Subject: Re: DH group exchange (Re: SSH key algorithm updates)

From: "Mark D. Baushke" <[email-masked]>
Date: Thu, 10 Dec 2015 05:44:53 -0800

Niels Möller <[email-masked]> writes:

> "Mark D. Baushke" <[email-masked]> writes:
>
> > Given your point about sha2-384, I think there are three possibilities
> > that remain:
> >
> >   sha2-512
> >   sha3-256
> >   sha3-512
>
> sha3-384 could also be on that list. Unlike for sha*2*-384, it's a
> different security/performance tradeoff than sha3-512.
>
> > fwiw: I have no idea if the SSH community is ready to consider the use
> > of sha3 (FIPS PUB 202 style) at this time,
>
> Me neither.

Okay. Well, what do other folks on the list think? Is it time to add
SHA3 to the SSH standard for DH Group15 and DH Group16? If so, what
values make the most sense?

fwiw: I do not believe that the SHA-3 family (sha3-224, SHA3-256,
SHA3-512, SHAKE128 and SHAKE256) from FIPS PUB 202 have been added as an
RFC yet.

So, what would be the correct way to handle specification of ay of those
algorithms in an Internet Draft?

I can certainly write an update to RFC 4253 that moves
'diffie-hellman-group1-sha1' to 'NOT RECOMMENDED' and adds
'diffie-hellman-group14-sha256' as 'RECOMMENDED', but I am less sure
about what to add for a diffie-hellman-groupNN-<sha3-HHH> where groupNN
are names from RFC 3526 and sha3-HHH are recommended sizes of the SHA-3
family.

I suppose I could just add a <xref target="FIPS-PUB-202"/> or something,
with

      <reference
        anchor="FIPS-PUB-202"
        target="http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf">
        <front>
          <title>SHA-3 Standard: Permutation-Based Hash and Extendable-Output
	  Functions</title>
          <author>
            <organization>National Institute of Standards and Technology
	     </organization>
	     <address>
	     <city>Gaithersburg</city>
	     <region>MD</region>
	     <code>20899-8900</code>
	     <country>US</country>
	     </address>
          </author>
          <date month="April" year="2015"/>
        </front>
        <seriesInfo name="FIPS PUB" value="202"/>
      </reference>

but it seems like having an RFC defining the SHA-3 family and its
security considerations first might be reasonable?

	Thanks,
        -- Mark

---

From: "Mark D. Baushke" <[email-masked]>
Date: Thu, 10 Dec 2015 07:42:23 -0800

I have posted draft-baushke-ssh-dh-group-sha2-00

URL:

  https://datatracker.ietf.org/doc/draft-baushke-ssh-dh-group-sha2/

to handle starting to remove diffie-hellman-group1-sha1 from the
REQUIRED list and adding group14, group15 and group16 using sha256 to
the RECOMMENDED, RECOMMENDED, OPTIONAL lists.

	-- Mark

---

From: Darren Tucker <[email-masked]>
Date: Fri, 11 Dec 2015 15:34:30 +1100

> I have posted draft-baushke-ssh-dh-group-sha2-00

I've implemented this for OpenSSH (against -current, but the diff will
also apply to 7.1p1 with some fuzz) if anyone would like to try it.
Patch is at https://bugzilla.mindrot.org/show_bug.cgi?id=2515.  Please
let me know if you have any comments or you can report success or
failure with it.

Thanks.

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.

---

From: Matt Johnston <[email-masked]>
Date: Fri, 11 Dec 2015 22:20:04 +0800

I've added preliminary diffie-hellman-group14-sha256 to Dropbear, https://secure.ucc.asn.au/hg/dropbear/rev/d2f9ef67af15

The OpenSSH patch seems to have problems, I've replied in bugzilla.

Cheers,
Matt

> On Fri 11/12/2015, at 12:34 pm, Darren Tucker <[email-masked]> wrote:
>

---

From: [email-masked] (Niels Möller)
Date: Thu, 10 Dec 2015 15:51:05 +0100

> values make the most sense?

I think it is important to keep these two upgrades separately. As far as
I'm aware, there's no reason to try to avoid sha256, so I'd prefer that
we go with what you suggested a few weeks back:

>   diffie-hellman-group15-sha256 (3072-bit MODP group ~130 bits of security)
>   diffie-hellman-group16-sha256 (4096-bit MODP group ~150 bits of security)

I think it would make sense with at least the first one as RECOMMENDED.

As for sha3, what would we want to use it for? 

As an alternative for key exchange and key derivation? Makes sense to me
as alternatives with group14, 15 and 16. Not that I think this is
urgent, but it makes me feel a little better if we are prepared with an
alternative to sha256.

As a mac? It's possible to to hmac-sha3-nnn, but I hope we'll see some
standards for a keyed sha3 mac and/or a keccak-based aead, without doing
the hmac construction. So maybe that's premature.

Regards,
/Niels

-- 
Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26.
Internet email is subject to wholesale government surveillance.

---

From: Peter Gutmann <[email-masked]>
Date: Sat, 12 Dec 2015 04:50:32 +0000

[email-masked] <[email-masked]> writes:

>Well, what do other folks on the list think? Is it time to add SHA3 to the
>SSH standard for DH Group15 and DH Group16?

Nope.  We know, from the outcome of the SHA-3 competition, that SHA-2 is
actually a lot stronger than people thought.  So adding SHA-3 would be adding
yet another extra algorithm that's not noticeably stronger than SHA-2 (just
different), but a whole lot slower.  If there's some desperate demand for a
new hash algorithm, I'd rather have Blake2, which is at least an improvement
on SHA-2.

Peter.

---

From: Darren Tucker <[email-masked]>
Date: Sat, 12 Dec 2015 19:56:09 +1100

> The OpenSSH patch seems to have problems, I've replied in bugzilla.

Damien implemented the missing code and I've updated the patch in the
bug.  With that change, openssh client interops with dropbear server.
There's some problem with dropbear client and openssh server, but that
combination doesn't work for me without my changes using group14-sha1
so I'll follow up with that off-list.