IETF Logo Mail Archive

[saag] Side-comment: SSH issues (was: New Version Notification ...)

Peter Gutmann <pgut001@cs.auckland.ac.nz> Sat, 30 November 2024 02:01 UTC

Return-Path: <pgut001@cs.auckland.ac.nz>
X-Original-To: saag@ietfa.amsl.com
Delivered-To: saag@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7A585C16941D for <saag@ietfa.amsl.com>; Fri, 29 Nov 2024 18:01:33 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.005
X-Spam-Level:
X-Spam-Status: No, score=-2.005 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_BLOCKED=0.001, RCVD_IN_MSPIKE_H2=-0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=cs.auckland.ac.nz
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BsgwvZUDAW7F for <saag@ietfa.amsl.com>; Fri, 29 Nov 2024 18:01:28 -0800 (PST)
Received: from AUS01-SY4-obe.outbound.protection.outlook.com (mail-sy4aus01on2156.outbound.protection.outlook.com [40.107.107.156]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-384) server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 407EEC169407 for <saag@ietf.org>; Fri, 29 Nov 2024 18:01:27 -0800 (PST)
ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=jxCquIq7FLnkvRhb4SS5qEqH7vrM5v/vwwoO2Nyp5PVCLxVvmN1OtOR15hGdMzZVsTXKWGk0sxoIfNKClHKYOt4vdWDRvsSvaNZUBbUY2kGoGvf8BQvPmP2mWrwTU3nl73FExgy9uNbdpIZnMbYfKC+m07q13MsrfGWuniMbkCT3Lzkm1CgmU+nzc9MbpqRk1IGZuDJQeIXf6+n/wQxd6HAxtfm1r0SsmaM/+FPB4IHW9o6m++k7HEJROs5WVu6m7NfSWclVuU+Dtd+eO8vzVzuAvRS0FOkwlE4ANmhLXh3ahAqJpRbIVPaa0lnjC3Wv+dqWsy/FcXOSDBzrV7NirA==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=JwLzNPwJhPZ08m5MEfhivyoTvJGwyX6B0nFMLkjSECk=; b=LAnhe+hk/EWNb8Id3ohQYIRrcFuFWrN5jtD2szRuyUngnYhah9ESRqQTTTJ9bc2/MBOEshvQGRBkO5HNa7Pbp81Yta6oz4zRQ+FrFtPhgZm/Dq93eVyRCR7cX3hoGei/vosBnmuBNLK/aBizJIHC1ApQxPy1PzPkfnLPvQ2di0N5MtMi7iNOyZz1tU7ZGT9VNp9Xbm3j5LifSZlj9b6LFiCjARb3qIMAG+/5iPJd23N//40XP0Y2bGNgcx9WssWTrjRo14CzuAyFFdlJG2mBK2PDvyflmmyiomY1tzgTU3jkwkfr8AtjGdPdZR8QuaZdc3Nb4Jw+D1QYv2BPuiJ8ug==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cs.auckland.ac.nz; dmarc=pass action=none header.from=cs.auckland.ac.nz; dkim=pass header.d=cs.auckland.ac.nz; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cs.auckland.ac.nz; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=JwLzNPwJhPZ08m5MEfhivyoTvJGwyX6B0nFMLkjSECk=; b=S5OepTrvBNTiENlSpZgYfoJPNpSo16SQ7bRiA7ndumcUERUSerpQLS0EIvh6uS2SUNa/6ukRMVyEptDRS3bv1+ifgLNCBPkSsXXfDprqjq4vczW22q/Up1/dkKQVH+gNm2aWLq6HQlL///VVSb3ZVHATVZzdqmWh5b53IaayAbxtK6qfw+llk5PHH1gw3jmUBN5RWJlgHtUO/WHfj158aEzM0bk+BBMdBnAtuIUplDxjLQABimTD1P4dvosYAkPE/D1Q6adKB/2ZxEWW2V9HWTxbXH41eBT+VTPa2JUULk7KUyxFhwCLK1PMtvIfkVLSO5ll62oRWWqi/8uNHNHeIA==
