Bug 13 - Need faster ssh startup when no /dev/random or prngd available
Summary: Need faster ssh startup when no /dev/random or prngd available
Status: CLOSED WONTFIX
Alias: None
Product: Portable OpenSSH
Classification: Unclassified
Component: ssh (show other bugs)
Version: -current
Hardware: All All
: P2 enhancement
Assignee: OpenSSH Bugzilla mailing list
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2001-11-10 04:25 AEDT by Dave Dykstra
Modified: 2004-04-14 12:24 AEST (History)
0 users

See Also:


Attachments
added proposed patch (9.47 KB, patch)
2001-11-10 05:15 AEDT, Dave Dykstra
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Dave Dykstra 2001-11-10 04:25:31 AEDT
On systems that don't have a fast source of entropy such as /dev/random or
prngd,  startup up of ssh takes a long time because it runs a lot of external
programs.  I have made a patch to add an option to intialize the pseudo-random
number generator from a saved seed file rather than running all the external
programs, which I will add as an attachment.
Comment 1 Dave Dykstra 2001-11-10 05:15:09 AEDT
Created attachment 4 [details]
added proposed patch
Comment 2 Damien Miller 2001-12-12 11:46:42 AEDT
I don't like this - you could easily end up in a situation where you end up
using  essentially the same seed over and over again.
Comment 3 Dave Dykstra 2001-12-13 01:31:54 AEDT
No, that's not true, because every startup still adds small amounts of easily
gathered entropy.  You could argue that that means people could guess all the
possibilities and try them all, but they can't because they do not know the
contents of the seed file which was originally generated from a large amount
of entropy.  The only added risk is that somebody may get hold of the seed
file, but if the ~/.ssh directory is not secured someone could easily break
in anyway so I maintain that it doesn't add any more overall risk.  There is
no way for someone to guess the contents of the seed file by examining network
traffic because the psuedo-random number generation process is not reversible.
As an added protection, the seed file is re-written with additional entropy
mixed in each time ssh is run.

You don't have to rely on just my arguments, either: the SSH 1.2.* series did
this and there was never any CERT advisories nor complaints from crypto experts
about it, and pointing out SSH weaknesses have brought fame to many of them
so I'm sure that if there was a weakness here you would have heard about it.
Also, GnuPG does essentially the same thing on systems that don't have
/dev/random.
Comment 4 Damien Miller 2001-12-29 00:57:26 AEDT
This is redundant now. You can implement whatever local policy you like using
shell script wrappers around the new ssh-rand-helper in -current CVS
Comment 5 Damien Miller 2004-04-14 12:24:17 AEST
Mass change of RESOLVED bugs to CLOSED