berryssh 0.8.0

A general audit of the code, and what it turned up.

No live vulnerability was found. The critical paths — AEAD authenticate-then-decrypt, the low-order point check and signature verification in the key exchange, bounds checks before every allocation, the host key check across a rekey — all hold.

Five findings, all now fixed:

• One byte comparison instead of four (#54). Two were constant-time and two were not, with nothing at a call site to say which. Not exploitable, since the early-exit pair compared public host keys, but the next thing needing comparison might be a tag.
• The server's banner is shown (#55). It was being read and dropped, so a notice about an expiring password or an environment you had landed on went nowhere.
• Leaving says so (#56). The client now sends SSH_MSG_DISCONNECT instead of dropping the socket, so a user who chose Disconnect no longer looks to the server like a handset that fell off the network.
• A bridge catalogue you backed out of stays gone (#57). It used to arrive seconds later and take over the screen.
• Less duplication and less dead code (#58). Three copies of the same line reader became one, and Profile's convenience constructors — one of which had already caused a bug by dropping a field — are gone.

230 offline vectors and 41 against a live OpenSSH.

berryssh 0.7.0

An authenticated bridge, so the handset can reach a tailnet it cannot join.

The bridge now proves a shared key before it will connect anywhere, and answers with the names it will connect to rather than taking an address — so no IP is ever typed into the phone. See tools/wsbridge-install.md for the server half, including the Tailscale policy that bounds what a compromised bridge could reach.

Two fixes on the way: host keys are now stored per bridge target, so two machines behind one bridge no longer look like one machine whose key keeps changing; and a bridged connection with no saved password no longer loses its WebSocket path at the password prompt.

Profiles are format 4; connections saved by 0.6.0 still load.

berryssh 0.6.0

Adds SSH over a WebSocket, so the handset can reach a network whose only public entrance speaks HTTP — no VPN client and no open router port. See tools/wsbridge-install.md for the bridge.

Also in 0.5.0 and since: drawn connection screens, saved connections, public key authentication, colour, cursor, scrollback, Turkish and box-drawing glyphs, and surviving the rekey OpenSSH asks for after an hour.

berryssh 0.5.0

An SSH client for BlackBerry OS 7.x, in plain MIDP 2.0 / CLDC 1.1.

No RIM APIs, so no code signature is needed — the jar contains no reference to
net.rim, which is checkable rather than merely claimed. It speaks
curve25519-sha256, ssh-ed25519 and chacha20-poly1305@openssh.com: the
algorithms a current OpenSSH offers by default, so a twenty-year-old handset
reaches a modern server without that server being weakened to meet it.

Install by opening berryssh.jad in the device's own browser, over plain
HTTP — the OS 7 trust store predates every currently issued CA, and its browser
cannot negotiate TLS 1.2.

In this release

• Saved connections, on screens drawn rather than left to MIDP's own forms
• Password and public key authentication; OpenSSH accepts a signature we make
• Host key confirmed on first contact, refused on mismatch, stored in RMS
• Colour, a cursor, scrollback, and a generated font atlas covering Turkish and
  box drawing
• Survives the rekey OpenSSH asks for after an hour, which used to kill the
  session

Verified against two OpenSSH installations: 200 offline vectors and 32
tests against real servers, including a full shell session.

Known gap — the raw key codes for the BlackBerry's own Escape, Menu, Symbol
and Alt keys have not been read off the hardware, so those keys are unmapped.
Ctrl and Esc are on the menu meanwhile. See #11.