TinySSH is a small SSH server using NaCl, TweetNaCl • Hacker News Board

Re: TinySSH is a small SSH server using NaCl, TweetNaCl

#31

Post by higherpurpose » Sun, May 11, 2014, 12:48 PM UTC

edwintorok wrote: post #26

pjscott wrote: post #15

Earlier quoted context omitted.

The usual problem with DJB's implementations is not that they're incorrect or slow or insecure -- far from it! -- but that they're awkward to integrate with the rest of the world, may require weird build configurations, and are hard for anybody else to modify. Well, TweetNaCl is really easy to integrate with the rest of the world, since it's just a single portable .c file, and the speed is surprisingly good, and its…

I see 3 alternatives: use the original NaCl, use the unofficial fork libsodium, or use TweetNaCl. The latter shares the same authors as the original NaCl, with the advantage of being much smaller. I don't like the fact that TinySSH modified TweetNaCl, and added back MD5: /* Based on tweetnacl 20140427 (http://tweetnacl.cr.yp.to software.html) - updated int/uint types to crypto_int/crypto_uint - added crypto_stream_ch…

That seems strange indeed. Some clarification is needed. Perhaps it's part of the whole NIST suite that's disabled right now?

Re: TinySSH is a small SSH server using NaCl, TweetNaCl

#32

Post by kzrdude » Sun, May 11, 2014, 1:00 PM UTC

nitrogen wrote: post #3

Is TweetNaCl deliberately 32-bit or LLP64 only? One of the first lines is typedef unsigned long u32; but on 64-bit LP64 systems (like Linux), long is 64-bits. See http://tweetnacl.cr.yp.to/20140427/tweetnacl.c

They seem to mask u32 values just fine everywhere, so u32 being larger than it has to is no problem.

ulong is as you know the smallest type that's always guaranteed to be at least 32 bits.

Re: TinySSH is a small SSH server using NaCl, TweetNaCl

#33

Post by edwintorok » Sun, May 11, 2014, 1:01 PM UTC

higherpurpose wrote: post #31

edwintorok wrote: post #26

Earlier quoted context omitted.

I see 3 alternatives: use the original NaCl, use the unofficial fork libsodium, or use TweetNaCl. The latter shares the same authors as the original NaCl, with the advantage of being much smaller. I don't like the fact that TinySSH modified TweetNaCl, and added back MD5: /* Based on tweetnacl 20140427 (http://tweetnacl.cr.yp.to software.html) - updated int/uint types to crypto_int/crypto_uint - added crypto_stream_ch…

That seems strange indeed. Some clarification is needed. Perhaps it's part of the whole NIST suite that's disabled right now?

It appears to be used only in tinysshd-printkey to print the key's fingerprint.

The fingerprint is 47 characters when printed, the key itself is 64. Since the key is so short does the fingerprint still server a useful purpose, or would it be enough to print only the key?

Re: TinySSH is a small SSH server using NaCl, TweetNaCl

#34

Post by eliteraspberrie » Sun, May 11, 2014, 1:02 PM UTC

nitrogen wrote: post #3

Is TweetNaCl deliberately 32-bit or LLP64 only? One of the first lines is typedef unsigned long u32; but on 64-bit LP64 systems (like Linux), long is 64-bits. See http://tweetnacl.cr.yp.to/20140427/tweetnacl.c

The name is a little confusing. The way u32 is used in TweetNaCl, it doesn't have to be exactly 32 bits, only at least 32 bits.

Re: TinySSH is a small SSH server using NaCl, TweetNaCl

#35

Post by edwintorok » Sun, May 11, 2014, 1:04 PM UTC

Nursie wrote: post #13

sanxiyn wrote: post #6

Earlier quoted context omitted.

Yes, TweetNaCl is. TweetNaCl's goal is to be auditable, not to be portable. On the other hand, TinySSH actually includes a configuration mechanism to detect integer sizes, and modifies TweetNaCl accordingly, so TinySSH is not 32-bit/LLP64 only.

I wonder why not just use stdint.h, it's got what you need. ..

stdint.h is C99 and while I'd love to believe that every C compiler is C99 capable by now, I don't know if that is actually the case. Does stdint.h exist on Win32 these days?

Re: TinySSH is a small SSH server using NaCl, TweetNaCl

#36

Post by X-Istence » Sun, May 11, 2014, 1:14 PM UTC

tinco wrote: post #19

What use is an sshd that doesn't support SCP? I think to most people that is a core feature, I'd be surprised if it wasn't a requirement for git for example. It sounds like it's small enough perhaps for a direct port to a safe language like rust, that would be interesting (to me at least).

Git doesn't require scp.

Re: TinySSH is a small SSH server using NaCl, TweetNaCl

#37

Post by akerl_ » Sun, May 11, 2014, 1:16 PM UTC

Awesome! A few questions/thoughts:

Right now, you're suggesting it be downloaded via HTTP, which isn't exactly the best way to get my secure daemons. Any chance you could move that to HTTPS?

Semi-related: any chance you'll be making a repo available in some form? (I'm preferential to GitHub, but really anything that lets us follow source changes and open bug reports would rock)

I would love to see an audit of this by some 3rd party entity.

Glad to see folks working to build new tools from such solid building blocks!

Re: TinySSH is a small SSH server using NaCl, TweetNaCl

#38

Post by brians » Sun, May 11, 2014, 1:24 PM UTC

baudehlo wrote: post #30

tinco wrote: post #19

What use is an sshd that doesn't support SCP? I think to most people that is a core feature, I'd be surprised if it wasn't a requirement for git for example. It sounds like it's small enough perhaps for a direct port to a safe language like rust, that would be interesting (to me at least).

This should work perfectly well with rsync -e ssh. Which is what you should use anyway.

Rsync stats a bunch of files on both sides. There are plenty of cases where reading is much more expensive than writing at the destination---imagine Glacier, maybe.

Re: TinySSH is a small SSH server using NaCl, TweetNaCl

#39

Post by baudehlo » Sun, May 11, 2014, 1:27 PM UTC

brians wrote: post #38

baudehlo wrote: post #30

Earlier quoted context omitted.

This should work perfectly well with rsync -e ssh. Which is what you should use anyway.

Rsync stats a bunch of files on both sides. There are plenty of cases where reading is much more expensive than writing at the destination---imagine Glacier, maybe.

Sure but I don't think you can scp to Glacier either.

Re: TinySSH is a small SSH server using NaCl, TweetNaCl

#40

Post by Nursie » Sun, May 11, 2014, 1:31 PM UTC

edwintorok wrote: post #35

Nursie wrote: post #13

Earlier quoted context omitted.

I wonder why not just use stdint.h, it's got what you need. ..

stdint.h is C99 and while I'd love to believe that every C compiler is C99 capable by now, I don't know if that is actually the case. Does stdint.h exist on Win32 these days?

Microsoft's poor support for standard C is no excuse not to use these types everywhere else and either define them yourself on windows or get stdint from boost, from one of the stdint.h replacements or from MSVC 2012.

IMHO, of course.