search

mirage / awa-ssh

Purely functional SSH library in ocaml.
ISC License
104 stars 12 forks source link

Chacha20/poly1305 support #14

Closed hannesm closed 4 years ago

hannesm commented 4 years ago

this is on top of #13, and requires https://github.com/mirage/mirage-crypto/pull/73 being merged and released.

TL;DR: implements https://cvsweb.openbsd.org/src/usr.bin/ssh/PROTOCOL.chacha20poly1305?annotate=HEAD ChaCha20/Poly1305 support for ssh. ssh uses 64 bit nonce (well, the 32 bit sequence number, 0 padded), and 64 bit counter. Two keys are used: one to encrypt the length field, the other to derive a poly1305 secret and encrypt and authenticate the msg. The encrypted length field is part of the data to be authenticated.

When Chacha20/poly1305 is negotiated, there is no hmac in place, since the poly1305 already provides a mac. This makes the Packet.decrypt operation slightly more convoluted (need to take care of mac_len and do some book keeping on it). Also, Cipher.decrypt may now fail (if the sent mac and computed mac are not equal).

Motivation came from #10, cryptographic agility, and recent integration of chacha20/poly1305 into mirage-crypto (still unreleased).

hannesm commented 4 years ago

any hints on the CI failure (maybe @talex5)?

#4 docker-image://docker.io/docker/dockerfile:experimental@sha256:ee85655c57140bd20a5ebc3bb802e7410ee9ac47ca92b193ed0ab17485024fe5
#4 sha256:71a594c684f98692da7baadc89226dfbe7a87a365660bd1251c8db6c1d7f4620
#4 resolve docker.io/docker/dockerfile:experimental@sha256:ee85655c57140bd20a5ebc3bb802e7410ee9ac47ca92b193ed0ab17485024fe5
#4 resolve docker.io/docker/dockerfile:experimental@sha256:ee85655c57140bd20a5ebc3bb802e7410ee9ac47ca92b193ed0ab17485024fe5 done
#4 sha256:ee85655c57140bd20a5ebc3bb802e7410ee9ac47ca92b193ed0ab17485024fe5 527B / 527B done
#4 sha256:80b5f664ac0c5f6b89608f7b0afd9548ac5b2d4cd631b7b723d9f2edca8676d9 897B / 897B done
#4 ERROR: failed to get dead record sha256:b41143b8fa43fe16600dd95e6ba42ec939e206fcf336cd6990ec59e0afdaf65c: not found
------
 > docker-image://docker.io/docker/dockerfile:experimental@sha256:ee85655c57140bd20a5ebc3bb802e7410ee9ac47ca92b193ed0ab17485024fe5:
------
failed to solve with frontend dockerfile.v0: failed to solve with frontend gateway.v0: failed to build LLB: failed to get dead record sha256:b41143b8fa43fe16600dd95e6ba42ec939e206fcf336cd6990ec59e0afdaf65c: not found
2020-07-04 18:50.34: Job failed: Docker build exited with status 1
talex5 commented 4 years ago

The build machine was running a docker prune at the time. I guess docker got confused by that somehow. I restarted the jobs and they passed.