OpenSSH 9.5 released with keystroke timing obfuscation
1–10 of 60 posts
Re: OpenSSH 9.5 released with keystroke timing obfuscation
#2The link that was (originally) submitted is to LWN just posting the release notes. The direct link(s) to the release notes is:
Re: OpenSSH 9.5 released with keystroke timing obfuscation
#3More importantly (IMHO):
ssh-keygen(1): generate Ed25519 keys by default. Ed25519 public keys
are very convenient due to their small size. Ed25519 keys are
specified in RFC 8709 and OpenSSH has supported them since version 6.5
(January 2014).
Previously, if you didn't specify "-t", you got RSA keys; now you get Ed25519, and if you want RSA you have to ask for it.
NIST's publication of FIPS 186-5 in February (2023) added Ed25519 and Ed448 as approved (? allowed?) algorithms:
* https://csrc.nist.gov/publications/detail/fips/186/5/final
* https://en.wikipedia.org/wiki/EdDSA#Standardization_and_impl...
Partly one of the reasons given for the default switch:
* https://lists.mindrot.org/pipermail/openssh-unix-dev/2023-Se...
Curious to know if/when the OpenSSH folks will add Ed448 (RFC 8709, like Ed25519).
Re: OpenSSH 9.5 released with keystroke timing obfuscation
#4> This attempts to hide inter-keystroke timings by sending interactive traffic at fixed intervals (default: every 20ms) when there is only a small amount of data being sent. It also sends fake "chaff" keystrokes for a random interval after the last real keystroke. These are controlled by a new ssh_config ObscureKeystrokeTiming keyword.
So does it send these phantom keystrokes only when there are real keystrokes?
On first reading I thought it sends periodic+random keystrokes and so {Client,Server}AliveInterval option(s) may not be required to keep the connection alive. Need to try and confirm the behaviour.
This version also changes ssh-keygen to generate ed25519 keys by default. Time to update scripts that generate keys without a '-t' arg.
Re: OpenSSH 9.5 released with keystroke timing obfuscation
#5More importantly (IMHO): ssh-keygen(1): generate Ed25519 keys by default. Ed25519 public keys are very convenient due to their small size. Ed25519 keys are specified in RFC 8709 and OpenSSH has supported them since version 6.5 (January 2014). * https://www.openssh.com/releasenotes.html#9.5 Previously, if you didn't specify "-t", you got RSA keys; now you get Ed25519, and if you want RSA you have to ask for it. NIST's…
What are the pros/cons of Ed448?
Re: OpenSSH 9.5 released with keystroke timing obfuscation
#6More importantly (IMHO): ssh-keygen(1): generate Ed25519 keys by default. Ed25519 public keys are very convenient due to their small size. Ed25519 keys are specified in RFC 8709 and OpenSSH has supported them since version 6.5 (January 2014). * https://www.openssh.com/releasenotes.html#9.5 Previously, if you didn't specify "-t", you got RSA keys; now you get Ed25519, and if you want RSA you have to ask for it. NIST's…
> Curious to know if/when the OpenSSH folks will add Ed448
Yeah, it's a little weird feeling to downgrade in best-estimate security level to go from 4096 bit RSA to ed25519. Ed448 avoids that concern.
Re: OpenSSH 9.5 released with keystroke timing obfuscation
#7More importantly (IMHO): ssh-keygen(1): generate Ed25519 keys by default. Ed25519 public keys are very convenient due to their small size. Ed25519 keys are specified in RFC 8709 and OpenSSH has supported them since version 6.5 (January 2014). * https://www.openssh.com/releasenotes.html#9.5 Previously, if you didn't specify "-t", you got RSA keys; now you get Ed25519, and if you want RSA you have to ask for it. NIST's…
Somehow I've never heard of Curve448 or the company Rambus. It's giving me (unfounded) Crypto AG vibes.
Re: OpenSSH 9.5 released with keystroke timing obfuscation
#8> This attempts to hide inter-keystroke timings by sending interactive traffic at fixed intervals (default: every 20ms) when there is only a small amount of data being sent. It also sends fake "chaff" keystrokes for a random interval after the last real keystroke. These are controlled by a new ssh_config ObscureKeystrokeTiming keyword. So does it send these phantom keystrokes only when there are real keystrokes? On f…
It's 2023, you shouldn't be using the old rsa keys anyway.
Re: OpenSSH 9.5 released with keystroke timing obfuscation
#9The release notes do not say why there is a need to obfuscate keystroke timings. I guess it is designed to mitigate some attack vector? Is it already being exploited in the wild or... let's say is purely of academic interest?
Re: OpenSSH 9.5 released with keystroke timing obfuscation
#10More importantly (IMHO): ssh-keygen(1): generate Ed25519 keys by default. Ed25519 public keys are very convenient due to their small size. Ed25519 keys are specified in RFC 8709 and OpenSSH has supported them since version 6.5 (January 2014). * https://www.openssh.com/releasenotes.html#9.5 Previously, if you didn't specify "-t", you got RSA keys; now you get Ed25519, and if you want RSA you have to ask for it. NIST's…
What are the pros/cons of Ed448?
> Ed25519 is one of the two digital signature algorithms today that use the EdDSA algorithm framework. The other is Ed448, which targets a higher security level (224-bit vs 128-bit) but is also slower and uses SHAKE256 (which is overkill and not great for performance).
* https://soatok.blog/2022/05/19/guidance-for-choosing-an-elli...