Received: from ME0P300MB0713.AUSP300.PROD.OUTLOOK.COM (2603:10c6:220:229::18) by SY7P300MB1392.AUSP300.PROD.OUTLOOK.COM (2603:10c6:10:2c2::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8207.15; Sat, 30 Nov 2024 02:01:24 +0000
Received: from ME0P300MB0713.AUSP300.PROD.OUTLOOK.COM ([fe80::2b6:430a:4d2a:5c52]) by ME0P300MB0713.AUSP300.PROD.OUTLOOK.COM ([fe80::2b6:430a:4d2a:5c52%3]) with mapi id 15.20.8207.014; Sat, 30 Nov 2024 02:01:24 +0000
From: Peter Gutmann <pgut001@cs.auckland.ac.nz>
To: Paul Wouters <paul.wouters=40aiven.io@dmarc.ietf.org>, Watson Ladd <watsonbladd@gmail.com>
Thread-Topic: Side-comment: SSH issues (was: New Version Notification ...)
Thread-Index: AQHbQsvChYOTO6+fbUuWHj7SgKzQNw==
Date: Sat, 30 Nov 2024 02:01:24 +0000
Message-ID: <ME0P300MB0713FF985B5D9F60B9327EFDEE2B2@ME0P300MB0713.AUSP300.PROD.OUTLOOK.COM>
References: <CACsn0c=H21Tj=UxGMGCey1q=Rw9R9KgysOEhWyv78YU6G5vqFQ@mail.gmail.com> <5F652C61-E35E-4B0D-8D7A-4BD56A624772@aiven.io>
In-Reply-To: <5F652C61-E35E-4B0D-8D7A-4BD56A624772@aiven.io>
Accept-Language: en-NZ, en-US
Content-Language: en-NZ
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
msip_labels:
authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=cs.auckland.ac.nz;
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: ME0P300MB0713:EE_|SY7P300MB1392:EE_
x-ms-office365-filtering-correlation-id: 19d64e15-c6b9-469b-74d9-08dd10e2e505
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam: BCL:0;ARA:13230040|366016|376014|1800799024|38070700018;
x-microsoft-antispam-message-info: FwDij69PQ2m/SWlVlViWKt6hNYw58KjQJHyAgVGyx3anXn6OTGgkaDsEH3z0rb1wtfc11xdrFDlTck79+Xn7ZGkDQY4ksqyVG/zmLondZ4QCT40qeiXG0+1x9Vz/tX2qLYEVJt/5pC9RtlWo2J4ixiotto1ICVHSG1ux16Cegk1dI+sDOsQ0F72wD2IRQMgrVd+y3SdJQ0SsZGVlxhNN7ifhx+Uo33X/7rr/ULMysyMp8XvfBVW4Ey10YZosIFMD00bu1TULcaC/vqFpNHkSffpJK1QpoQcHPdillJ4dCK76j7X8Xvse7crcRU3mMhmcbnOSMOs01IBn0Rj61CD8Xkf5hREl1hIZuypUCrSGZzoZaOqQ/H6RjvqPXxzIakhAVpukqDLP6FpS4LsktTkDG8c2y/Sc8uC0J7E4mxDumitQIv3Mv6fSQFj7MU1Yb1KWvvnh2/JN1WjdnOB1noszNNnwwNA/f3RMip7/JjLij6ifFdus34RVgIWDQDYAYjpc707xJ/3rdSXe1x+LhwsJdJfb7h65IPkVDSVVCYyImX2rntdaiBqwgn8uytIRmxZh/zkiJ3YQ10TEAgjOrdK6y601Tzgvas5p3OdILI8qrlBFMuz66zNgN3CFTqJNhGuMgrDUczWDuw/q2wzhpCQICnLV4URDd+1S6Vevve+LTXShoT7ju+Cn0tZz0nral1UKC26qYgM+Z+b1cSsbGBsOmosenjQL8L/qt+UoqHEySFrffMrMZvPvibgbSXrzwrM68H+14U12opLHwGeGXtTXXYFpgj2v4tCTW2we60tLB2M4wcJl8bmwLA62iB3M+/0qovojfZs7BWtv06oYIXK5uGDbcDnSIfyDYDLI57dpNv7x4oMIO2ayOAmoyZksaZaJavhrcYCsKOeJiJ+KrDex/Ap8APIH27DpkBsb2QNiMBKbYa2mJzHlKtkOf7s35uSvL9vw/s4qMmmpN9NUpr7akPNOovUyA5WCPlxgxV5WAzpuoVfUYIx/Ss094bpYR/wiH+AqIN4Z2CO5z9tNZAqhTf8EnStVrTM3WWbpS9CMVL1sWUK/hHpgLYZPweNzYIJGlh2up9BRmCQvEnGu/8j2/3Uzopr2PZvwXamfbWhFDODzfiD1QgcSJssXekzl/DQWVN5saflAjPzjg50tON9N0YfUiLioh2Ptu9d/i1A1q3BCq4YJ5jPmI7shWsaZEb3KYMDYInNwFtVN0TJkoOsdPZBmiCfDvXAM8XAAKBTGlr81H5KGlFIeFr4UUjCmeHFM8a9Xt1eO1czFYDNIuh1wATWzstoXZazcyuAbm82lhJJ/IVtyBxm/ZYd6aDbt0stxWQDZ06BSi5T6Dz+2sZJEPVaNTByBQMNzAEbclHCs590SbnLvtJnjF6EKxd20buYcJtdi/OEtUVd9bUFGXBRhiA==
x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:ME0P300MB0713.AUSP300.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(366016)(376014)(1800799024)(38070700018);DIR:OUT;SFP:1102;
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: r+k4/euA/Yq/DbUwRtnXzenTih70i4+S6VPwrvGQRIkyz4/uXWVt2HPSoWpdlRFRtyXHNsEQlubfJ1m/0dh57UnRP+zrXiwWAK6m5W/KPChs+cck8QWtEPztKU6A/zf4va4ItG+B73T5HEyyGgqUM8mpJZrIIuNzEL33PSuI0Dl52BEtFqE0GhIkNv7TXmX5oKIlble7VIodDA2tPYKqPYWVAr/BrIMrIspxJ2FgFu4iOdb44ufBXTkzN2T1fyZL0W620mRouIUnhO1cI7KnompIcQXTSzeztdf8Jrlbdy77psMkAKqjYNd4X7WCaXYpRRJZWnmGUa94hsX90m3dNPA76spWepPbqxB+p2GrvIklU7BXsLgLv8B3TE70qYkvgKAnRbblfT1qQEl2cJ2GWCtw5GAuYIJyOXDsBFC4UTgepTSjM2ShQY46S3Hqgdft1IJk4SxUoYGPGlB79gayAI4XltNchdoHTsnG1gw9sT9K4SZf6UuWF9fMGcRG1JLEce3cF7jwP+h3V0kCCd0ZFt6mvzSCfECady11q9dQD4V23z6XnnsqZig0PbRNKScd/jvMlhh3Y2Psw/wexw201g1BkZmtOSZsnGTUgNO2Pdk5Bs+oE3SsEwlpsVMdHAQoOn9yBCSROEiqekhi+3UEFx3O7Tr8jasOiuGFgVXg++QdwKnWvVh0T9HJRpwjFmWfuO/kSPOCm8ZHL7OdgOg0S8hxA1llC1OOEE5C0yW56bX53hifNhs0Ehaw2YGy7vuD6B3JmCJEiIbbhp0r7ZdXAoAvaDha7JBzZd3crZtmqxR8SLpzmRRLdqembRyWYJUEdYA/ivWBADc3xezlscnV5BOly+UWHpdF5eVe82i98NPhdpFXfs1BASMaopwUYPV0zkgd3BXkCui+2ofV8xSyzmDUrnegRrxVtQ0W98PVK77PN+mtCs8gkwgz79Lp9FBzGYDTjqGxa5+HyLjEcTyZ230okD1GQzZxaxCvZhD8Hmo+4VHmM4dxB7zi3gXCHe+PcTUfHp+gL1UNFrGRpyvz6gCAZxj1yNkXugcO/hSv0wo3ckBftm+Y+PjLYpqrH+jaSqdsyEOQlYCVxAXwBt2kreQ/a+pupK8UJRwRKmHDENZuZXTEY59Sf4l9HqpUuae6u8kOf7TAkm1CmQbGtGSLmria9Yq7v3lvx4eZvxvoyg/N8JXzNoYsf0vvsrSsckeeHfn+XIcRYoTqqei32UbQ9C2MVXQWBE08cfddRzGlDWHR/ZYe/dwoi/4M92MOeSfRP2bbsSSVxFyW3bV6X1C82lh51GuLDo03Ykc5M7iLYuF+NrRkZP71b70LB6Ai9093TDcEj2pX4aYhGEaAVTTfaOEgXWarN41OMtV1B/DS4dcTAm3KN1dB7PbfEbgeYlGDK/SnS8+CaBY45Vh2aKrEojFP3fQKogqM8dl89MiHwGBY/dj3H5ZWqLO9zOyEC5j1cawkVug1lFhyZYu4lOGMYJCDCPMmX+Mr3tww+sBdVOCvMRtKWd1JiL4Su/7a/OxLedGaYyqRgs1DLEsnixV2cjIMX9DjRTq8Eb/wsaIiDxsVK7u3h5gXnAsh2r2lTFah
