Comments (3)
For reference, this commit can be cherrypicked if desired
6e43be5 Implement Strict KEX mode
With description in 66bc1fc
Lines 12 to 23 in 66bc1fc
from dropbear.
Not sure if I'll get the release made in the next week, otherwise it'll be after mid-January.
Note that Terrapin doesn't reduce the security of Dropbear at all, it doesn't implement [email protected]
extension.
server-sig-algs
is mentioned by the Terrapin authors as security-related, but I think that's incorrect - it's used for compatibility, not security.
from dropbear.
server-sig-algs is mentioned by the Terrapin authors as security-related, but I think that's incorrect - it's used for compatibility, not security.
The reason why we considered server-sig-algs
to be security-related is given in RFC8332 Section 3.3:
When authenticating with an RSA key against a server that does not
implement the "server-sig-algs" extension, clients MAY default to an
"ssh-rsa" signature to avoid authentication penalties. When the new
rsa-sha2-* algorithms have been sufficiently widely adopted to
warrant disabling "ssh-rsa", clients MAY default to one of the new
algorithms.
While it is true that not sending server-sig-algs
does not prevent the client from trying SHA2-based RSA signatures, we observed the suggested behavior (preferring SHA-1 over SHA-2 when server-sig-algs
is missing) in a wide variety of SSH clients. Also, the order of algorithms in server-sig-algs
is used by some clients in case multiple private keys are present, potentially leading to downgrades as well.
However, we do not consider this application of the Terrapin attack to have a significant impact. Instead, our main concern is the combination of Terrapin with implementation bugs, as seen in AsyncSSH. We evaluated only a handful of SSH implementations, where one already allowed for in-session man-in-the-middle attacks. Given the wide variety of SSH implementations, one can estimate with sufficient probability that other implementations face similar issues.
from dropbear.
Related Issues (20)
- There is no command to limit the simultaneous connection of users HOT 2
- Log improvement: name the key
- Bad `authorized_keys` is not reported in non-debug mode HOT 5
- dropbear 22.83 patch error in lede/optnwrt HOT 1
- Minor clarification for DEBUG_TRACE HOT 1
- dbclient can't connect to embedded dropbear server HOT 4
- sshkey file layout HOT 1
- dropbear for android error ` fstatat64(AT_FDCWD, "//.ssh` HOT 1
- Can I Replace LibTomCrypt with OpenSSL? HOT 3
- Ability to configure the `authorized_keys` file HOT 2
- Error if I use scp from same network with python paramiko HOT 2
- cannot login just with private key HOT 2
- Long time to authorize HOT 15
- Make dropbearkey as ssh-keygen HOT 1
- The terminal process cannot be closed correctly HOT 5
- How do you change the port number for SSH server? Where is the dropbear configuration file located? HOT 2
- Dropbear limited scalability HOT 1
- how to set the unlock time for user using dropbear? HOT 2
- -static-pie: Aiee, segfault! You should probably report this as a bug to the developer HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from dropbear.