Re: About OpenSSH "user enumeration" / CVE-2018-15473

[Solar Designer <solar () openwall com>]

Hi Damien,

Thank you for sharing these thoughts with the community.

On Fri, Aug 24, 2018 at 10:58:20AM +1000, Damien Miller wrote:
> Finally, and perhaps most importantly: there's a fundamental tradeoff
> between attack surface and fixing this class of bug. As a concrete
> example, fixing this one added about 150 lines of code to our
> pre-authentication attack surface. In this case, we were willing to do
> this because we had confidence in the additional parsing, mostly because
> it's been reviewed several times and we've conducted a decent amount of
> fuzzing on it. But, given the choice between leaving a known account
> validity oracle or exposing something we don't trust, we'll choose the
> former every time.

Can you summarize for us all (on these mailing lists) the commits
leading to OpenSSH 7.8 that deal with this issue and add "about 150
lines of code", please?  The commit originally referenced by Qualys
doesn't.  I guess this has to do with you fixing not only the yes/no
kind of oracle, but also mitigating some timing oracle(s), as per the
change log:

 * sshd(8): add some countermeasures against timing attacks used for
   account validation/enumeration. sshd will enforce a minimum time
   or each failed authentication attempt consisting of a global 5ms
   minimum plus an additional per-user 0-4ms delay derived from a
   host secret.

 * sshd(8): avoid observable differences in request parsing that could
   be used to determine whether a target user is valid.

Thanks again,

Alexander