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: cs.auckland.ac.nz
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: ME0P300MB0713.AUSP300.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-Network-Message-Id: 19d64e15-c6b9-469b-74d9-08dd10e2e505
X-MS-Exchange-CrossTenant-originalarrivaltime: 30 Nov 2024 02:01:24.7145 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: d1b36e95-0d50-42e9-958f-b63fa906beaa
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: 0dfN3DiX1n6Z9/VEOlpoCIphaU+OCTC33/W0L1RsuQQ2LUL/L0bX57WehqvhyJPTwyTCA9EzijvlAR0FbOGfY5nSHZ5dllZ7QGLCELA1/3U=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SY7P300MB1392
Message-ID-Hash: JDV5LSLOSVUUIP2LBNSES7JVU47PBO4K
X-Message-ID-Hash: JDV5LSLOSVUUIP2LBNSES7JVU47PBO4K
X-MailFrom: pgut001@cs.auckland.ac.nz
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-saag.ietf.org-0; header-match-saag.ietf.org-1; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: Simon Josefsson <simon@josefsson.org>, Tero Kivinen <kivinen@iki.fi>, Damien Miller <djm@mindrot.org>, IETF SAAG <saag@ietf.org>
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [saag] Side-comment: SSH issues (was: New Version Notification ...)
List-Id: Security Area Advisory Group <saag.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/saag/OYNHcK6MpcmVjw6Bq3cjCJI82i4>
List-Archive: <https://mailarchive.ietf.org/arch/browse/saag>
List-Help: <mailto:saag-request@ietf.org?subject=help>
List-Owner: <mailto:saag-owner@ietf.org>
List-Post: <mailto:saag@ietf.org>
List-Subscribe: <mailto:saag-join@ietf.org>
List-Unsubscribe: <mailto:saag-leave@ietf.org>

[Changed the topic slightly since it's not part of the current thread, just a
 side-comment]

Paul Wouters <paul.wouters=40aiven.io@dmarc.ietf.org> writes:

>the SSH protocol doesn't even ensure both peers experienced the same
>handshake content using a cryptographic signature. 

At least it authenticates the entire client and server hello (KEXINIT) rather
than just the nonces while ignoring everything else that's there, but yeah,
that does seem like a pretty straightforward thing to fix.

Maybe I should do an independent-submissions-stream draft...

Peter.

v2.29.0 | Report a Bug | By Email | System Status