Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenSSH 9.5 released with keystroke timing obfuscation

lwn.net

Post reply on HN
Print view View original

41–50 of 60 posts

Re: OpenSSH 9.5 released with keystroke timing obfuscation

#41

Post by tptacek »

DiabloD3 wrote: post #39
botanical wrote: post #7

Earlier quoted context omitted.

Somehow I've never heard of Curve448 or the company Rambus. It's giving me (unfounded) Crypto AG vibes. https://en.wikipedia.org/wiki/Crypto_AG

My fellow comments aren't actually getting to the point: The original release of the Pentium 4 used Rambus RAM, instead of the JEDEC standard of the time. This Pentium 4 was released in the year 2000. So, yes, Rambus, the company, is a known quantity. Just weird they're into crypto now, because trying to wiggle into this already crowded patent landmine is certainty an... interesting choice.

They bought Paul Kocher's Cryptography Research in 2021. Cryptography Research designed the Blu-Ray BD+ licensing system and owned a huge IP portfolio on differential power analysis, a technique Kocher, one of the godfathers of side channel cryptanalysis, invented. They also ran (run?) one of the industry's best cryptographic consultancies. If you're a major hardware vendor going to market with a new cryptographic coprocessor, you're very likely going to engage Rambus.

Re: OpenSSH 9.5 released with keystroke timing obfuscation

#42

Post by tptacek »

botanical wrote: post #7
throw0101a wrote: post #3

More importantly (IMHO): ssh-keygen(1): generate Ed25519 keys by default. Ed25519 public keys are very convenient due to their small size. Ed25519 keys are specified in RFC 8709 and OpenSSH has supported them since version 6.5 (January 2014). * https://www.openssh.com/releasenotes.html#9.5 Previously, if you didn't specify "-t", you got RSA keys; now you get Ed25519, and if you want RSA you have to ask for it. NIST's…

Somehow I've never heard of Curve448 or the company Rambus. It's giving me (unfounded) Crypto AG vibes. https://en.wikipedia.org/wiki/Crypto_AG

This comment is cringe enough that it is making the rounds on multiple Slacks. It's fine that you've never heard of Curve448. That just means you're not a cryptography engineer. Most people aren't! But if you're not one of those, be a little careful about connecting the dots to things like "Crypto AG". Saying "I've never heard of Curve448, it sounds sketchy" is a little like a systems programmer saying "I've never heard of Paxos before, it sounds sketchy". Most systems programmers are never going to do anything with Paxos. But all the competent ones can look it up in about 20 seconds and confirm that it isn't a conspiracy.

Re: OpenSSH 9.5 released with keystroke timing obfuscation

#43

Post by dang »

Tempest1981 wrote: post #17

More from last month: https://news.ycombinator.com/item?id=37307708 (258 comments)

Thanks! Macroexpanded:

Keystroke timing obfuscation added to ssh(1) - https://news.ycombinator.com/item?id=37307708 - Aug 2023 (255 comments)

also:

Timing Analysis of Keystrokes and Timing Attacks on SSH (2001) [pdf] - https://news.ycombinator.com/item?id=18557916 - Nov 2018 (17 comments)

Re: OpenSSH 9.5 released with keystroke timing obfuscation

#44

Post by rdtsc »

botanical wrote: post #7
throw0101a wrote: post #3

More importantly (IMHO): ssh-keygen(1): generate Ed25519 keys by default. Ed25519 public keys are very convenient due to their small size. Ed25519 keys are specified in RFC 8709 and OpenSSH has supported them since version 6.5 (January 2014). * https://www.openssh.com/releasenotes.html#9.5 Previously, if you didn't specify "-t", you got RSA keys; now you get Ed25519, and if you want RSA you have to ask for it. NIST's…

Somehow I've never heard of Curve448 or the company Rambus. It's giving me (unfounded) Crypto AG vibes. https://en.wikipedia.org/wiki/Crypto_AG

Not sure about Crypto AG level shardy. But they are still shady. When I see Rambus I think "patent troll".

https://en.wikipedia.org/wiki/Rambus

> Rambus was accused of shredding key documents prior to court hearings, the judge agreed and dismissed Rambus' case against Infineon. T

> On January 9, 2009, a Delaware federal judge ruled that Rambus could not enforce patents against Micron Technology Inc., stating that Rambus had a "clear and convincing" show of bad faith, and ruled that Rambus' destruction of key related documents (spoliation of evidence) nullified its right to enforce its patents against Micron.[28]

> Rambus engaged in intentional deceptive conduct in the context of the standard-setting process for example by not disclosing the existence of the patents which it later claimed were relevant to the adopted standard. This type of behavior is known as a "patent ambush".

> Ronald Black, Rambus's CEO, said, "Somehow we got thrown into the patent troll bunch...This is just not the case."[43]

See, they are the good guys after all. It came right from their CEO. /s

If someone is acting like this then shows up with a "here is a cool curve you can use", not surprising people will be suspicious. It's like that neighbor who has been suing everyone in the neighborhood, and calling the cops on kids playing outside, all of the sudden shows with a plate of cookies. People will think twice before trying a cookie.

