TinySSH is a small SSH server using NaCl, TweetNaCl
1–10 of 128 posts
Re: TinySSH is a small SSH server using NaCl, TweetNaCl
#2Poor, poor site. They got HN hug of death.
Re: TinySSH is a small SSH server using NaCl, TweetNaCl
#3Re: TinySSH is a small SSH server using NaCl, TweetNaCl
#4What is the difference between this and dropbear ssh?
Re: TinySSH is a small SSH server using NaCl, TweetNaCl
#5What is the difference between this and dropbear ssh?
I don't think there's much of one. The concept in itself isn't really useful, I've never seen someone go "you know the real problem with sshd? It's too bloated".
It is slightly useful to put in smaller devices that don't have much space but I think it still relies on top many linux facilities to be an appropriate fix for that too. Still, cool project.
Re: TinySSH is a small SSH server using NaCl, TweetNaCl
#6What is the difference between this and dropbear ssh?
This server is very restricted compared to dropbear.
-passwords are not allowed, only keys
-only a single AEAD cipher is supported, and a single elliptic curve for key exchange
-root cannot be locked out with this server
-the key restrictions available in OpenSSH are not supported
-the server does not use dynamic memory, and has a better security record than dropbear
Re: TinySSH is a small SSH server using NaCl, TweetNaCl
#7What is the difference between this and dropbear ssh?
It is smaller and supports less features. Dropbear does password auth and x11 agent forwarding iirc.
Re: TinySSH is a small SSH server using NaCl, TweetNaCl
#8What is the difference between this and dropbear ssh?
Dropbear claims to be RFC-compliant, but isnt.
Proof here: https://www.cvedetails.com/cve/CVE-2021-36369/
TinySSH doesnt claim to be compliant, and isnt. Does less in exchange for a reduced attack surface.
Re: TinySSH is a small SSH server using NaCl, TweetNaCl
#9What is the difference between this and dropbear ssh?
dropbear has the goal of being small and light on ressources while still providing featurefull ssh support.
tinyssh is small because it only implements a tiny subset of SSH that is needed for secure basic SSH connections. It only includes few crypto primitives excluding even RSA.
There is considerable overlap in the two and you can reach something similar to tinyssh by compiling dropbear with only few select features, but tinyssh aims to be as secure and attack surface minimized as possible out of the box.
Another notable difference:
> no dynamic memory allocation - TinySSH has all memory statically allocated (less than 1MB)
Re: TinySSH is a small SSH server using NaCl, TweetNaCl
#10What is the difference between this and dropbear ssh?
I don't think there's much of one. The concept in itself isn't really useful, I've never seen someone go "you know the real problem with sshd? It's too bloated". It is slightly useful to put in smaller devices that don't have much space but I think it still relies on top many linux facilities to be an appropriate fix for that too. Still, cool project.
I suspect the average openssh-server user just uses it for remote terminal access and copying files. Reducing the attack surface by dropping features and outdated standards is certainly valuable.