Bug 2303 - ssh (and perhaps even sshd) should allow to specify the minimum DH group sizes for DH GEX
Summary: ssh (and perhaps even sshd) should allow to specify the minimum DH group size...
Status: NEW
Alias: None
Product: Portable OpenSSH
Classification: Unclassified
Component: ssh (show other bugs)
Version: 6.7p1
Hardware: All All
: P5 security
Assignee: Assigned to nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-10-29 07:21 AEDT by Christoph Anton Mitterer
Modified: 2014-10-29 07:29 AEDT (History)
0 users

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Christoph Anton Mitterer 2014-10-29 07:21:33 AEDT
Hi.

I think it would be a nice feature if ssh/libssh allow to specify the minimum and maximum accepted group size for DH GEX.

Currently the limits are hardcoded between 1024 - 8912, but this may not be enough for the security margins expected by client users or server operators.

A server operator can apparently easy protect against too small groups, by simply disabling the respective algos (diffie-hellman-group1-sha1 and diffie-hellman-group14-sha1) respectively removing all those entries from /etc/ssh/moduli, which are considered to be too small.
Well not exactly since there is bug #2302.

But a client has currently no way to restrict the servers choice (unless by recomiling with new hardcoded defaults).
Of course on cannot protect this way against evil servers, but it's a good way against those which are just weakly configured without malicious intent.


I think it's also worth to allow changing the maximum size,... cause the RFC seems to only suggest a maximum of 8192, but doesn't forbid any higher.

But people should probably not be allowed to manually set something smaller than the current 1024.

If the server doesn't accept the client's choice or cannot serve it, the connection should be aborted and no fallback be made as in #2302.


Cheers,
Chris.
Comment 1 Christoph Anton Mitterer 2014-10-29 07:29:17 AEDT
Oh and regarding sshd... well not sure if it makes sense to allow setting the minimum value for the server side... it may make it easier to disable smaller DH groups without the need to edit the moduli file.

But it probably does make sense to allow chaning the max... at least to the value that is supported by sshd.