Re: OpenSSH key blacklisting

[Robert Buchholz <rbu () gentoo org>]

Thanks for bringing up the topic here.

On Friday 16 May 2008, Solar Designer wrote:
> Are any other distros, besides Debian, Ubuntu, and derived ones,
> going to implement key blacklisting in OpenSSH - or are considering
> it?
>
> We are considering it for Openwall GNU/*/Linux, and if our effort
> would be reused by others, or if others join us in developing and/or
> testing the patch, this would be a reason for us to go for it.

Gentoo is discussing the feature in bug #221759 [1]. Until now, I have 
not heard a reaction to the patch from our OpenSSH maintainers, so I 
cannot judge on the technical side of the inclusion.


> I don't think we'll take the Debian/Ubuntu patch as-is.  Rather, we
> are likely to use a trivial binary encoding/compression method for
> the partial fingerprints.  We'd also use smaller partial
> fingerprints.  With the approach I have in mind, it'd take around
> 4.55 bytes per key to store 48-bit partial fingerprints, bringing the
> installed file size for 3 arch types and 2 key types/sizes in under 1
> MB (or just over 1 MB for 3 key types/sizes).

I assume whichever version has the acceptance of the OpenSSH upstream is 
what most of us would be willing to go with. Did you discuss either 
blacklist format with them already?

Personally, I would like to see the feature ported to our distribution 
sooner than later, but neither at the cost of maintaining patchsets for 
the rest of existance, nor with high transition cost once upstream 
accepts another format.

Robert


[1] https://bugs.gentoo.org/show_bug.cgi?id=221759

Attachment: signature.asc
Description: This is a digitally signed message part.