Subject: RE: Feedback on draft-ssh-ext-info-00

From: Peter Gutmann <[email-masked]>
Date: Fri, 4 Dec 2015 03:24:31 +0000

denis bider <[email-masked]> writes:

>Presence of "rsa-sha2-256" as a host key signature algorithm cannot reliably
>serve as an indicator for user authentication, because it requires the server
>to actually have an RSA host key.

Ah, OK, I'd missed that.  Maybe the -sha2 draft could point this out, I saw
section 3 but didn't connect it with the issues of identifying algorithms,
since my code does all of them so will just accept something like an ECDSA
server sig combined with an RSA client sig.

>The server might only have an ECDSA host key; but may still accept and prefer
>"rsa-sha2-256" signatures for client authentication.

Hmm, which leads to a follow-on question, is this actually going to be an
issue?  Are there going to be implementations out there that support signature
algorithm A in one case but only signature algorithm B in another?

Peter.

---

From: denis bider <[email-masked]>
Date: Thu, 3 Dec 2015 02:06:28 +0000

Presence of "rsa-sha2-256" as a host key signature algorithm cannot reliably serve as an indicator for user authentication, because it requires the server to actually have an RSA host key.

The server might only have an ECDSA host key; but may still accept and prefer "rsa-sha2-256" signatures for client authentication.

Or the server might have an ECDSA host key, and NOT accept "rsa-sha2-256" for client authentication, but instead require "rsa-sha2-512".

----- Original Message -----
From: Peter Gutmann 
Sent: Wednesday, December 2, 2015 17:14
To: Markus Friedl ; [email-masked] 
Cc: Damien Miller 
Subject: RE: Feedback on draft-ssh-ext-info-00

Markus Friedl <[email-masked]> writes:

>I'm in the process of implementing draft-rsa-dsa-sha2-256-03 and welcome a 
>way for signaling SHA2 support to the client for userauth,

Doesn't the presence of "rsa-sha2-256" do this?  The client proposes it, and
if the server supports it, they indicate via the algorithm string.  It's
pretty much independent of draft-ssh-ext-info-00 (I know it specifies
"server-sig-algs", but it seems that specifying "rsa-sha2-256" was already
sufficient to indicate this).

Peter.