[
https://issues.apache.org/jira/browse/SSHD-1216?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17429222#comment-17429222
]
Evgeny Pasynkov edited comment on SSHD-1216 at 10/15/21, 11:52 AM:
-------------------------------------------------------------------
For me works this snippet at application side, no need to patch library:
{code:java}
mySSHD.kexExtensionHandler = object : KexExtensionHandler {
val extensionsSupportedKey = AttributeRepository.AttributeKey<Unit>()
val extensionsSentKey = AttributeRepository.AttributeKey<Unit>()
override fun isKexExtensionsAvailable(session: Session, phase:
KexExtensionHandler.AvailabilityPhase): Boolean {
return phase == KexExtensionHandler.AvailabilityPhase.NEWKEYS
}
override fun handleKexExtensionNegotiation(
session: Session, option: KexProposalOption, nValue: String?,
c2sOptions: Map<KexProposalOption, String>, cValue: String?,
s2cOptions: Map<KexProposalOption, String>, sValue: String?
) {
if (option == KexProposalOption.ALGORITHMS) {
val hasExtensions = cValue?.split(',')?.any {
KexExtensions.IS_KEX_EXTENSION_SIGNAL.test(it) }
if (hasExtensions == true)
session.setAttribute(extensionsSupportedKey, Unit)
}
}
override fun sendKexExtensions(session: Session, phase:
KexExtensionHandler.KexPhase) {
if (phase != KexExtensionHandler.KexPhase.NEWKEYS)
return
if (session.getAttribute(extensionsSupportedKey) == null) return
if (session.getAttribute(extensionsSentKey) != null) return
session.addSessionListener(object : SessionListener {
override fun sessionEvent(session: Session, event:
SessionListener.Event) {
if (event == SessionListener.Event.KeyEstablished) {
val buffer: Buffer =
session.createBuffer(KexExtensions.SSH_MSG_EXT_INFO)
buffer.putInt(1) // Number of extensions
ServerSignatureAlgorithms.INSTANCE.putExtension(session.signatureFactories.map
{ it.name }, buffer)
session.writePacket(buffer)
session.setAttribute(extensionsSentKey, Unit)
session.removeSessionListener(this)
}
}
})
}
}
{code}
UPDATE: Snippet updated to take "ext-info-c" into account
was (Author: xvost):
For me works this snippet at application side, no need to patch library:
{code:java}
mySSHD.kexExtensionHandler = object : KexExtensionHandler {
val extensionsSupportedKey = AttributeRepository.AttributeKey<Unit>()
val extensionsSentKey = AttributeRepository.AttributeKey<Unit>()
override fun isKexExtensionsAvailable(session: Session, phase:
KexExtensionHandler.AvailabilityPhase): Boolean {
return phase == KexExtensionHandler.AvailabilityPhase.NEWKEYS
}
override fun handleKexExtensionNegotiation(
session: Session, option: KexProposalOption, nValue: String?,
c2sOptions: Map<KexProposalOption, String>, cValue: String?,
s2cOptions: Map<KexProposalOption, String>, sValue: String?
) {
if (option == KexProposalOption.ALGORITHMS) {
val hasExtensions = cValue?.split(',')?.any {
KexExtensions.IS_KEX_EXTENSION_SIGNAL.test(it) }
if (hasExtensions == true)
session.setAttribute(extensionsSupportedKey, Unit)
}
}
override fun sendKexExtensions(session: Session, phase:
KexExtensionHandler.KexPhase) {
if (phase != KexExtensionHandler.KexPhase.NEWKEYS)
return
if (session.getAttribute(extensionsSupportedKey) == null) return
if (session.getAttribute(extensionsSentKey) != null) return
session.addSessionListener(object : SessionListener {
override fun sessionEvent(session: Session, event:
SessionListener.Event) {
if (event == SessionListener.Event.KeyEstablished) {
val buffer: Buffer =
session.createBuffer(KexExtensions.SSH_MSG_EXT_INFO)
buffer.putInt(1) // Number of extensions
ServerSignatureAlgorithms.INSTANCE.putExtension(session.signatureFactories.map
{ it.name }, buffer)
session.writePacket(buffer)
session.setAttribute(extensionsSentKey, Unit)
session.removeSessionListener(this)
}
}
})
}
}
{code}
> Implement RFC 8332 server-sig-algs on the server
> ------------------------------------------------
>
> Key: SSHD-1216
> URL: https://issues.apache.org/jira/browse/SSHD-1216
> Project: MINA SSHD
> Issue Type: Improvement
> Reporter: Ben Humphreys
> Assignee: Thomas Wolf
> Priority: Major
>
> In the recently released [OpenSSH
> 8.8|https://www.openssh.com/txt/release-8.8] for RSA keys the public key
> signature algorithm that depends on SHA-1 has been disabled by default:
> {quote}This release disables RSA signatures using the SHA-1 hash algorithm
> 2by default. This change has been made as the SHA-1 hash algorithm is
> cryptographically broken, and it is possible to create chosen-prefix 4hash
> collisions for <USD$50K [1]
> {quote}
> As a result OpenSSH 8.8 clients are unable to authenticate with Mina SSHD
> servers with RSA based keys (it is however possible to reenable ssh-rsa).
> OpenSSH since 7.2 does however support RFC 8332 RSA/SHA-256/512 signatures,
> indeed the release notes go on to say:
> {quote}
> For most users, this change should be invisible and there is no need to
> replace ssh-rsa keys. OpenSSH has supported RFC8332 RSA/SHA-256/512
> signatures since release 7.2 and existing ssh-rsa keys will automatically use
> the stronger algorithm where possible.
> {quote}
> It appears Mina SSHD partly implements support for RFC 8332, indeed the
> client code appears to support it (see SSHD-1141). However the server appears
> to lack full support because it doesn't full implement the"server-sig-algs"
> extension.
> The basic framework for supporting this seems to be present, specifically
> {{AbstractKexFactoryManager.setKexExtensionHandler()}} could perhaps permit
> such a "server-sig-algs" extension.
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscr...@mina.apache.org
For additional commands, e-mail: dev-h...@mina.apache.org
