From bounces-ietf-ssh-owner-secsh-tyoxbijeg7-archive=lists.ietf.org@NetBSD.org Tue Mar 1 02:08:39 2016 Return-Path: X-Original-To: ietfarch-secsh-tyoxbijeg7-archive@ietfa.amsl.com Delivered-To: ietfarch-secsh-tyoxbijeg7-archive@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 133681B3E3B for ; Tue, 1 Mar 2016 02:08:39 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.907 X-Spam-Level: X-Spam-Status: No, score=-1.907 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.006, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YTXjdmGkvLDE for ; Tue, 1 Mar 2016 02:08:37 -0800 (PST) Received: from mail.netbsd.org (mail.NetBSD.org [IPv6:2001:470:a085:999::25]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E9A551B3E42 for ; Tue, 1 Mar 2016 02:08:36 -0800 (PST) Received: by mail.netbsd.org (Postfix, from userid 605) id F3D7785F27; Tue, 1 Mar 2016 10:08:35 +0000 (UTC) Delivered-To: ietf-ssh@netbsd.org Received: from localhost (localhost [127.0.0.1]) by mail.netbsd.org (Postfix) with ESMTP id 2F15185F31 for ; Tue, 1 Mar 2016 10:08:34 +0000 (UTC) X-Virus-Scanned: amavisd-new at netbsd.org Received: from mail.netbsd.org ([IPv6:::1]) by localhost (mail.netbsd.org [IPv6:::1]) (amavisd-new, port 10025) with ESMTP id KXVOEug6mZjo for ; Tue, 1 Mar 2016 10:08:33 +0000 (UTC) Received: from duva.sjd.se (duva.sjd.se [IPv6:2001:9b0:1:1702::100]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.netbsd.org (Postfix) with ESMTPS id 4300B85EB7 for ; Tue, 1 Mar 2016 10:08:31 +0000 (UTC) Received: from latte.josefsson.org ([155.4.17.2]) (authenticated bits=0) by duva.sjd.se (8.14.4/8.14.4/Debian-4) with ESMTP id u21A8Esr006641 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=NOT); Tue, 1 Mar 2016 11:08:16 +0100 X-Hashcash: 1:22:160301:ietf-ssh@netbsd.org::BjAeJqkG0faS13N7:UJNA X-Hashcash: 1:22:160301:curdle@ietf.org::4lRuAGJlEinKGxpz:dDri From: Simon Josefsson To: ietf-ssh@netbsd.org, curdle@ietf.org Subject: draft-josefsson-ssh-curves-04 OpenPGP: id=54265E8C; url=http://josefsson.org/54265e8c.txt Date: Tue, 01 Mar 2016 11:08:13 +0100 Message-ID: <8737satss2.fsf@latte.josefsson.org> User-Agent: Gnus/5.130014 (Ma Gnus v0.14) Emacs/24.4 (gnu/linux) MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha256; protocol="application/pgp-signature" X-Virus-Scanned: clamav-milter 0.98.7 at duva.sjd.se X-Virus-Status: Clean Sender: ietf-ssh-owner@NetBSD.org List-Id: ietf-ssh.NetBSD.org Precedence: list --=-=-= Content-Type: text/plain All, I have updated ssh-curves to use SHA-512 for Curve448 as requested by several people. We are waiting for a Curve448 implementation to confirm that the description is correct. Otherwise I am not aware of any open issues with the document. All feedback is welcome. https://tools.ietf.org/html/draft-josefsson-ssh-curves-04 Thanks, /Simon --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQEcBAEBCAAGBQJW1WoNAAoJEIYLf7sy+BGdqPkH/2tDViZg1PektBLBP7466ltc aEO8Dbc+71pcOdjl7ayhJjkwrP9fYZt6TM/20hpTsNH++wil7fUo5jlk5vYngP9O 6xNqMJQ672krJKdk8hm63L7g65B9ChteBgPsadKFb6GCK9rKkVLLlPBRnpqL+DRs 4pqt+qIr4zJDiWOf2i0BppnJDkzIWHV08uLZRFf0SDltsVZnlc+z+hIvCHalBoif GdAZLW6xNaSCNzweKdFXWY7tcaZtMRnSXPQdH/VD/wj+dsAAa1AJPd9ArXBdwIu4 gMldNcxNLVSoCAYQLrzyKQqgTBUbN/BRq5xO32cN0ladRwJTDp/FO5BOpKoloGE= =KMHd -----END PGP SIGNATURE----- --=-=-=-- From bounces-ietf-ssh-owner-secsh-tyoxbijeg7-archive=lists.ietf.org@NetBSD.org Tue Mar 1 06:52:01 2016 Return-Path: