search

open-quantum-safe / openssh

Fork of OpenSSH that includes prototype quantum-resistant key exchange and authentication in SSH based on liboqs. PROJECT INACTIVE. CONTRIBUTORS WANTED.
https://openquantumsafe.org/
Other
170 stars 61 forks source link

8.4 README example error #100

Closed baentsch closed 3 years ago

baentsch commented 3 years ago

Continuing a discussion from #91 regarding ssh and sshd command line examples:

I'm not sure off the top of my head what's going on here, but it seems like there's a good lead sign_and_send_pubkey to follow up.

@xvzcf : I traced this down to a routine peeking into the sshbuf: https://github.com/open-quantum-safe/openssh/blob/c600d653b6ce79c81f98d674e99c16d816008301/sshbuf-getput-basic.c#L150 and that routine just delivers "ssh-" instead of "ssh-dilithium3" as it would be expected. This is on the client side; the server seems to have worked OK: 

debug1: /home/mib/ssh_server/authorized_keys:1: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding
Accepted key DILITHIUM3 SHA256:jyUbmvamkb/R663PLoR+bZbv4gK/LsG0M/VYk/tA8jE found at /home/mib/ssh_server/authorized_keys:1

So, Question: Do you recall feeding this buffer correctly with the algorithm name? Where would this be? Possibly at the server? Please let me know if you do not have time for this issue; I'll then keep digging on my own. Simply disabling this bad string check for algorithm name has everything working OK, so it should be a minor issue...

xvzcf commented 3 years ago

I think I have an idea, let me investigate.

dstebila commented 3 years ago

@xvzcf This is the only thing we're waiting on for making OpenSSH v8 the default. Will you be able to take a look in the next few days?

Updated to add: Actually, should say that @baentsch thought this was the only thing we're waiting on for making OpenSSH v8 the default, do you agree @xvzcf?

xvzcf commented 3 years ago

Looks like I introduced the bug through these lines. I've fixed it, will upload a PR tomorrow or the day after updating the test suite to test the README commands as well.

baentsch commented 3 years ago

Closed by #103