New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

disable sha1-based key exchanges #64

Closed
bkw opened this Issue Jan 7, 2015 · 5 comments

Comments

Projects
None yet
5 participants
@bkw
Contributor

bkw commented Jan 7, 2015

Following the very interesting post https://stribika.github.io/2015/01/04/secure-secure-shell.html by @stribika I think it would make sense to at least offer an option to disable sha1-based key exchanges on systems that support better ones.

What do you think?

@chris-rock

This comment has been minimized.

Show comment
Hide comment
@chris-rock

chris-rock Jan 7, 2015

Member

@bkw will study this in-depth

Member

chris-rock commented Jan 7, 2015

@bkw will study this in-depth

@stribika

This comment has been minimized.

Show comment
Hide comment
@stribika

stribika Jan 8, 2015

Having a strong hash there is what prevents downgrade attacks. The KDF at the end of the key exchange doesn't only take s as input, but also the supported list of algorithms and the basically arbitrary banners. That overview I included is... let's call it simplified.

If you try to downgrade, Alice will end up calculating
k = KDF(s || algo_list_alice || algo_list_nsa1 || banner_alice || banner_nsa1)
while Bob will calculate
k = KDF(s || algo_list_nsa2 || algo_list_bob || banner_nsa2 || banner_bob)
and end up with different keys.

Unless we are using a sufficiently broken hash. In that case, banner_nsa can be used to synchronize k again.

stribika commented Jan 8, 2015

Having a strong hash there is what prevents downgrade attacks. The KDF at the end of the key exchange doesn't only take s as input, but also the supported list of algorithms and the basically arbitrary banners. That overview I included is... let's call it simplified.

If you try to downgrade, Alice will end up calculating
k = KDF(s || algo_list_alice || algo_list_nsa1 || banner_alice || banner_nsa1)
while Bob will calculate
k = KDF(s || algo_list_nsa2 || algo_list_bob || banner_nsa2 || banner_bob)
and end up with different keys.

Unless we are using a sufficiently broken hash. In that case, banner_nsa can be used to synchronize k again.

@atomic111

This comment has been minimized.

Show comment
Hide comment
@atomic111

atomic111 Jan 8, 2015

Member

yes, this is a good point, but it should be configurable.

2015-01-07 18:48 GMT+01:00 Bernhard Weisshuhn (a.k.a. bernhorst) <
notifications@github.com>:

Following the very interesting post
https://stribika.github.io/2015/01/04/secure-secure-shell.html by
@stribika https://github.com/stribika I think it would make sense to at
least offer an option to disable sha1-based key exchanges on systems that
support better ones.

What do you think?


Reply to this email directly or view it on GitHub
#64.

Member

atomic111 commented Jan 8, 2015

yes, this is a good point, but it should be configurable.

2015-01-07 18:48 GMT+01:00 Bernhard Weisshuhn (a.k.a. bernhorst) <
notifications@github.com>:

Following the very interesting post
https://stribika.github.io/2015/01/04/secure-secure-shell.html by
@stribika https://github.com/stribika I think it would make sense to at
least offer an option to disable sha1-based key exchanges on systems that
support better ones.

What do you think?


Reply to this email directly or view it on GitHub
#64.

@arlimus

This comment has been minimized.

Show comment
Hide comment
@arlimus

arlimus Jan 12, 2015

Member

@bkw Thanks again for bringing this up :)
@stribika Thank you for your insights!

We'll add it to code this week.

Member

arlimus commented Jan 12, 2015

@bkw Thanks again for bringing this up :)
@stribika Thank you for your insights!

We'll add it to code this week.

arlimus added a commit to dev-sec/ssh-baseline that referenced this issue Jan 14, 2015

arlimus added a commit that referenced this issue Jan 14, 2015

remove sha1 key-exchange mechanisms from default
Move diffie-hellman-group14-sha1 and diffie-hellman-group-exchange-sha1 to 'weak' KEX mechanisms.

References:
* https://stribika.github.io/2015/01/04/secure-secure-shell.html
* #64

Signed-off-by: Dominik Richter <dominik.richter@gmail.com>

arlimus added a commit to dev-sec/puppet-ssh-hardening that referenced this issue Jan 14, 2015

remove sha1 key-exchange mechanisms from default
Move diffie-hellman-group14-sha1 and diffie-hellman-group-exchange-sha1 to 'weak' KEX mechanisms.

References:
* https://stribika.github.io/2015/01/04/secure-secure-shell.html
* dev-sec/chef-ssh-hardening#64

Signed-off-by: Dominik Richter <dominik.richter@gmail.com>

@arlimus arlimus closed this Jan 14, 2015

@arlimus

This comment has been minimized.

Show comment
Hide comment
@arlimus

arlimus Jan 14, 2015

Member

inclued in chef-ssh-hardening v1.0.3

Member

arlimus commented Jan 14, 2015

inclued in chef-ssh-hardening v1.0.3

arlimus added a commit to dev-sec/ssh-baseline that referenced this issue Oct 15, 2015

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment