Subject: Re: additional core draft nits in need of WG attention.

From: Bill Sommerfeld <[email-masked]>
Date: Tue, 11 Nov 2003 17:30:53 -0500

> I'd prefer to see AES as REQUIRED and 3DES put down to RECOMMENDED. Having
> two REQUIRED ciphers adds to the size of implementations, and could be an
> issue in some small environments.

I've seen sufficient opposition to demoting 3DES that the only thing
on the table right now is whether we should promote AES.

Anyone have data on:

- what proportion of the code size of a "minimized" implementation is
the actual algorithm code?  i.e., are we talking 1% or 10% bloat here?

- how widespread is AES support today?

					- Bill

---

From: Matt Johnston <[email-masked]>
Date: Wed, 12 Nov 2003 15:37:50 +0800

> the actual algorithm code?  i.e., are we talking 1% or 10% bloat here?

Looking at a x86 dynamically linked binary for Dropbear (SSH2 server), the
size is ~110kB with 3DES and AES compiled in (plus rsa, dss, dh-group1,
sha1).

Removing 3DES drops the size by ~5kB, removing AES drops it by ~15kB,
although the AES implementation is quite large.

So the size difference could be in the order of 5%, at least for this
implementation. I guess the size decrease from removing 3DES isn't actually
that significant.

Matt

---

From: Simon Tatham <[email-masked]>
Date: Wed, 12 Nov 2003 09:14:07 +0000

> Anyone have data on:
[...]
> - how widespread is AES support today?

It's difficult to imagine how this data might show up except in the
form of a bunch of implementors each shouting `I do / do not support
AES' [delete as appropriate].

On which basis: PuTTY supports AES.

Cheers,
Simon
-- 
Simon Tatham         "That all men should be brothers is a
<[email-masked]>    dream of people who have no brothers."

---

From: Jon Bright <[email-masked]>
Date: Wed, 12 Nov 2003 10:19:16 +0100

> On which basis: PuTTY supports AES.

PenguiNet also supports AES (and has done so in all SSH2-capable versions).

If implementors shout at me about whether they support AES, rather than 
everyone sending in a mail to the list, I'll be happy to correlate the 
answers and send a summary tomorrow at about this time.

-- 
Jon Bright
Silicon Circus Ltd.
http://www.siliconcircus.com

---

From: [email-masked] (Niels Möller)
Date: 12 Nov 2003 14:51:35 +0100

> the actual algorithm code?  i.e., are we talking 1% or 10% bloat here?

In my implementation, des is about 8K code. Aes is about 2.5K code and
9K tables, which iirc can easily be cut to about 3K of tables if
memory usage is more important than speed, so below I'll count aes as
5.5K total code and data. All this measured on x86.

The stripped lsh client binary is 340K (excluding bignum library and
libz and other libraries which are linked dynamically). So here, the
ciphers are 2.4% (des), or 1.6% (small aes) of the bulk.

So let's guess that a minimized implementation would be cut down to
somewhere between 100K-200K (I think it's difficult to get below 100K,
anybody that has tried?). Then the bloat factor for each cipher is
somewhere between 3% and 8%.

/Niels

---

From: Jon Bright <[email-masked]>
Date: Thu, 13 Nov 2003 16:43:41 +0100

> answers and send a summary tomorrow at about this time.

So, further to this - I doubt this list is anything like complete, but 
the following implementations all support AES.  Nobody mailed to say 
they didn't:

PuTTY
Dropbear
MindTerm
AppGate
All current Vandyke versions
PenguiNet

Peter Gutman didn't mail to say whether his implementation supports AES 
or not (since his policy is to support as little as possible, I guess 
he'd be the most likely candidate for non-support, hence the special 
mention).

Matt Johnston (DropBear) mentioned he might try and hunt down an SSH2 
implementation that didn't support AES.  He's not mailed to say he found 
anything, but that could just mean he hasn't had time yet.

Either way, it seems like making AES required won't cause problems for 
anyone.

---

From: Matt Johnston <[email-masked]>
Date: Fri, 14 Nov 2003 01:55:15 +0800

> anything, but that could just mean he hasn't had time yet.

Mocha Telnet for Palm OS appears to only support 3DES with SSH2.
http://www.mochasoft.dk/palm.html#palmtelnet

A Cisco router with version "Cisco-1.25" appears to advertise 3DES only as
well.

Those are the only two I found.

Cheers,
Matt

---

From: Derek Fawcus <[email-masked]>
Date: Thu, 13 Nov 2003 19:50:55 +0000

> A Cisco router with version "Cisco-1.25" appears to advertise 3DES only as

I guess it may depend upon version.  I thought that all versions including
SSHv2 (as opposed to SSHv1) also supported AES.  However I can't give an
authoritive answer without checking.

Certainly my home router (with a 12.3T snapshot) which signs itself as
'SSH-1.99-Cisco-1.25',  advertises aes128-cbc, aes192-cbc,  aes256-cbc.

Mind given that it only offers 'ssh-rsa' and not 'ssh-dsa' it can't
claim complete checkbox compiance to the drafts.

DF