AndrewSav
commented
1 year ago Having the same issue with v9.4.0.0p1-Beta
Open heidelman opened 1 year ago
AndrewSav
commented
1 year ago Having the same issue with v9.4.0.0p1-Beta
brainos233
commented
10 months ago sntrup761x25519 needs variable length arrays, see https://github.com/PowerShell/openssh-portable/blob/59aba65cf2e2f423c09d12ad825c3b32a11f408f/defines.h#L942
#if defined(VARIABLE_LENGTH_ARRAYS) && defined(VARIABLE_DECLARATION_AFTER_CODE)
# define USE_SNTRUP761X25519 1
#endifBut msvc does not support variable length arrays 😕
AndrewSav
commented
10 months ago If it's not supported it should not be proposed?
triatic
commented
5 months ago I came across this issue when testing 9.5p1. I suppose I'll just go back to using 8.1p1 which is bundled with Windows 10.
triatic
commented
1 month ago 4 months later... 9.5p1 has been bundled into the latest update for Windows 10. I think a lot more people will be seeing this bug now.
Peter-76
commented
1 month ago Same here, have 9.5p1 now and my script that worked 2 days ago stopped working.
Brink2Three
commented
1 month ago Same here, anything newer than 9.5p1 appears to break. Had to manually rollback to 8.9p1 on multiple machines as newer versions are also broken :(
$ ssh-keyscan -t rsa 10.xx.xx.xxx
# 10.xx.xx.xxx:22 SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.6
choose_kex: unsupported KEX method sntrup761x25519-sha512@openssh.com
kthy
commented
3 weeks ago Also just bitten by this. Is there a way to restrict the KEX list at runtime using flags, or does this essentially break ssh-keyscan until the PR is merged and released?
tgauth
commented
3 weeks ago Also just bitten by this. Is there a way to restrict the KEX list at runtime using flags, or does this essentially break ssh-keyscan until the PR is merged and released?
Yes, but the restriction has to be done via sshd, rather than ssh-keyscan as sshd_config has a KexAlgorithms directive
kthy
commented
3 weeks ago Yeah, I figured out I could do that, but if I didn't control the sshd setup on the target server I would've been SOL.
Thanks @tgauth for doing the patch on this 👏 - hoping we'll see a patch release asap.
Prerequisites
Steps to reproduce
The ssh-keyscan.exe client application can propose unsupported KEX algorithms, notably sntrup761x25519-sha512@openssh.com. The server (if it also supports sntrup) will also propose sntrup. However, ssh-keyscan.exe will then fail in choose_kex with the error: choose_kex: unsupported KEX method sntrup761x25519-sha512@openssh.com That KEX algorithm requires a C99 compiler and is hidden behind a #if in defines.h.
ssh.exe and sshd.exe do not have this issue, because only supported KEX algorithms are proposed using the function match_filter_allowlist.
Client requirement: Win32-OpenSSH version 9.2 (a merge in 9.1 moved sntrup to the top of the preferred KEX list) Server requirement: Linux (for enabled sntrup761x25519-sha512@openssh.com support) OpenSSH version >=8.9 (where sntrup support was added)
ssh.exe -V OpenSSH_for_Windows_9.2p1, LibreSSL 3.7.2
ssh-keyscan.exe -vvv ip
Expected behavior
Actual behavior
Error details
Environment data
Version
9.2p1
Visuals
No response