Re: OpenSSH 9.5 released with keystroke timing obfuscation

#45

Post by tiffanyh »

throw0101a wrote: post #38
isilofi wrote: post #36

Earlier quoted context omitted.

If you are doing hundreds or thousands of SSH connections per second, you are doing something wrong. At least in 99.9% of cases. Github might be different, but not the rest of the world.

The comments about Ed25519 versus Ed448 were meant for the general case of their use, and not (necessarily) strictly in the use for SSH. However, the reason for Ed25519 use in OpenSSH is because the keys are much smaller, and easier to cut/paste/etc, for the same security factor. The fact that they are faster for signing is a bonus. * https://lists.mindrot.org/pipermail/openssh-unix-dev/2023-Se... RFC 8032 § 7.1. Tes…

Is it a coincidence the generated keys start with the same first 3 letters (“MII…”)?

Re: OpenSSH 9.5 released with keystroke timing obfuscation

#46

Post by kstrauser »

rdtsc wrote: post #44
botanical wrote: post #7

Earlier quoted context omitted.

Somehow I've never heard of Curve448 or the company Rambus. It's giving me (unfounded) Crypto AG vibes. https://en.wikipedia.org/wiki/Crypto_AG

Not sure about Crypto AG level shardy. But they are still shady. When I see Rambus I think "patent troll". https://en.wikipedia.org/wiki/Rambus > Rambus was accused of shredding key documents prior to court hearings, the judge agreed and dismissed Rambus' case against Infineon. T > On January 9, 2009, a Delaware federal judge ruled that Rambus could not enforce patents against Micron Technology Inc., stating that Ram…

Same for me. I don't think Rambus was a pure troll because they actually did invent some things, but at the time I thought they saw what SCO did and wanted in on that action.

Re: OpenSSH 9.5 released with keystroke timing obfuscation

#47

Post by kstrauser »

tiffanyh wrote: post #45
throw0101a wrote: post #38

Earlier quoted context omitted.

The comments about Ed25519 versus Ed448 were meant for the general case of their use, and not (necessarily) strictly in the use for SSH. However, the reason for Ed25519 use in OpenSSH is because the keys are much smaller, and easier to cut/paste/etc, for the same security factor. The fact that they are faster for signing is a bonus. * https://lists.mindrot.org/pipermail/openssh-unix-dev/2023-Se... RFC 8032 § 7.1. Tes…

Is it a coincidence the generated keys start with the same first 3 letters (“MII…”)?

Nope. See https://www.thedigitalcatonline.com/blog/2018/04/25/rsa-keys... for example:

"Please note that, due to the structure of the underlying ASN.1 structure, RSA PEM bodies start always with the same characters: MIG for 1024 bit keys, MII for 2048 and 4096 bit ones."

Re: OpenSSH 9.5 released with keystroke timing obfuscation

#48

Post by snuxoll »

frabert wrote: post #32
throwaway9870 wrote: post #19

Earlier quoted context omitted.

Rambus is an interesting company. I can't vouch for their crypto offerings, but they have been around since the 90's and at one point pioneered high-speed DRAM interfaces. Lots of what we see in DDR today is based on ideas and concepts they pushed forward in their proprietary interface. Early on, they definitely did innovative work. IIRC, their interfaces were used in some Sony play-stations and also some Intel syste…

I think it was Nintendo who put Rambus DRAM in the N64

The N64 did use Rambus RDRAM, but the PS3 also used Rambus XDR memory.

Re: OpenSSH 9.5 released with keystroke timing obfuscation

#49

Post by milliams »

Arnavion wrote: post #28
milliams wrote: post #27

Earlier quoted context omitted.

That seems like specifically Azure DevOps, not the Azure platform generally? I assume any OS running inside Azure Compute, or any other managed services will support Ed25519 fine?

The API for creating Azure VMs doesn't support specifying an ED25519 key. https://docs.microsoft.com/en-us/azure/virtual-machines/linu... But once you've created the VM you can log in and replace that RSA key with an ED25519 one just like any standard Linux install, via ssh-copy-id or manually updating authorized_keys or whatever you want. So you just need a throwaway RSA key for the initial deployment.

Thanks for the information. That's pretty embarrassing that it's still not supported.

Re: OpenSSH 9.5 released with keystroke timing obfuscation

#50

Post by sigg3 »

throw0101a wrote: post #3

More importantly (IMHO): ssh-keygen(1): generate Ed25519 keys by default. Ed25519 public keys are very convenient due to their small size. Ed25519 keys are specified in RFC 8709 and OpenSSH has supported them since version 6.5 (January 2014). * https://www.openssh.com/releasenotes.html#9.5 Previously, if you didn't specify "-t", you got RSA keys; now you get Ed25519, and if you want RSA you have to ask for it. NIST's…

This is great news and has a much larger impact than the featured feature IMO.
Post reply on HN