61–70 of 88 posts
I'm not a security expert, so could one of the security experts who frequent HN weigh in on this? Otherwise this looks super cool.
Great to see protocol versioning over negotiation. I don’t think replacing OpenSSH is as important as wireguard replacing OpenVPN but it’s up there. Protocol tasting notes: - If you’re going to dole out PSKs, why care about signatures? If you’re going to dole out PSKs, why are they separate from the knock PSKs? (You sort of address this by sharing knock PSKs are per server and handshake PSK is per pair. But if I have…
Less tangibly, it can prevent an adversary from recording your traffic now, waiting until Quantum Computers are practical, breaking your public key crypto and reading your messages.
Sure, you can't just slap both modes together and claim the adversary has to break both, some care is involved, but it absolutely isn't strange at all.
tl;dr there are plenty of good reasons to use a combination of modes. Both Noise and Wireguard have built on support for strengthening public key crypto with psks.
>Memory Safe + Fast $ grep 'unsafe {' -R ~/oxy --include=*.rs | wc -l 13 Not bad.
- in ui.rs, for resetting the blocking state of stdin via fcntl
- in tuntap.rs, for an ioctl to do some tun/tap setup, and resetting errno beforehand
- in pty.rs, for ioctls for controlling terminal admin and setting the terminal size
- in util.rs, for getting the current UID, calling getpwnam or getpwuid, and extracting field values from the resulting passwd struct
I have to confess that i don't know the details of the Linux API well enough to know for sure, but they all look eminently reasonable.
Great to see protocol versioning over negotiation. I don’t think replacing OpenSSH is as important as wireguard replacing OpenVPN but it’s up there. Protocol tasting notes: - If you’re going to dole out PSKs, why care about signatures? If you’re going to dole out PSKs, why are they separate from the knock PSKs? (You sort of address this by sharing knock PSKs are per server and handshake PSK is per pair. But if I have…
The Noise framework (and Wireguard) deliberately support the combination of psk and public key authentication. One clear benefit is that you get redundancy against a failure in either mode. If your DH implemention is broken, the attacker still has to compromise your shared secret. Alternatively if the attacker compromises your shared secret, they still have to break your public key crypto. In short, its an excellent…
EDIT: I take it back: the keys _used_ to be 96 bits (example given in the protocol description), but are now 256 judging by the keygen code. Apparently (I'm spelunking in the bug tracker) they were short once because there was an attempt to make them diceware-style verbally transmittable? Regardless: at least it looks like an effective PQ measure assuming the key derivation works.
(Generally hedging against DH snafus makes a lot of sense to me, hedging against clients who can somehow manage to hold on to one kind of key material but not another is less convincing. I guess you could have P-256 on a smartcard and PSK on disk or something?)
Great to see protocol versioning over negotiation. I don’t think replacing OpenSSH is as important as wireguard replacing OpenVPN but it’s up there. Protocol tasting notes: - If you’re going to dole out PSKs, why care about signatures? If you’re going to dole out PSKs, why are they separate from the knock PSKs? (You sort of address this by sharing knock PSKs are per server and handshake PSK is per pair. But if I have…
Great to see protocol versioning over negotiation. I don’t think replacing OpenSSH is as important as wireguard replacing OpenVPN but it’s up there. Protocol tasting notes: - If you’re going to dole out PSKs, why care about signatures? If you’re going to dole out PSKs, why are they separate from the knock PSKs? (You sort of address this by sharing knock PSKs are per server and handshake PSK is per pair. But if I have…
https://github.com/oxy-secure/oxy/blob/571ef12199f8b0f3eca55...
What is the point of panic! after exiting the process?
Earlier quoted context omitted.
If it's virtue signalling to point out a lack of precision then...well...harrumph...etc
I think some people sometimes use guy in the more casual non-gender-specific way, myself included. Maybe it's a cultural or regional thing? And I guess it could be said that using guy is assuming the gender of someone, but one the other hand isn't that also assuming that the someone saying guy is making an assumption, etc, etc? Perhaps it's just a bit sad when a whole point is disregarded because of a single ambiguou…
And I agree with you about Mosh style features. That would be lovely.
Great to see protocol versioning over negotiation. I don’t think replacing OpenSSH is as important as wireguard replacing OpenVPN but it’s up there. Protocol tasting notes: - If you’re going to dole out PSKs, why care about signatures? If you’re going to dole out PSKs, why are they separate from the knock PSKs? (You sort of address this by sharing knock PSKs are per server and handshake PSK is per pair. But if I have…
If anyone knows rust better than I do: https://github.com/oxy-secure/oxy/blob/571ef12199f8b0f3eca55... What is the point of panic! after exiting the process?
Earlier quoted context omitted.
If anyone knows rust better than I do: https://github.com/oxy-secure/oxy/blob/571ef12199f8b0f3eca55... What is the point of panic! after exiting the process?
There isn’t one. They even had to suppress a warning about how the code can never be reached.
Great to see protocol versioning over negotiation. I don’t think replacing OpenSSH is as important as wireguard replacing OpenVPN but it’s up there. Protocol tasting notes: - If you’re going to dole out PSKs, why care about signatures? If you’re going to dole out PSKs, why are they separate from the knock PSKs? (You sort of address this by sharing knock PSKs are per server and handshake PSK is per pair. But if I have…
The Noise framework (and Wireguard) deliberately support the combination of psk and public key authentication. One clear benefit is that you get redundancy against a failure in either mode. If your DH implemention is broken, the attacker still has to compromise your shared secret. Alternatively if the attacker compromises your shared secret, they still have to break your public key crypto. In short, its an excellent…
The code relying on that just extends the generated key with the statically found key, so it appears to be fine as long as you just chuck enough entropy in. So it appears an empty shared secret would just do what you'd expect: just the DH bit.