tyoxbijeg7-archive@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 14EC921F8B17 for ; Mon, 5 Sep 2011 03:00:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.977 X-Spam-Level: X-Spam-Status: No, score=-2.977 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OSaDdZwKRqG7 for ; Mon, 5 Sep 2011 03:00:58 -0700 (PDT) Received: from mail.netbsd.org (ns.NetBSD.org [IPv6:2001:4f8:3:7::53]) by ietfa.amsl.com (Postfix) with ESMTP id 70FE921F8B18 for ; Mon, 5 Sep 2011 03:00:58 -0700 (PDT) Received: by mail.netbsd.org (Postfix, from userid 605) id A006A14A202; Mon, 5 Sep 2011 10:02:38 +0000 (UTC) Delivered-To: ietf-ssh@netbsd.org Received: from localhost (localhost [127.0.0.1]) by mail.netbsd.org (Postfix) with ESMTP id 3D4B814A201 for ; Mon, 5 Sep 2011 10:02:37 +0000 (UTC) X-Virus-Scanned: amavisd-new at NetBSD.org Authentication-Results: mail.NetBSD.org (amavisd-new); dkim=pass header.i=@gmail.com Received: from mail.netbsd.org ([127.0.0.1]) by localhost (mail.NetBSD.org [127.0.0.1]) (amavisd-new, port 10025) with ESMTP id I9AOa80MFgmv for ; Mon, 5 Sep 2011 10:02:36 +0000 (UTC) Received: from mail-vw0-f52.google.com (mail-vw0-f52.google.com [209.85.212.52]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by mail.netbsd.org (Postfix) with ESMTPS id 86D8714A1FE for ; Mon, 5 Sep 2011 10:02:36 +0000 (UTC) Received: by vws16 with SMTP id 16so3963710vws.25 for ; Mon, 05 Sep 2011 03:02:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=mime-version:sender:in-reply-to:references:date :x-google-sender-auth:message-id:subject:from:to:cc:content-type; bh=p01M4Tj/xvyQMq7Gz87xwhDzL88QzHHtbD58B5G5oVg=; b=IUmGS4kYWaK60G5BUdrIXc/Dc84zVjVvQl//JCezM9U8cOy4TmmWwsfWa2p6w9LCC4 GZ8YsJoeVwaXibxC/b5L14SCAk8VUbMdj4GTeqcyiPhuL7ZE+b16IQsU3UgFlpDmakS3 5skB7oUgVzt28BXlu6w71OYgbPI8hYp3i4l+U= MIME-Version: 1.0 Received: by 10.52.37.111 with SMTP id x15mr57675vdj.16.1315216955493; Mon, 05 Sep 2011 03:02:35 -0700 (PDT) Received: by 10.52.182.39 with HTTP; Mon, 5 Sep 2011 03:02:35 -0700 (PDT) In-Reply-To: References: Date: Mon, 5 Sep 2011 11:02:35 +0100 X-Google-Sender-Auth: WfHFHID7YwR2DHh7RnKBmugchmk Message-ID: Subject: Re: Fwd: Support for ECDSA and SHA-2 (SHA-256) in the SSHFP record From: Ben Laurie To: Damien Miller Cc: =?UTF-8?B?T25kxZllaiBTdXLDvQ==?= , ietf-ssh@netbsd.org Content-Type: text/plain; charset=ISO-8859-1 Sender: ietf-ssh-owner@NetBSD.org List-Id: ietf-ssh.NetBSD.org Precedence: list On Mon, Sep 5, 2011 at 2:16 AM, Damien Miller wrote: > > Did anyone on this list have any comment on > https://tools.ietf.org/html/draft-os-ietf-sshfp-ecdsa-sha2 Makes sense to me _except_ it refers to RFC 4255 for the format of the resource record, and implicitly for the calculation of the fingerprint. RFC 4255 refers to RFC 4253 for the fingerprint calculation. However, 4253 doesn't mention fingerprints at all. Or I'm missing something. Anyway, bottom line is I don't know how to calculate the fingerprint :-) From bounces-ietf-ssh-owner-secsh-tyoxbijeg7-archive=lists.ietf.org@NetBSD.org Mon Sep 5 03:10:28 2011 Return-Path: X-Original-To: ietfarch-secsh-tyoxbijeg7-archive@ietfa.amsl.com Delivered-To: ietfarch-secsh-tyoxbijeg7-archive@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 756E221F8B4D for ; Mon, 5 Sep 2011 03:10:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.699 X-Spam-Level: X-Spam-Status: No, score=-1.699 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, J_CHICKENPOX_23=0.6, MIME_8BIT_HEADER=0.3] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GSA7avJGv0mM for ; Mon, 5 Sep 2011 03:10:24 -0700 (PDT) Received: from mail.netbsd.org (ns.NetBSD.org [IPv6:2001:4f8:3:7::53]) by ietfa.amsl.com (Postfix) with ESMTP id 4A42721F8B2E for ; Mon, 5 Sep 2011 03:10:24 -0700 (PDT) Received: by mail.netbsd.org (Postfix, from userid 605) id 0CD8114A206; Mon, 5 Sep 2011 10:12:02 +0000 (UTC) Delivered-To: ietf-ssh@netbsd.org Received: from localhost (localhost [127.0.0.1]) by mail.netbsd.org (Postfix) with ESMTP id 13DB114A205 for ; Mon, 5 Sep 2011 10:11:59 +0000 (UTC) X-Virus-Scanned: amavisd-new at NetBSD.org Authentication-Results: mail.NetBSD.org (amavisd-new); dkim=pass header.i=@nic.cz Received: from mail.netbsd.org ([127.0.0.1]) by localhost (mail.NetBSD.org [127.0.0.1]) (amavisd-new, port 10025) with ESMTP id HXCF8hTb0Q2a for ; Mon, 5 Sep 2011 10:11:58 +0000 (UTC) Received: from mail.nic.cz (mail.nic.cz [IPv6:2001:1488:800:400::400]) by mail.netbsd.org (Postfix) with ESMTP id 30B2414A1FE for ; Mon, 5 Sep 2011 10:11:58 +0000 (UTC) Received: from kimac.office.nic.cz (fw.nic.cz [217.31.207.1]) by mail.nic.cz (Postfix) with ESMTPSA id 305932A2CA7; Mon, 5 Sep 2011 12:11:57 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nic.cz; s=default; t=1315217517; bh=EoNoWsJsWYCw/rT/FDGdRfE1zpRLab/awvEMCYPlsgs=; h=Subject:Mime-Version:Content-Type:From:In-Reply-To:Date:Cc: Content-Transfer-Encoding:Message-Id:References:To; b=K0m/3VdjbnJSUuKzIRtqW7zmZR0RpwhMdo3iFmLvNuBVZ94K7FlAbRF1uC9mquB8O lGe/x2adBT6PnyQzQnn5P2JKxpyQAJSQ4xyEA/1hWfXjiLhkvO0AGrktiteXYz4Sjk ZuvZnHuSr5L0RFO+nz3lG30iyLbOcWlhfbglnAKw= Subject: Re: Support for ECDSA and SHA-2 (SHA-256) in the SSHFP record Mime-Version: 1.0 (Apple Message framework v1244.3) Content-Type: text/plain; charset=utf-8 From: =?utf-8?Q?Ond=C5=99ej_Sur=C3=BD?= In-Reply-To: Date: Mon, 5 Sep 2011 12:11:56 +0200 Cc: Damien Miller , ietf-ssh@netbsd.org Content-Transfer-Encoding: quoted-printable Message-Id: <9E3F5124-3516-40C4-9A5F-51EB9A6652FB@nic.cz> References: To: Ben Laurie , Jakob Schlyter X-Mailer: Apple Mail (2.1244.3) X-Virus-Scanned: clamav-milter 0.96.5 at mail X-Virus-Status: Clean Sender: ietf-ssh-owner@NetBSD.org List-Id: ietf-ssh.NetBSD.org Precedence: list Hi Ben, On 5. 9. 2011, at 12:02, Ben Laurie wrote: > On Mon, Sep 5, 2011 at 2:16 AM, Damien Miller wrote: >>=20 >> Did anyone on this list have any comment on >> https://tools.ietf.org/html/draft-os-ietf-sshfp-ecdsa-sha2 >=20 > Makes sense to me _except_ it refers to RFC 4255 for the format of the > resource record, and implicitly for the calculation of the > fingerprint. RFC 4255 refers to RFC 4253 for the fingerprint > calculation. However, 4253 doesn't mention fingerprints at all. Or I'm > missing something. I think that 4255 refers to 4253 for "public key blob" and not = calculating the fingerprint. > Anyway, bottom line is I don't know how to calculate the fingerprint = :-) Looks like the RFC4255 #3.1.3 could be more clearer than: The message-digest algorithm is presumed to produce an opaque octet string output, which is placed as-is in the RDATA fingerprint field. But the question is - is it worth updating in this particular I-D? = Isn't this more an errata for RFC4255 type of update? I don't mind adding a paragraph or two about the calculation of the = fingerprint, but it seems to be awfully close to our legislation process when you can = update non-related law as an attachment to an different law. And this scares = me. Ccing Jakob as an author of RFC4255. O. -- Ond=C5=99ej Sur=C3=BD vedouc=C3=AD v=C3=BDzkumu/Head of R&D department ------------------------------------------- CZ.NIC, z.s.p.o. -- Laborato=C5=99e CZ.NIC Americka 23, 120 00 Praha 2, Czech Republic mailto:ondrej.sury@nic.cz http://nic.cz/ tel:+420.222745110 fax:+420.222745112 ------------------------------------------- From bounces-ietf-ssh-owner-secsh-tyoxbijeg7-archive=lists.ietf.org@NetBSD.org Mon Sep 5 04:11:20 2011 Return-Path: X-Original-To: ietfarch-secsh-tyoxbijeg7-archive@ietfa.amsl.com Delivered-To: ietfarch-secsh-tyoxbijeg7-archive@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B187B21F8B22 for ; Mon, 5 Sep 2011 04:11:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.527 X-Spam-Level: X-Spam-Status: No, score=-2.527 tagged_above=-999 required=5 tests=[AWL=-0.450, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, J_CHICKENPOX_23=0.6, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EgGTQu11xKmD for ; Mon, 5 Sep 2011 04:11:16 -0700 (PDT) Received: from mail.netbsd.org (ns.NetBSD.org [IPv6:2001:4f8:3:7::53]) by ietfa.amsl.com (Postfix) with ESMTP id C112321F8B0A for ; Mon, 5 Sep 2011 04:11:08 -0700 (PDT) Received: by mail.netbsd.org (Postfix, from userid 605) id 5A36D14A202; Mon, 5 Sep 2011 11:12:49 +0000 (UTC) Delivered-To: ietf-ssh@netbsd.org Received: from localhost (localhost [127.0.0.1]) by mail.netbsd.org (Postfix) with ESMTP id 8B0F614A20A for ; Mon, 5 Sep 2011 11:12:45 +0000 (UTC) X-Virus-Scanned: amavisd-new at NetBSD.org Authentication-Results: mail.NetBSD.org (amavisd-new); dkim=pass header.i=@gmail.com Received: from mail.netbsd.org ([127.0.0.1]) by localhost (mail.NetBSD.org [127.0.0.1]) (amavisd-new, port 10025) with ESMTP id fMrguPhxG7Gh for ; Mon, 5 Sep 2011 11:12:44 +0000 (UTC) Received: from mail-vx0-f180.google.com (mail-vx0-f180.google.com [209.85.220.180]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by mail.netbsd.org (Postfix) with ESMTPS id 8F51B14A1F7 for ; Mon, 5 Sep 2011 11:12:44 +0000 (UTC) Received: by vxh15 with SMTP id 15so3881797vxh.25 for ; Mon, 05 Sep 2011 04:12:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=mime-version:sender:in-reply-to:references:date :x-google-sender-auth:message-id:subject:from:to:cc:content-type :content-transfer-encoding; bh=JYUbhmwrfo2SZbyXCDunr73N7ZWZt7t81WsRgSffcok=; b=U11xJDawNfTKgWgFRuDCuZYHUBIMPNVPW6hkvnjykr2VinUgegYYDKKcYCmikziwWN r+aJELtKTl1Shks4a4URqCsmNDfVXv9VUIZ+LivscRj5M9yUs16ie5VaKl4gQKebgNql