Re: additional core draft nits in need of WG attention.

[pgut001%cs.auckland.ac.nz@localhost (Peter Gutmann)]

nisse%lysator.liu.se@localhost (Niels =?iso-8859-1?q?M=F6ller?=) writes:

>Out of curiosity, which ciphers did you support at all? With only one or both
>of aes and des3 to choose from, assymetric choices doesn't make much sense.

{ "whatever the user has enabled" union "3des, aes, blowfish, cast, idea" }
alongside any custom algorithms the user (meaning the person who built the
code) has added.  For example the user may have disabled IDEA due to patent
concerns, so cryptlib wouldn't advertise that as available, or may have
enabled some other algorithm of their choice which isn't one of the built-in
defaults.  Out of the box though it's the above five, that's all of the
mainstream ciphers covered.

(Hmm, I just saw RC4 buried down under Serpent there, I could switch that on
as well now that I've noticed it's in the list :-).

>Or will it enforce that the *input* to the selection processing is symmetric,
>i.e. that in the KEXINIT message,
>
>  encryption_algorithms_client_to_server
>     == encryption_algorithms_server_to_client
>
>  mac_algorithms_client_to_server
>     == mac_algorithms_server_to_client

That's what I do, and from the error message I got when I accidentally didn't
do it, at least one other implementation does that too.

>If we really want to get rid of this possibility, the cleanest and least
>confusing way of doing it would be to define protocol version 2.1 with a
>changed KEXINIT format,

I don't really know if such a big change is necessary, just discouraging the
use of asymmetric choices (which shouldn't be hard given that nothing (?) does
it at the moment, so any attempt to implement it will fail to interop) should
be enough.  No need to break things.

>I'm always confused when a spec allows flexibility which, for good or bad and
>perhaps undocumented reasons, noone implements.

I guess I've been polluted by too long with PKIX RFCs, there are so many MUSTs
in there that you need to ignore in order to get things to work it's scary.

Peter.