Subject: Re: Feedback on draft-ssh-ext-info-00

From: denis bider <[email-masked]>
Date: Mon, 14 Dec 2015 00:27:44 +0000

This is what I would prefer also. However, as far as I've understood, it's not what Markus implemented for OpenSSH.

If Markus and Damien wanted to implement this - that both sides presenting ext-info-{s,c} should reliably lead to both sides sending SSH_MSG_EXT_INFO - then I would prefer to modify the draft this way.

However, it would be counter-productive to knowingly specify behavior different from this major implementation.

----- Original Message -----
From: Niels "Möller" 
Sent: Saturday, December 12, 2015 02:14
To: Matt Johnston 
Cc: denis bider ; Damien Miller ; Markus Friedl ; [email-masked] 
Subject: Re: Feedback on draft-ssh-ext-info-00

Matt Johnston <[email-masked]> writes:

> Why not keep just ext_info_{c,s} and specify that client and server
> both MUST send SSH_MSG_EXT_INFO immediately after SSH_NEWKEYS iff both
> sent ext_info_{c,s}? Then they both know what to expect.

Sounds ok to me.

Regards,
/Niels

-- 
Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26.
Internet email is subject to wholesale government surveillance.

---

From: [email-masked] (Niels Möller)
Date: Tue, 15 Dec 2015 09:44:56 +0100

denis bider <[email-masked]> writes:

> This is what I would prefer also. However, as far as I've understood,
> it's not what Markus implemented for OpenSSH.

And to be clear, the problem with that way of doing it is that the
client has no way to know reliably whether or not to expect
SSH_EXT_INFO, and in particular, to know it *before* deciding what to
put in its SERVICE_REQUEST.

I think it's desirable to be able to know whether or not the peer is
going to send SSH_EXT_INFO, even if I don't agree at all with your
dislike for SERVICE_REQUEST.

One scenario where it matters, is if we define an extension that lists
which services the server is offering.

> However, it would be counter-productive to knowingly specify behavior
> different from this major implementation.

I wouldn't put it that way. I'd say that we should strive for consensus,
and it's pretty important that that our consensus includes the openssh
folks.

Regards,
/Niels