Algorithm negotiation really is necessary

On issue #279 @keithw commented:

"[...]. I'm not really eager to make Mosh crypto-agile -- if you look at incumbent systems, like OpenSSH, cipher negotiation is a huge source of bugs and security holes. [...]"

Crypto-agility is necessary. Someday cryptanalysis of Mosh's crypto algorithms may show them to be substantially weaker than expected/desired and though it may not be immediately fatal to Mosh's security, such cryptanalysis may open the door to future cryptanalysis that does fully break Mosh.

The options available the day one of the algorithms used by Mosh begins to weaken significantly are:

• flag day switch to new algorithm

or

• switch to a new port number and use new algorithms there

The problem with flag days is that they are a terrible user experience. The problem with using a new port number is that port numbers are a scarce resource and worse: there will be a fallback to old number approach that is very likely to be susceptible to a downgrade attack!

The cryptanalysis of the now-weak algorithm might not be so devastating that only a flag day could address it. That is, it may be OK to continue to use the now-weak algorithm during the time it takes to migrate to a replacement algorithm.

The downgrade attack issue is where all the complexity is. You're clearly hoping to be able to avoid this complexity. I'm asserting from experience that you should not.

OpenSSH may be an example of complexity in algorithm negotiation, but it's also an example where algorithm negotiation has saved the protocol's bacon (think of the chained IV CBC cipher suites it used to use).

TLS is an example of a protocol where downgrade protection was not done well originally, an example of fallback reconnects.

My advice is to implement algorithm agility, that you get negotiation and downgrade protection right rather than avoid it out of fear of complexity.

Start by reading issue #279 and the surrounding discussion to understand the existing objections to crypto-agility. The issue does not name files, tests, or an implementation entry point; work is complete only after the negotiation and downgrade-protection design is agreed and implemented.