5 ms·

Sure: https://github.com/openbsd/src/commit/707316f931b35ef67f1390b2a00386bdd0863568 https://github.com/openbsd/src/commit/707316f931b35ef67f1390...

archi42 7y ago
Hm, I wonder if the symmetric encryption with a sophisticated cipher is really necessary in this scenario. The aim is require an attacker to read 16Kb of memory in addition to the much smaller key data, e.g. for each bit of the key, the attacker needs X additional, random bits. Wouldn't it be possible to block-wise xor the random data onto the key? Maybe use a windowing mechanism, where the window is moved forward depending on the random data (e.g. for a 16 bit key, xor random bits 0 to 15, then move forward 4 to 16 bits, depending on the current window; iterate until the maximum number of window movements necessary to go over the whole random data is reached [leak less bits via timing]; if the end of the data is reached, again start at the beginning, but with some offset to avoid result_bit_0 = secret_bit_0 xor random_bit_0 xor random_bit_0).
- the8472 7y ago
  You want every single bit error to avalanche to the whole key. You also don't want bit errors at some offsets modulo X to cancel each other out. Cryptographic hashes provide these properties. For any custom solution you would first have to prove that it has the security properties needed. The asymmetric crypto of a connection setup takes the lion's share of CPU cycles. I don't think it's worth the risk just to beat the cheap (relatively speaking) symmetric algorithms.
ktpsns 7y ago
- /* $OpenBSD: authfd.c,v 1.113 2018/12/27 23:02:11 djm Exp $ */ + /* $OpenBSD: authfd.c,v 1.114 2019/06/21 04:21:04 djm Exp $ */ what weird tool/infrastructure do these guys use, that they maintain CVS/SVN string identifiers in the files but nevertheless use git? I actually liked these identifiers. There were tools like ident (http://manpages.org/ident/1 http://manpages.org/ident/1) to deal with them.
- guan 7y ago
  They use CVS, not git. The repository that’s on GitHub is a mirror of the CVS repository; I don’t know what tool is used to do the mirroring. Here is the original change in authfd.c in cvsweb: https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/authfd.c?rev=1.114&content-type=text/x-cvsweb-markup https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/au...
- kardos 7y ago
  They use CVS; the github repo description says it is a mirror: > Public git conversion mirror of OpenBSD's official cvs src repository.

archi42 7y ago

Hm, I wonder if the symmetric encryption with a sophisticated cipher is really necessary in this scenario. The aim is require an attacker to read 16Kb of memory in addition to the much smaller key data, e.g. for each bit of the key, the attacker needs X additional, random bits. Wouldn't it be possible to block-wise xor the random data onto the key? Maybe use a windowing mechanism, where the window is moved forward depending on the random data (e.g. for a 16 bit key, xor random bits 0 to 15, then move forward 4 to 16 bits, depending on the current window; iterate until the maximum number of window movements necessary to go over the whole random data is reached [leak less bits via timing]; if the end of the data is reached, again start at the beginning, but with some offset to avoid result_bit_0 = secret_bit_0 xor random_bit_0 xor random_bit_0).

the8472 7y ago
You want every single bit error to avalanche to the whole key. You also don't want bit errors at some offsets modulo X to cancel each other out. Cryptographic hashes provide these properties. For any custom solution you would first have to prove that it has the security properties needed. The asymmetric crypto of a connection setup takes the lion's share of CPU cycles. I don't think it's worth the risk just to beat the cheap (relatively speaking) symmetric algorithms.

ktpsns 7y ago

- /* $OpenBSD: authfd.c,v 1.113 2018/12/27 23:02:11 djm Exp $ */ + /* $OpenBSD: authfd.c,v 1.114 2019/06/21 04:21:04 djm Exp $ */ what weird tool/infrastructure do these guys use, that they maintain CVS/SVN string identifiers in the files but nevertheless use git? I actually liked these identifiers. There were tools like ident (http://manpages.org/ident/1 http://manpages.org/ident/1) to deal with them.

guan 7y ago
They use CVS, not git. The repository that’s on GitHub is a mirror of the CVS repository; I don’t know what tool is used to do the mirroring. Here is the original change in authfd.c in cvsweb: https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/authfd.c?rev=1.114&content-type=text/x-cvsweb-markup https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/au...
kardos 7y ago
They use CVS; the github repo description says it is a mirror: > Public git conversion mirror of OpenBSD's official cvs src repository.