IUhDvYWxOSZqq7VeXyFn351OwaNkaPtVhGGSE= MIME-Version: 1.0 Received: by 10.52.66.70 with SMTP id d6mr3756377vdt.351.1315221163539; Mon, 05 Sep 2011 04:12:43 -0700 (PDT) Received: by 10.52.182.39 with HTTP; Mon, 5 Sep 2011 04:12:43 -0700 (PDT) In-Reply-To: <9E3F5124-3516-40C4-9A5F-51EB9A6652FB@nic.cz> References: <9E3F5124-3516-40C4-9A5F-51EB9A6652FB@nic.cz> Date: Mon, 5 Sep 2011 12:12:43 +0100 X-Google-Sender-Auth: hkLvKSZ4EuhMuo1ipZCT3ud2H90 Message-ID: Subject: Re: Support for ECDSA and SHA-2 (SHA-256) in the SSHFP record From: Ben Laurie To: =?UTF-8?B?T25kxZllaiBTdXLDvQ==?= Cc: Jakob Schlyter , Damien Miller , ietf-ssh@netbsd.org Content-Type: text/plain; charset=ISO-8859-2 Content-Transfer-Encoding: quoted-printable Sender: ietf-ssh-owner@NetBSD.org List-Id: ietf-ssh.NetBSD.org Precedence: list On Mon, Sep 5, 2011 at 11:11 AM, Ond=F8ej Sur=FD wrote= : > Hi Ben, > > On 5. 9. 2011, at 12:02, Ben Laurie wrote: >> On Mon, Sep 5, 2011 at 2:16 AM, Damien Miller wrote: >>> >>> Did anyone on this list have any comment on >>> https://tools.ietf.org/html/draft-os-ietf-sshfp-ecdsa-sha2 >> >> Makes sense to me _except_ it refers to RFC 4255 for the format of the >> resource record, and implicitly for the calculation of the >> fingerprint. RFC 4255 refers to RFC 4253 for the fingerprint >> calculation. However, 4253 doesn't mention fingerprints at all. Or I'm >> missing something. > > I think that 4255 refers to 4253 for "public key blob" and not calculatin= g > the fingerprint. Well, OK, but "public key blob" does not appear in 4253 either. And even if it did, it would not be completely obvious how to calculate the fingerprint from it (presumably just feed the bytes to the hash algorithm, but...) > >> Anyway, bottom line is I don't know how to calculate the fingerprint :-) > > > Looks like the RFC4255 #3.1.3 could be more clearer than: > > =A0 The message-digest algorithm is presumed to produce an opaque octet > =A0 string output, which is placed as-is in the RDATA fingerprint field. > > But the question is - is it worth updating in this particular I-D? =A0Isn= 't > this more an errata for RFC4255 type of update? Yes. > I don't mind adding a paragraph or two about the calculation of the finge= rprint, > but it seems to be awfully close to our legislation process when you can = update > non-related law as an attachment to an different law. =A0And this scares = me. > > Ccing Jakob as an author of RFC4255. > > O. > -- > =A0Ond=F8ej Sur=FD > =A0vedouc=ED v=FDzkumu/Head of R&D department > =A0------------------------------------------- > =A0CZ.NIC, z.s.p.o. =A0 =A0-- =A0 =A0Laborato=F8e CZ.NIC > =A0Americka 23, 120 00 Praha 2, Czech Republic > =A0mailto:ondrej.sury@nic.cz =A0 =A0http://nic.cz/ > =A0tel:+420.222745110 =A0 =A0 =A0 fax:+420.222745112 > =A0------------------------------------------- > > From bounces-ietf-ssh-owner-secsh-tyoxbijeg7-archive=lists.ietf.org@NetBSD.org Mon Sep 5 04:19:38 2011 Return-Path: X-Original-To: ietfarch-secsh-tyoxbijeg7-archive@ietfa.amsl.com Delivered-To: ietfarch-secsh-tyoxbijeg7-archive@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7601221F8B23 for ; Mon, 