openssh unix dev - Feb 2019 - Can we disable diffie-hellman-group-exchange-sha1 by default?

That doesn't seem to be the case. See
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r4.pdf
(5.6.1 Comparable Algorithm Strengths)

On Fri, Feb 15, 2019 at 8:28 AM Darren Tucker <dtucker at dtucker.net>
wrote:
>
> On Fri, 15 Feb 2019 at 16:00, Yegor Ievlev <koops1997 at gmail.com>
wrote:
> > I don't think there is any point to generate so many moduli.
Actually,
> > 3 moduli of sizes 2048, 3072 and 4096 seem like a sane choice.
>
> NIST SP 800-57 Part 1, on which the current group size selection code
> is based, puts a 4k group at a little over 128 bits of security.  This
> is why we generate larger groups (and request them, when using 192 and
> 256 bit ciphers).
>
> --
> Darren Tucker (dtucker at dtucker.net)
> GPG key 11EAA6FA / A86E 3E07 5B19 5880 E860  37F4 9357 ECEF 11EA A6FA (new)
>     Good judgement comes with experience. Unfortunately, the experience
> usually comes from bad judgement.

On Fri, 15 Feb 2019 at 16:45, Yegor Ievlev <koops1997 at gmail.com>
wrote:
> That doesn't seem to be the case. See
>
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r4.pdf
> (5.6.1 Comparable Algorithm Strengths)
For DH, the "Comparable strengths" table lists L=3072 for 128 bits and
L=7680 for 192 bits.  To me that puts 4k groups a bit above 128 bits
and well below 192 bits of security.   What are you referring to?

-- 
Darren Tucker (dtucker at dtucker.net)
GPG key 11EAA6FA / A86E 3E07 5B19 5880 E860  37F4 9357 ECEF 11EA A6FA (new)
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.

I referred to the fact that there is no value for 4096-bit groups at
all. For higher strengths than 128 bits one should probably not use
non-EC crypto at all, as the document suggests.

On Fri, Feb 15, 2019 at 9:19 AM Darren Tucker <dtucker at dtucker.net>
wrote:
>
> On Fri, 15 Feb 2019 at 16:45, Yegor Ievlev <koops1997 at gmail.com>
wrote:
> > That doesn't seem to be the case. See
> >
https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r4.pdf
> > (5.6.1 Comparable Algorithm Strengths)
>
> For DH, the "Comparable strengths" table lists L=3072 for 128
bits and
> L=7680 for 192 bits.  To me that puts 4k groups a bit above 128 bits
> and well below 192 bits of security.   What are you referring to?
>
> --
> Darren Tucker (dtucker at dtucker.net)
> GPG key 11EAA6FA / A86E 3E07 5B19 5880 E860  37F4 9357 ECEF 11EA A6FA (new)
>     Good judgement comes with experience. Unfortunately, the experience
> usually comes from bad judgement.