search

open-quantum-safe / openssh

Fork of OpenSSH that includes prototype quantum-resistant key exchange and authentication in SSH based on liboqs. PROJECT INACTIVE. CONTRIBUTORS WANTED.
https://openquantumsafe.org/
Other
159 stars 58 forks source link

Displayed version is not updated for 2023-10 release since 2022-08 #152

Closed vt-alt closed 3 weeks ago

vt-alt commented 8 months ago

This can be confusing for users to see what actual vision is installed.

# ssh -V
OpenSSH_8.9-2022-01_p1, Open Quantum Safe 2022-08, OpenSSL 3.1.4 24 Oct 2023

See https://github.com/open-quantum-safe/openssh/blob/OQS-v8/version.h

baentsch commented 8 months ago

Thanks for the report. This is an erroneous omission in the release even though documented.

@dstebila @praveksharma Do we want to retain oqs-openssh as a maintained project or shall we declare it "unmaintained" much like liboqs-java or completely "sunset" like oqs-openssl111 given v8 seems really far distant from the upstream by now? If we maintain it, I'd think we should have an assigned maintainer. Next question along the same lines: Why do we have two more-or-less active branches (OQS-v8 and OQS-v9)? Conceptually, v9 sounds more recent, but we don't seem to release it: May I ask why?

dstebila commented 8 months ago

I've made PR #153 to fix the version number.#148

@dstebila @praveksharma Do we want to retain oqs-openssh as a maintained project or shall we declare it "unmaintained" much like liboqs-java or completely "sunset" like oqs-openssl111 given v8 seems really far distant from the upstream by now? If we maintain it, I'd think we should have an assigned maintainer. Next question along the same lines: Why do we have two more-or-less active branches (OQS-v8 and OQS-v9)? Conceptually, v9 sounds more recent, but we don't seem to release it: May I ask why?

When Pravek was doing the update a few months ago, he misunderstood what OQS-vX meant, not realizing that v8 refers to us tracking OpenSSH v8. So the OQS-v9 branch was created in error; I've now deleted it.

We are far behind OpenSSH main now. I don't know the scale of work needed to update to main. But if we don't want to do that and don't have someone willing to maintain it, then we should consider deprecating this project: there are security issues being fixed in OpenSSH that we are lacking (e.g., the recent Terrapin cryptographic attack).

vt-alt commented 8 months ago

We build openquantumsafe-openssh in ALT so I backported fixes for CVE-2023-48795, CVE-2023-51384, CVE-2023-51385 since release 2023-10. So this sort of unmaintanability is not a big problem for downstreams. But it seems, Open Quantum Safe OpenSSH did not become popular among other distributions yet. I would like if you continue to maintain and update to v9 though.

that we are lacking (e.g., the recent Terrapin cryptographic attack).

By the way, OpenSSH upstream considers this attack to be of low importance: "While cryptographically novel, there is no discernable impact on the integrity of SSH traffic beyond giving the attacker the ability to delete the message that enables some features related to keystroke timing obfuscation."

baentsch commented 8 months ago

So the OQS-v9 branch was created in error; I've now deleted it.

Thanks for the explanation & fix. I do second the thought of "demoting" oqs-openssh though unless we find an enthusiastic maintainer. At the very least there should be a warning at the top of the README.md. Another noteworthy fact: This project fails CI since 2 months and no-one noticed/cared...

bsodmike commented 5 months ago

Hi all - obvious question but why is this project "inactive"? I see maintainers from AWS etc?

Thanks

baentsch commented 5 months ago

I see maintainers from AWS

Could you please point to where you see those maintainers?

dstebila commented 3 weeks ago

Closing this issue as it related to our deprecated OQS-v8 branch