5 Sep 2011 04:19:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.699 X-Spam-Level: X-Spam-Status: No, score=-1.699 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, J_CHICKENPOX_23=0.6, MIME_8BIT_HEADER=0.3] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KbIyC2AgLsGh for ; Mon, 5 Sep 2011 04:19:33 -0700 (PDT) Received: from mail.netbsd.org (ns.NetBSD.org [IPv6:2001:4f8:3:7::53]) by ietfa.amsl.com (Postfix) with ESMTP id 858D421F8A66 for ; Mon, 5 Sep 2011 04:19:33 -0700 (PDT) Received: by mail.netbsd.org (Postfix, from userid 605) id 0104614A21F; Mon, 5 Sep 2011 11:21:15 +0000 (UTC) Delivered-To: ietf-ssh@netbsd.org Received: from localhost (localhost [127.0.0.1]) by mail.netbsd.org (Postfix) with ESMTP id 53CCB14A217 for ; Mon, 5 Sep 2011 11:21:12 +0000 (UTC) X-Virus-Scanned: amavisd-new at NetBSD.org Authentication-Results: mail.NetBSD.org (amavisd-new); dkim=pass header.i=@nic.cz Received: from mail.netbsd.org ([127.0.0.1]) by localhost (mail.NetBSD.org [127.0.0.1]) (amavisd-new, port 10025) with ESMTP id QROKbTXzSvNI for ; Mon, 5 Sep 2011 11:21:11 +0000 (UTC) Received: from mail.nic.cz (mail.nic.cz [IPv6:2001:1488:800:400::400]) by mail.netbsd.org (Postfix) with ESMTP id 8964114A215 for ; Mon, 5 Sep 2011 11:21:11 +0000 (UTC) Received: from kimac.office.nic.cz (fw.nic.cz [217.31.207.1]) by mail.nic.cz (Postfix) with ESMTPSA id 0FCB52A2CA9; Mon, 5 Sep 2011 13:21:10 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=nic.cz; s=default; t=1315221670; bh=b9BrhGsENQzwdF/K7n59pFMH2+UnzImAsvUKIS1nOGg=; h=Subject:Mime-Version:Content-Type:From:In-Reply-To:Date:Cc: Content-Transfer-Encoding:Message-Id:References:To; b=m2RY0fw09n3pkcBjzvb2hyJL6YaPOoa1IDWWhmtRmirS6cX7h6xyD70avdYmZzubD e07u32SFXkg8aFgPjiI3M3xZSCsCIV30LahSUIAzr2p1qSsVqUqoECZUt+MAbYIXpe 8WycDj/9yR5JE0sa4VwQELbArZuUXml+X2oZBRwU= Subject: Re: Support for ECDSA and SHA-2 (SHA-256) in the SSHFP record Mime-Version: 1.0 (Apple Message framework v1244.3) Content-Type: text/plain; charset=iso-8859-2 From: =?utf-8?Q?Ond=C5=99ej_Sur=C3=BD?= In-Reply-To: Date: Mon, 5 Sep 2011 13:21:09 +0200 Cc: Jakob Schlyter , ietf-ssh@netbsd.org Content-Transfer-Encoding: quoted-printable Message-Id: References: <9E3F5124-3516-40C4-9A5F-51EB9A6652FB@nic.cz> To: Ben Laurie X-Mailer: Apple Mail (2.1244.3) X-Virus-Scanned: clamav-milter 0.96.5 at mail X-Virus-Status: Clean Sender: ietf-ssh-owner@NetBSD.org List-Id: ietf-ssh.NetBSD.org Precedence: list On 5. 9. 2011, at 13:12, Ben Laurie wrote: > On Mon, Sep 5, 2011 at 11:11 AM, Ond=F8ej Sur=FD = wrote: >>=20 >> But the question is - is it worth updating in this particular I-D? = Isn't >> this more an errata for RFC4255 type of update? >=20 > Yes. Yes what? :) Yes to update it in ECDSA I-D? or Yes to do an errata / bis of RFC4255? O. -- Ond=F8ej Sur=FD vedouc=ED v=FDzkumu/Head of R&D department ------------------------------------------- CZ.NIC, z.s.p.o. -- Laborato=F8e CZ.NIC Americka 23, 120 00 Praha 2, Czech Republic mailto:ondrej.sury@nic.cz http://nic.cz/ tel:+420.222745110 fax:+420.222745112 ------------------------------------------- From bounces-ietf-ssh-owner-secsh-tyoxbijeg7-archive=lists.ietf.org@NetBSD.org Mon Sep 5 04:24:03 2011 Return-Path: X-Original-To: ietfarch-secsh-tyoxbijeg7-archive@ietfa.amsl.com Delivered-To: ietfarch-secsh-tyoxbijeg7-archive@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3DC7221F8B23 for ; Mon, 5 Sep 2011 04:24:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.602 X-Spam-Level: X-Spam-Status: No, score=-2.602 tagged_above=-999 required=5 tests=[AWL=0.075, BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OBH6BTWxNDyw for ; Mon, 5 Sep 2011 04:24:02 -0700 (PDT) Received: from mail.netbsd.org (ns.NetBSD.org [IPv6:2001:4f8:3:7::53]) by ietfa.amsl.com (Postfix) with ESMTP id B7B1821F8B10 for ; Mon, 5 Sep 2011 04:24:02 -0700 (PDT) Received: by mail.netbsd.org (Postfix, from userid 605) id 58BAB14A225; Mon, 5 Sep 2011 11:25:46 +0000 (UTC) Delivered-To: ietf-ssh@netbsd.org Received: from localhost (localhost [127.0.0.1]) by mail.netbsd.org (Postfix) with ESMTP id 36C5914A223 for ; Mon, 5 Sep 2011 11:25:44 +0000 (UTC) X-Virus-Scanned: amavisd-new at NetBSD.org Authentication-Results: mail.NetBSD.org (amavisd-new); dkim=pass header.i=@gmail.com Received: from mail.netbsd.org ([127.0.0.1]) by localhost (mail.NetBSD.org [127.0.0.1]) (amavisd-new, port 10025) with ESMTP id DhbHEKUEKxM2 for ; Mon, 5 Sep 2011 11:25:43 +0000 (UTC) Received: from mail-vx0-f180.google.com (mail-vx0-f180.google.com [209.85.220.180]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by mail.netbsd.org (Postfix) with ESMTPS id 7AF3114A21E for ; Mon, 5 Sep 2011 11:25:43 +0000 (UTC) Received: by vxh15 with SMTP id 15so3889140vxh.25 for ; Mon, 05 Sep 2011 04:25:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=mime-version:sender:in-reply-to:references:date :x-google-sender-auth:message-id:subject:from:to:cc:content-type :content-transfer-encoding; bh=KcWY4VLBbOjja87S4IiVQtLtWzE+SIpJucGaOlSFve4=; b=tHo3/yuo4nRY3Prtr7MsqsT4yLt8OB8i764HL9eTuwNmIW/s2ypNp1avuSZKntUYEq gwGGX1iVX1M2KkgioLcOWRF0dGMit0lufgvdna6c4mJAljvi3kn/FLO/Qe3XLoWLFcYK nHAuJlwrO9xyxxYplQZCSuiiKkFJoEuLO8n14= MIME-Version: 1.0 Received: by 10.52.69.177 with SMTP id f17mr419544vdu.150.1315221942499; Mon, 05 Sep 2011 04:25:42 -0700 (PDT) Received: by 10.52.182.39 with HTTP; Mon, 5 Sep 2011 04:25:42 -0700 (PDT) In-Reply-To: References: <9E3F5124-3516-40C4-9A5F-51EB9A6652FB@nic.cz> Date: Mon, 5 Sep 2011 12:25:42 +0100 X-Google-Sender-Auth: xD-W4rvBKqUXvi_SqLleJoCURYc Message-ID: Subject: Re: Support for ECDSA and SHA-2 (SHA-256) in the SSHFP record From: Ben Laurie To: =?ISO-8859-2?Q?Ond=F8ej_Sur=FD?= Cc: Jakob Schlyter , ietf-ssh@netbsd.org Content-Type: text/plain; charset=ISO-8859-2 Content-Transfer-Encoding: quoted-printable Sender: ietf-ssh-owner@NetBSD.org List-Id: ietf-ssh.NetBSD.org Precedence: list 2011/9/5 Ond=F8ej Sur=FD : > > On 5. 9. 2011, at 13:12, Ben Laurie wrote: > >> On Mon, Sep 5, 2011 at 11:11 AM, Ond=F8ej Sur=FD wr= ote: >>> >>> But the question is - is it worth updating in this particular I-D? =A0I= sn't >>> this more an errata for RFC4255 type of update? >> >> Yes. > > > Yes what? :) > > Yes to update it in ECDSA I-D? > > or > > Yes to do an errata / bis of RFC4255? The latter.