Subject: [Curdle] [Editorial Errata Reported] RFC8270 (5502)

From: RFC Errata System <[email-masked]>
Date: Fri, 21 Sep 2018 14:43:22 -0700 (PDT)

The following errata report has been submitted for RFC8270,
"Increase the Secure Shell Minimum Recommended Diffie-Hellman Modulus Size to 2048 Bits".

--------------------------------------
You may review the report below and at:
http://www.rfc-editor.org/errata/eid5502

--------------------------------------
Type: Editorial
Reported by: Eugene Adell <[email-masked]>

Section: 5

Original Text
-------------
   A malicious client could cause a Denial of Service by intentionally
   making multiple connections that are less than 2048 bits in size.
   Therefore, operating systems SHOULD NOT log DH groups that are less
   than 2048 bits in size, as it would create an additional attack
   surface.

Corrected Text
--------------
   A malicious client could cause a Denial of Service by intentionally
   making multiple connections that are less than 2048 bits in size.
   Therefore, operating systems without any rate-limited logging 
   SHOULD NOT log DH groups that are less than 2048 bits in size, as it
   would create an additional attack surface.

Notes
-----
Instead of ignoring attacks, the administrator wants to know when one is taking place, particularly if it is an intense one which would lead to a denial of service, as suggested by the authors. Thus, using a rate-limited logging mechanism is an appropriate solution to keep records of the attack, and to notify the administrator in real-time then he can take actions if he wants to. As there might not be other ways to inform the administrator of an attack taking place, not logging at all is the last choice.

Instructions:
-------------
This erratum is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party  
can log in to change the status and edit the report, if necessary. 

--------------------------------------
RFC8270 (draft-ietf-curdle-ssh-dh-group-exchange-06)
--------------------------------------
Title               : Increase the Secure Shell Minimum Recommended Diffie-Hellman Modulus Size to 2048 Bits
Publication Date    : December 2017
Author(s)           : L. Velvindron, M. Baushke
Category            : PROPOSED STANDARD
Source              : CURves, Deprecating and a Little more Encryption
Area                : Security
Stream              : IETF
Verifying Party     : IESG

---

From: "Mark D. Baushke" <[email-masked]>
Date: Fri, 21 Sep 2018 15:36:40 -0700

For myself, given that RFC 8270 is moving from 1024-bit DH groups as a
minimum to 2048-bit DH groups as a minimum, I believe that ignoring any
group which is not at least 2048-bits is likely to be the correct
behavior regardless of any rate-limited logging behavior which might be
available for some implementations of the SSH protocol.

If the proposed DH group does not meet the new minimum, then the
connection should fail. I do not see an immediate need to add possible
mitigations to the security considerations section.

	-- Mark

---

From: Benjamin Kaduk <[email-masked]>
Date: Sun, 23 Sep 2018 18:36:28 -0500

> mitigations to the security considerations section.

Such mitigations would be outside the scope of an erratum anyway, as I see
it.

-Ben

---

From: Daniel Migault <[email-masked]>
Date: Mon, 24 Sep 2018 01:39:12 +0000

I do not see an issue with the current text as it does not prevent logging DH less than 2048 bits. 
I see the recommendations considering the minimum level of logging. This does not prevent different level of loggings as well as finer monitoring capabilities.  That is my personal opinion.  

Yours, 
Daniel

-----Original Message-----
From: Benjamin Kaduk <[email-masked]> 
Sent: Sunday, September 23, 2018 7:36 PM
To: Mark D. Baushke <[email-masked]>
Cc: RFC Errata System <[email-masked]>; [email-masked]; [email-masked]; Daniel Migault <[email-masked]>; [email-masked]; [email-masked]; [email-masked]
Subject: Re: [Editorial Errata Reported] RFC8270 (5502)

On Fri, Sep 21, 2018 at 03:36:40PM -0700, Mark D. Baushke wrote:
> minimum to 2048-bit DH groups as a minimum, I believe that ignoring 
> any group which is not at least 2048-bits is likely to be the correct 
> behavior regardless of any rate-limited logging behavior which might 
> be available for some implementations of the SSH protocol.
> 

Such mitigations would be outside the scope of an erratum anyway, as I see it.

-Ben

---

From: "Mark D. Baushke" <[email-masked]>
Date: Sun, 23 Sep 2018 20:43:31 -0700

> Such mitigations would be outside the scope of an erratum anyway, as I see

Yes.

Looking back at the RFC4419, it is worth noting that the server is the
one who produces the DH parameters to be used. The client just specifies
the minimum <= requested_size <= maximum DH size in bits. The server
will try to return a size between minimum and maximum inclusive which is
as close to the requested_size as it is able to do. With RFC 8270
suggesting that 2048 is the new minimum, a request with the maximum less
than 2048 should just close the connection while a a requested_size of
less than 2048 would just return 2048 or higher.

So, I suspect that the security consideration section is more confusing
than useful. I do not see a denial of service possibility if the server
either returns its minimum or closes the connection.

Rate-limiting the number of connections would be outside of the scope of
both RFC 4419 and RFC 8270.

	-- Mark