Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SSH gets protection against side-channel attacks

undeadly.org

Post reply on HN
Print view View original

31–40 of 166 posts

Re: SSH gets protection against side-channel attacks

#31

Post by mehrdadn »

bigato wrote: post #12
mehrdadn wrote: post #9

Earlier quoted context omitted.

Far more important than that what I want to know is whether I should even care, e.g. is there any evidence of Spectre being used in the wild or not.

A vulnerability that has been shown to work should not be patched in the software more widely used around the world to connect all kinds of linux/unix servers and even other systems? They should wait for it to start getting exploited "in the wild"? I'm just glad that the security of my systems does not depend on people with this kind of attitude.

Where did I say it shouldn't be patched? I just said this is information I think a user would care to know along with the patch.

Re: SSH gets protection against side-channel attacks

#32

Post by namibj »

tremon wrote: post #26
castis wrote: post #24

Earlier quoted context omitted.

The point is that we'd like to know that its not heavily degrading to the existing purpose. No one said anything about high performance.

What part of the existing purpose is performance-critical?

Tanking DDoS? Like, the more connections you can handle normally, the less filtering you need to do on incoming connections?

Re: SSH gets protection against side-channel attacks

#33

Post by ryanlol »

castis wrote: post #29
tremon wrote: post #26

Earlier quoted context omitted.

What part of the existing purpose is performance-critical?

I dont understand the purpose of this question. The existing purpose is that it works at all?

I’m really not convinced that this is a realistic concern.

And anyway, what you’re posing certainly isn’t a performance concern, but a “does the software work” concern.

Re: SSH gets protection against side-channel attacks

#35

Post by ryanlol »

namibj wrote: post #32
tremon wrote: post #26

Earlier quoted context omitted.

What part of the existing purpose is performance-critical?

Tanking DDoS? Like, the more connections you can handle normally, the less filtering you need to do on incoming connections?

OpenSSHd does not “tank DDoS”, it’ll simply consume all resources available to it if attacked.

The only way to mitigate such an attack would be to drop it before it reaches the SSH daemon.

Re: SSH gets protection against side-channel attacks

#36

Post by latchkey »

Koffiepoeder wrote: post #10

RAM encryption for sensitive data is overlooked in so many applications, even "highly secure" applications like veracrypt [0] only recently started adding it. In my opinion server-applications of all sorts should encrypt their private keys by default; this makes cold-boot attacks and other memory-escape attacks so much harder, since now two totally unrelated memory chunks have to be combined in order to retrieve the…

AMD has some interesting work in this area.

https://github.com/qemu/qemu/blob/master/docs/amd-memory-enc...

Re: SSH gets protection against side-channel attacks

#37

Post by castis »

ryanlol wrote: post #33
castis wrote: post #29

Earlier quoted context omitted.

I dont understand the purpose of this question. The existing purpose is that it works at all?

I’m really not convinced that this is a realistic concern. And anyway, what you’re posing certainly isn’t a performance concern, but a “does the software work” concern.

"I’m really not convinced". Ok great thanks, neither is anyone else, which is why we'd like numbers.

Re: SSH gets protection against side-channel attacks

#38

Post by mehrdadn »

pixl97 wrote: post #13
mehrdadn wrote: post #9

Earlier quoted context omitted.

Far more important than that what I want to know is whether I should even care, e.g. is there any evidence of Spectre being used in the wild or not.

Ah yes, I too love the panicked rush of trying to force application vendors to patch once we we discover something is being exploited in the wild. Remember defense is depth is a valid strategy.

What I was trying to say was I think library users care to know how urgent it is. If this is being used in the wild then application vendors might need to provide out-of-band patches somehow, and end users should rush to get those patches. If OTOH this is known to be extremely hard to pull off and not known to be used, then it'd be nice for users to know that just the same. Nowhere was I trying to suggest they should avoid providing the patch altogether or something.

Re: SSH gets protection against side-channel attacks

#39

Post by dangerface »

yjftsjthsd-h wrote: post #5

Unfortunate that there's no commentary on performance impact. It's symmetric encryption on a few kB, so probably fast, but I'd like to have numbers.

It's not mentioned because it's irrelevant. There is no security / performance trade off for a secure program. It's secure or its not.

Re: SSH gets protection against side-channel attacks

#40

Post by bigato »

mehrdadn wrote: post #31
bigato wrote: post #12

Earlier quoted context omitted.

A vulnerability that has been shown to work should not be patched in the software more widely used around the world to connect all kinds of linux/unix servers and even other systems? They should wait for it to start getting exploited "in the wild"? I'm just glad that the security of my systems does not depend on people with this kind of attitude.

Where did I say it shouldn't be patched? I just said this is information I think a user would care to know along with the patch.

You said you shouldn't care if it was not found in the wild, this is just wrong
Post reply on HN