X-Original-To: ietfarch-secsh-tyoxbijeg7-archive@ietfa.amsl.com Delivered-To: ietfarch-secsh-tyoxbijeg7-archive@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 34BC81A9107 for ; Tue, 1 Mar 2016 06:52:01 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.907 X-Spam-Level: X-Spam-Status: No, score=-1.907 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.006, SPF_PASS=-0.001] autolearn=unavailable Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EUHlWz42_TTV for ; Tue, 1 Mar 2016 06:51:57 -0800 (PST) Received: from mail.netbsd.org (mail.NetBSD.org [IPv6:2001:470:a085:999::25]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id B38D11A8B84 for ; Tue, 1 Mar 2016 06:51:57 -0800 (PST) Received: by mail.netbsd.org (Postfix, from userid 605) id 7700D85EDA; Tue, 1 Mar 2016 14:51:56 +0000 (UTC) Delivered-To: ietf-ssh@NetBSD.org Received: from localhost (localhost [127.0.0.1]) by mail.netbsd.org (Postfix) with ESMTP id D463B85ECD for ; Tue, 1 Mar 2016 14:51:53 +0000 (UTC) X-Virus-Scanned: amavisd-new at netbsd.org Received: from mail.netbsd.org ([IPv6:::1]) by localhost (mail.netbsd.org [IPv6:::1]) (amavisd-new, port 10025) with ESMTP id 1kovjECRrsms for ; Tue, 1 Mar 2016 14:51:53 +0000 (UTC) Received: from na01-bl2-obe.outbound.protection.outlook.com (mail-bl2on0719.outbound.protection.outlook.com [IPv6:2a01:111:f400:fc09::719]) by mail.netbsd.org (Postfix) with ESMTP id 46C1B85EA7 for ; Tue, 1 Mar 2016 14:51:49 +0000 (UTC) Received: from BY1PR0501CA0006.namprd05.prod.outlook.com (10.162.139.16) by BY1PR0501MB1605.namprd05.prod.outlook.com (10.160.203.154) with Microsoft SMTP Server (TLS) id 15.1.415.20; Tue, 1 Mar 2016 14:51:47 +0000 Received: from BN1BFFO11FD034.protection.gbl (2a01:111:f400:7c10::1:120) by BY1PR0501CA0006.outlook.office365.com (2a01:111:e400:4821::16) with Microsoft SMTP Server (TLS) id 15.1.427.16 via Frontend Transport; Tue, 1 Mar 2016 14:51:46 +0000 Authentication-Results: spf=softfail (sender IP is 66.129.239.19) smtp.mailfrom=juniper.net; ietf.org; dkim=none (message not signed) header.d=none;ietf.org; dmarc=none action=none header.from=juniper.net; Received-SPF: SoftFail (protection.outlook.com: domain of transitioning juniper.net discourages use of 66.129.239.19 as permitted sender) Received: from p-emfe01b-sac.jnpr.net (66.129.239.19) by BN1BFFO11FD034.mail.protection.outlook.com (10.58.144.97) with Microsoft SMTP Server (TLS) id 15.1.427.7 via Frontend Transport; Tue, 1 Mar 2016 14:51:46 +0000 Received: from magenta.juniper.net (172.17.27.123) by p-emfe01b-sac.jnpr.net (172.24.192.21) with Microsoft SMTP Server (TLS) id 14.3.123.3; Tue, 1 Mar 2016 06:51:39 -0800 Received: from eng-mail01.juniper.net (eng-mail01.juniper.net [172.17.28.114]) by magenta.juniper.net (8.11.3/8.11.3) with ESMTP id u21EpcD48418; Tue, 1 Mar 2016 06:51:38 -0800 (PST) (envelope-from mdb@juniper.net) Received: from eng-mail01.juniper.net (localhost [127.0.0.1]) by eng-mail01.juniper.net (Postfix) with ESMTP id ADF431144F; Tue, 1 Mar 2016 06:51:37 -0800 (PST) To: , From: "Mark D. Baushke" Subject: draft-baushke-ssh-dh-group-sha2-06 X-Phone: +1 408 745-2952 (Work) MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha1; protocol="application/pgp-signature" Date: Tue, 1 Mar 2016 06:51:37 -0800 Message-ID: <84277.1456843897@eng-mail01.juniper.net> X-EOPAttributedMessage: 0 X-Forefront-Antispam-Report: CPI:66.129.239.19;IPV:NLI;CTRY:US;EFV:NLI;SFV:NSPM;SFS:(10019020)(6009001)(2980300002)(189002)(164054003)(199003)(54356999)(50986999)(189998001)(76506005)(53416004)(5000100001)(15975445007)(77096005)(117636001)(87936001)(230783001)(6806005)(106466001)(1220700001)(1096002)(5001770100001)(586003)(2810700001)(19580395003)(229853001)(105596002)(11100500001)(92566002)(107886002)(5001960100003)(84326002)(2906002)(86362001)(5003600100002)(81156008)(42262002);DIR:OUT;SFP:1102;SCL:1;SRVR:BY1PR0501MB1605;H:p-emfe01b-sac.jnpr.net;FPR:;SPF:SoftFail;MLV:sfv;MX:1;A:1;LANG:en; X-Microsoft-Exchange-Diagnostics: 1;BN1BFFO11FD034;1:slJPd0Wv6Xf9cmXDiVmCFbRBWppEHgm2yh7VBM7LO0sUGoA/HMk+dEpABeiAEC/BBhlZUwVzsmKuwyY5lxpQ2nmbNUwNug2RA9XkupSkSUUyhEOgb4mfZMSfkdEl3VCPCDCZIKkW2PP2X0YDt+IEVH/wpxdHvOjp4FA0nHoKUvhyjWxrPvY53ekUZEQRXNcre3oh1ftibqAKwJ/c1/vVFTPbM28WS+hZNiyrCfowT+6kjzcE+DiZxxJwlddp8Tj3eeqh/MvtJoLj3gcZqjLbsqc4NKwR2/2/Vd2ql76pdEoVjY2rRXi7n0RxYQm084r1qLiBu21RSMGx55xMY/Fc+yfHHXzeBdHZk+/J+RbZujUnrRITczp7zIFbuOZLj/zx0RkLGcqcu9N7WVL+cv7Bhrf/uU8vRrerLZZxw4QxqnjMQAhNowjFjgU9mSWFTz1+s7HdsO3OFEymcj233AhD6g== X-Microsoft-Exchange-Diagnostics: 1;BY1PR0501MB1605;2:yPvCAFOPTDRsLKh/MfoApq91gdzw3pdk6l5yvFiFND737sPtdD0HBqENeK0ZR51h4wVJna5LcOJbvgAjzp5nF0wWZ3Ma66bYnZOHf5EFuWE61nPQZKnBcVzGYMdLv20qj6pSHeZBphPkPFnb5t/2lg==;3:8Lr+EeogEevkbnmonMp9DIxlBWz3hpD+DfjhT5pm9wLGXyamon7mrRRm8QZL6ZPAODqZL18WnkjabLG9gKCcE+j9XvlTClzLNbrv89XV3kYXIkeuFWSckwnN4+SkCd0F227uF3BFrqdCS5cC/FrsN/g6Akx5jWyYzhYHqqQMSZs=;25:gLR2U8OQ1cSxL9/iuKr3Psb5AmzPEM77lnWBZBHZXv999y8CIrGJvrDTS6s0WHahKgpEYx9Its4gQ4DieYpwFnL9ms9mNp/cG9RJVwc4RvDn50CfDRyVdvyPwvCnbB2Vo4M/eMRRQ3w/r4uQBRYxKJ8ufDQWjcrN6zZxMKvGWf/eSmW6t9BpZ5pv5zJRvgnWCpsqG1E5M6v2RT/hyeMme60q+t/loPIxwSArVZ7sDNrOYVOk8AwMQiSZWnnHIkrnjBFJSM4Re6OVnwfPs6DU6RUw36jz49dvQP4/uEbJE9FjcNchHsVmRu+8dBv3w8wvAdOhwSIsZvk2N5FnM2B5Fw== X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:BY1PR0501MB1605; X-MS-Office365-Filtering-Correlation-Id: 85e49622-55bd-4794-ba14-08d341e10305 X-Microsoft-Exchange-Diagnostics: 1;BY1PR0501MB1605;20:VqPDeaMVyIzXMFlitY1Pj1+bqRpC7J9IkHgP7IRhxKDVL/YZQxr1TZI2GQNPdh25dvVzztdRTQYpvtWti1BYwhp5UBl2DFVkSVCSh6bn4yYNTZbloYhiwsPWr1ooZwnmu1Q706CIOvBYluTrLXP0Iqh2DpAb66yP86XGJh3BByn54Sork4i4nS2syWZdR0suwEbG8LrRnsrV9tiaZPPqq73YmoWSxw8wt1uRrbd2A4T39/OgSI4SlgUUmBriOD+IxnfBar9Z4eh8Z/Fb8EDdDF63DabgE8+mTIgfqMHs7fDKIAv2yZViEqDVW1ikNxA4m9w8jI+5feGVe1H+hP0Oxy3JwdqmgaeDEJP10cNZiKy0Yzf35rL2uXwtZK/rz8lNYO/Xwwe1e0MNsFR3Sn/0X5aY/fK3zcLfCV+k1r+VlmNMVD79rYIYHoDB6NpzSXsmq6e3XepHd7VkDUNOfyCWo/jfozsZyNs67i4vIXIEY7VS+RGFGmm3Q13/g/MQKdnf X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:; X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(601004)(2401047)(13024025)(8121501046)(13018025)(13015025)(13017025)(13023025)(5005006)(10201501046)(3002001);SRVR:BY1PR0501MB1605;BCL:0;PCL:0;RULEID:;SRVR:BY1PR0501MB1605; X-Microsoft-Exchange-Diagnostics: 1;BY1PR0501MB1605;4:bRroAbkJTRomYj9tiZ0Il8uD1w06ofLKqCvK1h7hF6BAaMsR6+L+JARllxiOIBhgYJifRU5zfyJufENu6GzvZheA53ZsIAKBulD41v3xP8LoyU7wecsN4fv7Zi8bOHnqNbxp+IgdsnhW6cJ/r5FMrCtb1kMZXlDJI1yV/FJBk6tMPwIb0etM1RMHXuuIrrTs9l71yMeh8p1ywteYFM+oHPBJxs5jG3vXNRQsYUOQQlFDLHvlO7z82yFl+xTugbxpwzT1qS6PAX1WUhWwnAD49Fx0O/jaiavL3+sN8dynRerabZOrJvS8KSU8a4906UUpkENV/SzAfM0BsMAlmnz4xeDMsh0vn19XKDuW5oOpXpi44SVo/xwEeXYRRS3bWSsEQDH4nQ7ICZYxDQp5xmH3eu2CaAAVSTPS/n4VVvFdyZSPXaGCCK7MNUT5hHDqz5CS/y21FNLEVJvKD83mPwWixw== X-Forefront-PRVS: 086831DFB4 X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1;BY1PR0501MB1605;23:diT1AYYvRl7s7YWaMVlgYvRfq/VqP3d6LsTrUVp?