Re: OpenSSH key blacklisting

[Kees Cook <kees () outflux net>]

On Sun, May 18, 2008 at 04:06:55AM +0400, Solar Designer wrote:
> I've dropped the explicit CC because Kees is subscribed.

(I've adjusted my mail server to quit using SRS for the time being...)

> postings.  As to the fingerprint list, I'd appreciate it if you provide
> separate lists for different key types, sizes, and archs - such that we
> can produce any combinations.  The "unshortened" aspect is not as
> important; we'll probably pick last N bits of fingerprints anyway, to
> allow for comparison between our blacklist and that in the Debian and
> Ubuntu packages.

Ah, I haven't been separating it by arch, but I can certainly do that.
I've been including the "full" hashes in the Debian openssh-blacklist
source package and reducing them for the final files.  I can easily
split up the source blacklist files by arch and combine them during the
"build".

I will probably also keep the file in PID order, and sort it during the
build.  I've been interested in the pid origin just to see where in the
pid list keys tend to land.

-Kees

-- 
Kees Cook                                            @outflux.net