Subject: Re: What do we want from sshv2?

From: Jeffrey Altman <[email-masked]>
Date: Tue, 24 Oct 2000 14:12:12 EDT

> >I would suggest that the GSSAPI is the way to go. Rather then reinventing
> >a authentication protocol, the GSSAPI already provides this. The GSSAPI can 
> >also be used to verify any SSH host keys, using wrap/unwrap and the session keys.
> >I believe that this is very important, as all to many people do not distribute
> >the host keys out of band, but allow SSH to prompt them the first time of
> >when the key changes, thus leading to possible MITM attacks. 
> 
> Stupid question time; if we're using Kerberos/GSSAPI, why do we need
> the SSH host key _at all_?  Doesn't it become completely redundant?
> I'd personally prefer not having to generate a SSH host key.  I think
> the D-H exchanges described previously don't require a host key (unless
> I misread those documents, which is completely possibly).
> 
> --Ken
> 

The D-H exchanges do require a public key that is sent from the host
to the client.  What changes if you use GSSAPI is that you no longer
need to use the same public key/private key pair to represent a given
host for all connections.  Instead you can generate new key pairs as
you see fit.

                  Jeffrey Altman * Sr.Software Designer
                 The Kermit Project * Columbia University
               612 West 115th St * New York, NY * 10025 * USA
     http://www.kermit-project.org/ * [email-masked]

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Tue, 24 Oct 2000 15:55:11 -0400 (EDT)

> host for all connections.  Instead you can generate new key pairs as

Actually, the result of a D-H exchange isn't really a key per se.  It's a
shared secret which is used to derive keys for whatever symmetric
algorithm ends up being used to encrypt the stream.  Read the ssh
transport draft for details.

Ken is correct.  If the proposed kerberos-diffie-hellman-group1-sha1
method is used, no "ssh host key" is needed.  The public key signature
that is normally used to authenticate the key exchange is replaced by
Kerberos authentication.

It is important to be aware that the key exchange defined for the sshv2
protocol is nothing like the exchange used by sshv1.  In sshv1, the
server.  sends its (signed) public key to the client; the client chooses a
symmetric key and encrypts it using the public key provided by the server.
In the v2 protocol, there is a DH exchange in which both sides contribute
to the key material, and the host's public key is used only to
authenticate that exchange.

-- Jeffrey T. Hutzelman (N3NHS) <[email-masked]>
   Sr. Research Systems Programmer
   School of Computer Science - Research Computing Facility
   Carnegie Mellon University - Pittsburgh, PA

---

From: Derek Atkins <[email-masked]>
Date: 24 Oct 2000 16:03:44 -0400

> host for all connections.  Instead you can generate new key pairs as

That's fine -- you just keep generating the in-core, dynamic (every 2
hours?)  host key that is used for the ephemeral DH, but you don't
need to go through the ssh-keygen process.  You authenticate the
ephemeral key via Kerberos/GSSAPI.

-derek

-- 
       Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory
       Member, MIT Student Information Processing Board  (SIPB)
       URL: http://web.mit.edu/warlord/      PP-ASEL      N1NWH
       [email-masked]                        PGP key available