= =?us-ascii?Q?YClDNxEsYpfOIkJk+wk0FzVvL/2nahlKgNb/uC/IsCRdjoWm63DR3lmUj2Ok?= =?us-ascii?Q?5TcoCdZemrSOqPWaDpr31kiYaScpCOYjsDeoLW7SYkb3k4skJg6VE3GU8+dS?= =?us-ascii?Q?jDbMn86bpsu04eXYTS5EgB0jdW7bejJiuBlb35rYAQWmmZs1f4Nu64hdQxrr?= =?us-ascii?Q?4N5CExenepwBdn20AfLe80k76TDXiqBYLtsDh5+JzymldmmXJNmQrwOt6N9q?= =?us-ascii?Q?8x6E+F5OQXFSgrvpL8oGmWsjDsq+k4HeGIdk1NGwYFZgSAIiI82lN0kAF9JM?= =?us-ascii?Q?/W1eCQvOS37CsXXVHWT4ryTT9j/orJdh1mJD8K0LkJf/LMM6eGdASDogblB+?= =?us-ascii?Q?18/iJZiL6fqvcc/dzfmpkWRuTEp0drATTDjFp9p3xl1L4nZCWeLun1FYppFR?= =?us-ascii?Q?usq9Zu946tVQdnc+GUoWO13MVyMzrKKzZLzg6heSyNBBr5rtN0/rs7KbOnCS?= =?us-ascii?Q?C3FvUHpP41tvFOQbQNXQOuX61jPEHZZ1sTZu79kS1aldUcl5GarG8Zfk88n5?= =?us-ascii?Q?6DgeuOYVTw3UUoEG77vfMSrEePHcIlzta7pjzOYF2irxvJsW1+Esfriu117p?= =?us-ascii?Q?rN60L25XB0u/A9l+9y2ynaTCOZld1reT8ZRIbv/qvX+mXQBSb+RNs9hyUA9R?= =?us-ascii?Q?tMCI/lcucCAX/TjC+nSLUmqpnuyxgi/YWHW8vRciQ48cJ7pDOdx89p6xdUTl?= =?us-ascii?Q?mXshQBCUFKynWdcJSi5WT+7TY1r6bWhyvFzJc8VOFjuLnw94QWO6pNHfHD7G?= =?us-ascii?Q?r5AeIbpi/uUnIyeyhTYcDQ801XfO2TwbPi7x9+y0VDaZadwmJ/dy8s5kJgDt?= =?us-ascii?Q?J570sXT0Tgt9II0N0i8AiNqBJU/YhiyN4WsbbKJQmITs51eJJ5TDLYC/K/7E?= =?us-ascii?Q?QV0/im2fvUvMXafvM3B/hUdftVU4Ppop0HCaUUC1fDGVVIrlAYmwWb4vxZlU?= =?us-ascii?Q?89UE=3D?= X-Microsoft-Exchange-Diagnostics: 1;BY1PR0501MB1605;5:btUp7GD/AgytF6zBYblgMrEAQTDHrN3+OxWblbmLVfeONB6+VdLj9+OEoFCpoeEf6hyOsJ6QgoyMvWAl4GdIqInpKyOJeTR+7cOPPnCYNAoOlvsUViU6Gsazz8wNLUa60iRGG60TBS1UOlUuqLe5IQ==;24:4FDcMAWlaxln5fXCxjObza77wT1FaJIPxO77Eprrm7LljVl64339ENMh7n2idk8oZg2XEDdtfmZxeQYcIeL62yM8rae7b3SnQxNSKQBbJjc= SpamDiagnosticOutput: 1:23 SpamDiagnosticMetadata: NSPM X-OriginatorOrg: juniper.net X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 Mar 2016 14:51:46.0093 (UTC) X-MS-Exchange-CrossTenant-Id: bea78b3c-4cdb-4130-854a-1d193232e5f4 X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=bea78b3c-4cdb-4130-854a-1d193232e5f4;Ip=[66.129.239.19];Helo=[p-emfe01b-sac.jnpr.net] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: BY1PR0501MB1605 Sender: ietf-ssh-owner@NetBSD.org List-Id: ietf-ssh.NetBSD.org Precedence: list --=-=-= Content-Type: text/plain All, I have updated draft-baushke-ssh-dh-group-sha2 to reference draft-josefsson-ssh-curves-04 and added curve448-sha512 to the list of key exchange methods. I have also added an acknowledgements section. All feedback is welcome. https://tools.ietf.org/html/draft-baushke-ssh-dh-group-sha2-06 Thanks, -- Mark --=-=-= Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (FreeBSD) iD8DBQFW1ax0DsmuPPFOO2cRAmc6AJwJUIBcOxWAvZyt09IhVZ+swBx8DwCcC1aH 36YXlz3TSTKcJ+cLxhR3fLM= =d3t2 -----END PGP SIGNATURE----- --=-=-=-- From bounces-ietf-ssh-owner-secsh-tyoxbijeg7-archive=lists.ietf.org@NetBSD.org Wed Mar 2 04:02:16 2016 Return-Path: X-Original-To: ietfarch-secsh-tyoxbijeg7-archive@ietfa.amsl.com Delivered-To: ietfarch-secsh-tyoxbijeg7-archive@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7C7101A0404 for ; Wed, 2 Mar 2016 04:02:16 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.907 X-Spam-Level: X-Spam-Status: No, score=-1.907 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, RP_MATCHES_RCVD=-0.006, SPF_PASS=-0.001] autolearn=unavailable Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hCEgfeasgRQ5 for ; Wed, 2 Mar 2016 04:02:14 -0800 (PST) Received: from mail.netbsd.org (mail.NetBSD.org [IPv6:2001:470:a085:999::25]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 906761A0049 for ; Wed, 2 Mar 2016 04:02:14 -0800 (PST) Received: by mail.netbsd.org (Postfix, from userid 605) id 48C9E85EF3; Wed, 2 Mar 2016 12:02:13 +0000 (UTC) Delivered-To: ietf-ssh@netbsd.org Received: from localhost (localhost [127.0.0.1]) by mail.netbsd.org (Postfix) with ESMTP id 42D2285EE0 for ; Wed, 2 Mar 2016 12:02:09 +0000 (UTC) X-Virus-Scanned: amavisd-new at netbsd.org Authentication-Results: mail.netbsd.org (amavisd-new); dkim=pass (2048-bit key) header.d=auckland.ac.nz Received: from mail.netbsd.org ([IPv6:::1]) by localhost (mail.netbsd.org [IPv6:::1]) (amavisd-new, port 10025) with ESMTP id HjdK3uIHXlP2 for ; Wed, 2 Mar 2016 12:02:08 +0000 (UTC) Received: from mx4.auckland.ac.nz (mx4.auckland.ac.nz [130.216.125.248]) (using TLSv1 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.netbsd.org (Postfix) with ESMTPS id A832184CFD for ; Wed, 2 Mar 2016 12:02:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=auckland.ac.nz; i=@auckland.ac.nz; q=dns/txt; s=mail; t=1456920127; x=1488456127; h=from:to:cc:subject:date:message-id:references: in-reply-to:content-transfer-encoding:mime-version; bh=tSfVd65BTulpKeGM8J74nJYeaCdNO9/F2TVhbMPyE68=; b=5r+7lnqsuVukD2rTEiP/cns6n5aRZioA5trncvqlBLoLbpAcVA+Dsxk0 Qr/fY3sq/6tbmUFdl1RddkniTGzEsU4e+IK/KS7VXDJIR0xlKFTszs8Nv CUUCgnshDzfRI4RQIuvDiHXYytZuRn9mAcN30sYUUTydbezScCfHpm8kK LeOkDb7wioii3IG4+SwrnIrtLILXMMGBXPHSaCBmCvCAF5t7fMK7vGgiZ nKY6ItlyLNmmhplTLvxhLQb7DUmdc7cwT8Eq8WEb3uYRrlrZWoqXQIvX7 T53RVSr6wyA8RlifRB+kcYZ285rgqTeWMrltAwgfy2Jr70yNyymGIXJB6 g==; X-IronPort-AV: E=Sophos;i="5.22,528,1449486000"; d="scan'208";a="71480577" X-Ironport-HAT: MAIL-SERVERS - $RELAYED X-Ironport-Source: 130.216.4.171 - Outgoing - Outgoing Received: from uxchange10-fe4.uoa.auckland.ac.nz ([130.216.4.171]) by mx4-int.auckland.ac.nz with ESMTP/TLS/AES256-SHA; 03 Mar 2016 01:02:01 +1300 Received: from UXCN10-5.UoA.auckland.ac.nz ([169.254.5.153]) by uxchange10-fe4.UoA.auckland.ac.nz ([169.254.109.63]) with mapi id 14.03.0266.001; Thu, 3 Mar 2016 01:02:01 +1300 From: Peter Gutmann To: denis bider CC: =?iso-8859-1?Q?Niels_M=F6ller?= , Bryan Ford , "Mark D. Baushke" , Stephen Farrell , Watson Ladd , "Daniel Migault" , Curdle Chairs , "ietf-ssh@NetBSD.org" Subject: RE: AEAD in ssh Thread-Topic: AEAD in ssh Thread-Index: AQHRc2R/BfOcnKvI/0qJ+8iBK4Zo5J9GDxOc Date: Wed, 2 Mar 2016 12:02:00 +0000 Message-ID: <9A043F3CF02CD34C8E74AC1594475C73F4C06FCB@uxcn10-5.UoA.auckland.ac.nz> References: <1635692869-2876@skroderider.denisbider.com> In-Reply-To: <1635692869-2876@skroderider.denisbider.com> Accept-Language: en-NZ, en-GB, en-US Content-Language: en-NZ X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [130.216.158.4] Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Sender: ietf-ssh-owner@NetBSD.org List-Id: ietf-ssh.NetBSD.org Precedence: list denis bider writes:=0A= =0A= >It seems to me the only way you have a computing resource problem is if yo= ur=0A= >customers' stinginess increases in tandem with miniaturization. For exampl= e,=0A= >maybe a number of years ago your customers were willing to pay $10 per=0A= >gadget. Now, perhaps they're willing to pay only $1, while keeping=0A= >performance the same. Is that the trend you see?=0A= =0A= There are two things I see, the first is as you describe, the industry is= =0A= driven by cost, not having the latest flashy gadgets. Ten years ago, the= =0A= state of the art was a Cortex M3. Today, it's a Cortex M3. In ten years= =0A= time, it'll be a Cortex M3 (or perhaps an M0++ or whatever it'll be called= =0A= then, since vendors have been pushing the cheaper M's because that's where = the=0A= demand is).=0A= =0A= (Alongside Cortex M's there's also a bunch of Power stuff which has some=0A= devices good for rough environments, alongside R-series ARMs).=0A= =0A= The second is that in embedded, and I mean real embedded not cheap IoT junk= =0A= from China, the driver is reliability and long life and not fancy features.= =0A= You've got 10-20 year product lifecycles, so devices that once deployed nee= d=0A= to operate for 10-20 years without updates and upgrades every few months. = To=0A= give a somewhat extreme example, there are companies that scour eBay for 19= 90s=0A= x86 hardware to run compilers from the same era to do the translation of=0A= source code into binary, because that's what was certified and they can't m= ove=0A= to anything else without going through the certification process again, whi= ch=0A= involves more work and cost than staying with the current process. This is= =0A= code that has requirements like no recursion, no dynamic memory allocation,= =0A= 100% test coverage of all code paths (that leads to some interesting code),= =0A= and so on. It's also stuff that's incredibly reliable, which is why the=0A= constraints are so tight.=0A= =0A= >it seems to me that the needs of this market segment might indeed be best= =0A= >served by some restricted subset of existing protocols, =0A= =0A= Yup. Unfortunately standards groups seem to be going in the opposite=0A= direction, adding more gratuitous bloat and complexity to every protocol in= =0A= sight.=0A= =0A= >or a protocol designed specifically for that.=0A= =0A= I can't really see that ever happening. The people who design the thing ha= ve=0A= as their target hardware platform a Powerpoint slide projector, not real-wo= rld=0A= devices.=0A= =0A= >I don't want your 10 cent implementation to constrain me in what I can=0A= >provide to my users, however. Maybe you can't afford a fixed-bandwidth=0A= >terminal session. However, it seems like an excellent fit to provide priva= cy=0A= >for interactive administration of a server in a data center.=0A= =0A= Sure, include all the fancy extras you need, but make it optional, and don'= t=0A= change the base protocol, or put constraints on it that will make it a pain= or=0A= impossible to use on constrained devices.=0A= =0A= Peter.=0A= =0A= From bounces-ietf-ssh-owner-secsh-tyoxbijeg7-archive=lists.ietf.org@NetBSD.org Thu Mar 3 00:04:12 2016 Return-Path: X-Original-To: ietfarch-secsh-tyoxbijeg7-archive@ietfa.amsl.com Delivered-To: ietfarch-secsh-tyoxbijeg7-archive@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3379A1A01A1 for ; Thu, 3 Mar 2016 00:04:12 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.906 X-Spam-Level: X-Spam-Status: No, score=-1.906 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HTML_MESSAGE=0.001, RP_MATCHES_RCVD=-0.006, SPF_PASS=-0.001] autolearn=unavailable Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OrZIvCeaqkPU for ; Thu, 3 Mar 2016 00:04:09 -0800 (PST) Received: from mail.netbsd.org (mail.NetBSD.org [IPv6:2001:470:a085:999::25]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E5C261A0184 for ; Thu, 3 Mar 2016 00:04:09 -0800 (PST) Received: by mail.netbsd.org (Postfix, from userid 605) id E3CFC85ED3; Thu, 3 Mar 2016 08:04:08 +0000 (UTC) Delivered-To: ietf-ssh@netbsd.org Received: by mail.netbsd.org (Postfix, from userid 1347) id A0CD385EBB; Thu, 3 Mar 2016 08:04:08 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by mail.netbsd.org (Postfix) with ESMTP id 981CA85E70 for ; Wed, 2 Mar 2016 19:32:40 +0000 (UTC) X-Virus-Scanned: amavisd-new at netbsd.org Received: from mail.netbsd.org ([127.0.0.1]) by localhost (mail.netbsd.org [127.0.0.1]) (amavisd-new, port 10025) with ESMTP id jS5fqZTVuiBo for ; Wed, 2 Mar 2016 19:32:40 +0000 (UTC) Received: from skroderider.denisbider.com (skroderider.denisbider.com [50.18.172.175]) (using TLSv1.1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.netbsd.org (Postfix) with ESMTPS id 27CDA84CF5 for ; Wed, 2 Mar 2016 19:32:40 +0000 (UTC) X-Footer: ZGVuaXNiaWRlci5jb20= Received: from localhost ([127.0.0.1]) by skroderider.denisbider.com for simon@josefsson.org; Wed, 2 Mar 2016 19:32:08 +0000 Date: Wed, 2 Mar 2016 19:32:08 +0000 Subject: Re: draft-josefsson-ssh-curves-04 X-User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:44.0) Gecko/20100101 Firefox/44.0 Message-ID: <1784120660-3000@skroderider.denisbider.com> X-Priority: 3 Importance: Normal MIME-Version: 1.0 From: denis bider To: Simon Josefsson Cc: ietf-ssh@netbsd.org, curdle@ietf.org Content-Type: multipart/alternative; boundary="=-4Am42X05eb6agNaXe3K+" Sender: ietf-ssh-owner@NetBSD.org List-Id: ietf-ssh.NetBSD.org Precedence: list --=-4Am42X05eb6agNaXe3K+ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Hello Simon, very nice. :-) Thank you! Work is currently underway to make safe curves available in the next Crypto= ++ version. Assuming that's ready in a reasonable timeframe, I intend to us= e it for both curve25519-sha256, and curve448-sha512, for our SSH Client an= d Server. If Crypto++ takes too long, I will look into alternative implementations. denis ----- Original Message ----- From: Simon Josefsson=20 Sent: Tuesday, March 1, 2016 04:08 To: ietf-ssh@netbsd.org ; curdle@ietf.org=20 Subject: draft-josefsson-ssh-curves-04 All, I have updated ssh-curves to use SHA-512 for Curve448 as requested by several people.=C2=A0 We are waiting for a Curve448 implementation to confi= rm that the description is correct.=C2=A0 Otherwise I am not aware of any open issues with the document.=C2=A0 All feedback is welcome. https://tools.ietf.org/html/draft-josefsson-ssh-curves-04 Thanks, /Simon = --=-4Am42X05eb6agNaXe3K+ Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable Hello Simon,

very nice. :-) Thank you!
<= br>Work is currently underway to make safe curves available in the next Cry= pto++ version. Assuming that's ready in a reasonable timeframe, I intend to= use it for both curve25519-sha256, and curve448-sha512, for our SSH Client= and Server.

If Crypto++ takes too long, I will look into alternativ= e implementations.

denis


----- Original Message -----
= From: Simon Josefsson
Sent: Tuesday, March 1, 2016 04:08
To: ietf-ss= h@netbsd.org ; curdle@ietf.org
Subject: draft-josefsson-ssh-curves-04
All,

I have updated ssh-curves to use SHA-512 for Curve448 as = requested by
several people.  We are waiting for a Curve448 impleme= ntation to confirm
that the description is correct.  Otherwise I am= not aware of any open
issues with the document.  All feedback is w= elcome.

