[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <200805162136.06872.rbu@gentoo.org>
Date: Fri, 16 May 2008 21:36:06 +0200
From: Robert Buchholz <rbu@...too.org>
To: oss-security@...ts.openwall.com
Subject: Re: OpenSSH key blacklisting
Thanks for bringing up the topic here.
On Friday 16 May 2008, Solar Designer wrote:
> Are any other distros, besides Debian, Ubuntu, and derived ones,
> going to implement key blacklisting in OpenSSH - or are considering
> it?
>
> We are considering it for Openwall GNU/*/Linux, and if our effort
> would be reused by others, or if others join us in developing and/or
> testing the patch, this would be a reason for us to go for it.
Gentoo is discussing the feature in bug #221759 [1]. Until now, I have
not heard a reaction to the patch from our OpenSSH maintainers, so I
cannot judge on the technical side of the inclusion.
> I don't think we'll take the Debian/Ubuntu patch as-is. Rather, we
> are likely to use a trivial binary encoding/compression method for
> the partial fingerprints. We'd also use smaller partial
> fingerprints. With the approach I have in mind, it'd take around
> 4.55 bytes per key to store 48-bit partial fingerprints, bringing the
> installed file size for 3 arch types and 2 key types/sizes in under 1
> MB (or just over 1 MB for 3 key types/sizes).
I assume whichever version has the acceptance of the OpenSSH upstream is
what most of us would be willing to go with. Did you discuss either
blacklist format with them already?
Personally, I would like to see the feature ported to our distribution
sooner than later, but neither at the cost of maintaining patchsets for
the rest of existance, nor with high transition cost once upstream
accepts another format.
Robert
[1] https://bugs.gentoo.org/show_bug.cgi?id=221759
Download attachment "signature.asc " of type "application/pgp-signature" (198 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
