Hey there, you may know I am a developer of the SSH Library libssh. Last week, a post on the libssh mailing list was reporting a connection problem under Redhat RHEL 4.8. It seemed that the new cipher aes128-ctr, recently implemented in libssh, had a little problem…
This bug looked strange, firstly because we never ever had any cryptographic problems within libssh, secondly because the debugging did not report something broken :
 Set output algorithm to aes256-ctr
 Set input algorithm to aes256-ctr
 Writing on the wire a packet having 17 bytes before
 17 bytes after comp + 10 padding bytes = 28 bytes packet
 Encrypting packet with seq num: 3, len: 32
 Sent SSH_MSG_SERVICE_REQUEST (service ssh-userauth)
 Decrypting 16 bytes
 Packet size decrypted: 44 (0x2c)
 Read a 44 bytes packet
 Decrypting 32 bytes
2010-04-12 13:14:54,211557; 1126189408 procSrvAuth; Did not receive SERVICE_ACCEPT
While giving on the OpenSSH side :
sshd: debug1: SSH2_MSG_NEWKEYS sent
sshd: debug1: expecting SSH2_MSG_NEWKEYS
sshd: debug1: SSH2_MSG_NEWKEYS received
sshd: debug1: KEX done
sshd: Disconnecting: Corrupted MAC on input.
Continue reading “Debugging a cryptographic bug in libssh…”
Hi there !
After some solicitation from third parties (read: libssh developers), I finally installed a real blog to replace more or less my wiki-based website. I’m going to discuss some things about libssh development, thoughts about programming, networks, computer security and internet.
I’ll take the occasion to tell about the FOSDEM convention that took place this week-end. Awesome meeting of opensource developers, it was a great occasion to meet people, in particular Andreas which is a libssh developer as well. It’s also interesting to note that this is the fist time FOSDEM is connected to the IP world through BELNET (note: I work for BELNET). FOSDEM was connected to BELNET on IPv4 and IPv6 using fiber, and this bandwidth was distributed to users through WiFi access points distributed in the ULB campus. The bandwidth used peaked around 100 Mbit/s (a poor 1/10th of the available bandwidth) due to technical limitation of airwaves, but I’m sure the tech staff will find a solution for next year. Also interesting to note, an IPv4 was available for each participant (two /19 were allocated) and the IPv6/IPv4 enabled ratio was around 90%.
I’m looking forward for more good stuff next year !