https://tools.ietf.org/html/draft-josefsson-ssh-curves-04
Thanks,
/Simon

= --=-4Am42X05eb6agNaXe3K+-- From bounces-ietf-ssh-owner-secsh-tyoxbijeg7-archive=lists.ietf.org@NetBSD.org Thu Mar 3 00:42:47 2016 Return-Path: X-Original-To: ietfarch-secsh-tyoxbijeg7-archive@ietfa.amsl.com Delivered-To: ietfarch-secsh-tyoxbijeg7-archive@ietfa.amsl.com Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4BCAA1A1B66 for ; Thu, 3 Mar 2016 00:42:47 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.907 X-Spam-Level: X-Spam-Status: No, score=-1.907 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RP_MATCHES_RCVD=-0.006, SPF_PASS=-0.001] autolearn=ham Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id K_B6xOIW8kg2 for ; Thu, 3 Mar 2016 00:42:43 -0800 (PST) Received: from mail.netbsd.org (mail.NetBSD.org [IPv6:2001:470:a085:999::25]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 59FFE1A1AB8 for ; Thu, 3 Mar 2016 00:42:43 -0800 (PST) Received: by mail.netbsd.org (Postfix, from userid 605) id 1741B85ED3; Thu, 3 Mar 2016 08:42:43 +0000 (UTC) Delivered-To: ietf-ssh@netbsd.org Received: from localhost (localhost [127.0.0.1]) by mail.netbsd.org (Postfix) with ESMTP id C75DE85E25 for ; Thu, 3 Mar 2016 08:42:39 +0000 (UTC) X-Virus-Scanned: amavisd-new at netbsd.org Received: from mail.netbsd.org ([IPv6:::1]) by localhost (mail.netbsd.org [IPv6:::1]) (amavisd-new, port 10025) with ESMTP id jiqav7GFS5Ck for ; Thu, 3 Mar 2016 08:42:39 +0000 (UTC) Received: from duva.sjd.se (duva.sjd.se [IPv6:2001:9b0:1:1702::100]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.netbsd.org (Postfix) with ESMTPS id D0E4984CF5 for ; Thu, 3 Mar 2016 08:42:36 +0000 (UTC) Received: from latte.josefsson.org ([155.4.17.2]) (authenticated bits=0) by duva.sjd.se (8.14.4/8.14.4/Debian-4) with ESMTP id u238gE8V016436 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=NOT); Thu, 3 Mar 2016 09:42:15 +0100 From: Simon Josefsson To: denis bider Cc: ietf-ssh@netbsd.org, curdle@ietf.org Subject: Re: draft-josefsson-ssh-curves-04 References: <1784120660-3000@skroderider.denisbider.com> OpenPGP: id=54265E8C; url=http://josefsson.org/54265e8c.txt X-Hashcash: 1:22:160303:ietf-ssh@netbsd.org::3vNW7Py1xeAPdhgX:5Tio X-Hashcash: 1:22:160303:curdle@ietf.org::dcog+g2qR4pZgiA4:Fvy+ X-Hashcash: 1:22:160303:ietf-ssh3@denisbider.com::OCVYwX24qoBFMNDm:MSmh Date: Thu, 03 Mar 2016 09:42:13 +0100 In-Reply-To: <1784120660-3000@skroderider.denisbider.com> (denis bider's message of "Wed, 2 Mar 2016 19:32:08 +0000") Message-ID: <87r3fsrlzu.fsf@latte.josefsson.org> User-Agent: Gnus/5.130014 (Ma Gnus v0.14) Emacs/24.4 (gnu/linux) MIME-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha256; protocol="application/pgp-signature" X-Virus-Scanned: clamav-milter 0.98.7 at duva.sjd.se X-Virus-Status: Clean Sender: ietf-ssh-owner@NetBSD.org List-Id: ietf-ssh.NetBSD.org Precedence: list --=-=-= Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: quoted-printable denis bider writes: > Hello Simon, > > very nice. :-) Thank you! > > Work is currently underway to make safe curves available in the next > Crypto++ version. Assuming that's ready in a reasonable timeframe, I > intend to use it for both curve25519-sha256, and curve448-sha512, for > our SSH Client and Server. > > If Crypto++ takes too long, I will look into alternative implementations. Thanks. The other SSH implementation that considered Curve448 decided, after looking into it, to postpone it due to lack of suitable Curve448 implementation. If you manage to complete an implementation and ship it in some well known SSH implementation, we could keep the description. Otherwise I'm inclined to remove Curve448 from ssh-curves if nobody is looking to implement. I prefer descriptive standards over prescriptive. Especially related to crypto where the devil is always in the details, and you won't notice the details until you implement it. It can always be done later when there is sufficient groundwork to motivate it. Right now that is long overdue for Curve25519 but far from the case for Curve448. So coupling them comes with a high cost. /Simon > denis > > > ----- Original Message ----- > From: Simon Josefsson=20 > Sent: Tuesday, March 1, 2016 04:08 > To: ietf-ssh@netbsd.org ; curdle@ietf.org=20 > Subject: draft-josefsson-ssh-curves-04 > > All, > > I have updated ssh-curves to use SHA-512 for Curve448 as requested by > several people.=A0 We are waiting for a Curve448 implementation to confirm > that the description is correct.=A0 Otherwise I am not aware of any open > issues with the document.=A0 All feedback is welcome. > > https://tools.ietf.org/html/draft-josefsson-ssh-curves-04 > > Thanks, > /Simon > --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQEcBAEBCAAGBQJW1/jlAAoJEIYLf7sy+BGda7AIAKyLSGqBzY18pFQZ64EXwhaD cD3ELS4kBIxhG4WluKYZGH+OzeOrXeGJrYV8KqG98IU+7hKWkyduIRKEfrHKmVsr mSLIZiu7YPP5mi558uXs79aUcO4RS5pIjA6Q9q9nZ0bjelByNXZJFujFIKCJfJCC O/40Yy45LTWlZysiqDso3k0+7aKYV4qWLf3EBFCeDdrKfITHCFs7OPsfC6ApM+sV DZsVWmhRbZ9c+9NJG3lv8AgIollsnfycFXQTqr1Tc2qLISSO0mzhVZPvMgefkqhf jiao6ki3BiZ8jKgBlKUTVPBzHwi05rHezhOUroKeiEiUU3YNX1INHSUcW7SwWQQ= =2AbH -----END PGP SIGNATURE----- --=-=-=--