Opened on Feb 2, 2015 at 9:11:13 PM
Closed on Feb 17, 2015 at 2:42:08 PM
Last modified on Feb 17, 2015 at 2:47:51 PM
#8537 closed enhancement (fixed)
Add ability to deactivate weak crypto, SHA-1, DES etc.
Reported by: | lbort | Owned by: | dkocher |
---|---|---|---|
Priority: | normal | Milestone: | 4.7 |
Component: | sftp | Version: | 4.6.4 |
Severity: | normal | Keywords: | ssh, kex, ciphers, mac |
Cc: | Architecture: | Intel | |
Platform: |
Description (last modified by lbort)
I think the logical consequence of tickets #8488 and #8528 would be to offer the users the possibility to choose which Algorithms Cyberduck may use. This would include all the three parts described in the (really nice) blogentry mentioned in #8488, key exchange, symetric ciphers and Message Authentication Codes.
Servers that I control will not offer weak crypto anymore as soon as cyberduck offers something better, since it is the only software I use which still needs that. But when connecting to other servers, I would like be able to keep cyberduck from using the weak algorithms and display an error message just like described in the tickets mentioned above, if it cannot find a match. In case the server in question really only offers those protocols, one still can reactivate something that matches if one really wants to connect. But without that possibility to deactivate weak crypto, Cyberduck is not 100% safe, even if the stronger algorithms are incorporated.
This choice should be accessible in the SFTP-Settings imho, but if this is not a priority after adding the new algorithms, I would also be happy to delete some of them from the line in the configfile similar to .ssh/config, if something like this exists in the cyperduck.app contents.
Attachments (1)
Change History (14)
comment:1 Changed on Feb 2, 2015 at 9:16:17 PM by lbort
- Description modified (diff)
comment:2 Changed on Feb 3, 2015 at 10:01:40 AM by dkocher
- Milestone set to 4.7
- Severity changed from major to normal
- Status changed from new to assigned
comment:3 Changed on Feb 3, 2015 at 10:18:28 AM by dkocher
Would you mind compiling a list of weak algorithms you would want to us to display a warning.
comment:4 follow-ups: ↓ 7 ↓ 9 Changed on Feb 3, 2015 at 10:21:34 AM by dkocher
Such as [ kex=diffie-hellman-group14-sha1; sig=ecdsa-sha2-nistp256; c2sCipher=aes128-ctr; s2cCipher=aes128-ctr; c2sMAC=hmac-sha1; s2cMAC=hmac-sha1; c2sComp=zlib@openssh.com; s2cComp=zlib@openssh.com ].
comment:5 Changed on Feb 3, 2015 at 10:22:23 AM by dkocher
Add callback in 54681ecf5090d6e84fcc4e5b3088fd9944310426.
comment:6 Changed on Feb 3, 2015 at 10:22:38 AM by dkocher
Integrated in r16669.
comment:7 in reply to: ↑ 4 Changed on Feb 3, 2015 at 11:44:48 AM by lbort
Replying to dkocher:
Such as [ kex=diffie-hellman-group14-sha1; sig=ecdsa-sha2-nistp256; c2sCipher=aes128-ctr; s2cCipher=aes128-ctr; c2sMAC=hmac-sha1; s2cMAC=hmac-sha1; c2sComp=zlib@openssh.com; s2cComp=zlib@openssh.com ].
Sure, I can provide a list like that, but for that it would be good to have a complete list of all supported algorithms. Otherwise my list might be incomplete or list something that is not supported anyway.
So, is the quote above just an example, or are these all (currently) supported algorithms?
comment:8 follow-up: ↓ 10 Changed on Feb 3, 2015 at 12:38:30 PM by dkocher
Current supported algorithms in default configuration:
- Key exchange. diffie-hellman-group14-sha1 and diffie-hellman-group1-sha1.
- Ciphers. aes128-cbc, aes128-ctr, aes192-cbc, aes192-ctr, aes256-cbc, aes256-ctr, blowfish-cbc, 3des-cbc.
- MAC. hmac-md5, hmac-md5-96, hmac-sha1, hmac-sha1-96, hmac-sha2-256, hmac-sha2-512
- Signatures. SHA1withDSA, SHA256withECDSA, SHA1withRSA
comment:9 in reply to: ↑ 4 Changed on Feb 3, 2015 at 12:39:04 PM by dkocher
Replying to dkocher:
Such as [ kex=diffie-hellman-group14-sha1; sig=ecdsa-sha2-nistp256; c2sCipher=aes128-ctr; s2cCipher=aes128-ctr; c2sMAC=hmac-sha1; s2cMAC=hmac-sha1; c2sComp=zlib@openssh.com; s2cComp=zlib@openssh.com ].
This is just an example of negotiated algorithms.
comment:10 in reply to: ↑ 8 Changed on Feb 6, 2015 at 6:38:02 AM by lbort
Sorry, I was pretty busy, but here my list. I am not completly familiar with the notation, I hope I got it right.
[kex=diffie-hellman-group14-sha1; kex=diffie-hellman-group1-sha; c2sCipher=aes128-cbc; c2sCipher=aes192-cbc; c2sCipher=aes256-cbc; c2sCipher=blowfish-cbc; c2sCipher=3des-cbc; c2sMAC=hmac-md5; c2sMAC=hmac-md5-96; c2sMAC=hmac-sha1; c2sMAC=hmac-sha1-96; s2cCipher=aes128-cbc; s2cCipher=aes192-cbc; s2cCipher=aes256-cbc; s2cCipher=blowfish-cbc; s2cCipher=3des-cbc; s2cMAC=hmac-md5; s2cMAC=hmac-md5-96; s2cMAC=hmac-sha1; s2cMAC=hmac-sha1-96; sig=SHA1withDSA; sig=SHA256withECDSA ]
This is a quite long list, but all of the above are either using broken algorithms like MD5 and SHA-1, or too short keys like DSA, or rely on NIST curves, which can't be trusted either. I am not entirely sure about the aes-cbc ciphers, but I assume they are also vulnerable. I didn't read everything, but for some info about that, see http://www.openssh.com/txt/cbc.adv and http://homes.cs.washington.edu/~yoshi/papers/TISSEC04/
The list includes all currently supported kex-algorithms, so at least one of the suggested kex-algorithms needs to be implemented before activating the warning, otherwise it will always pop up. I also suggest putting the stronger ciphers with the longer keys first in the list of all available algorithms, since apparently the client chooses the first one in his list that is also supported by the server. In the long run, some more algorithms might be nice for the other part besides key-exchange, to be as compatible and secure as possible.
comment:11 Changed on Feb 17, 2015 at 2:39:52 PM by dkocher
Added properties to override algorithms that should yield a warning.
ssh.algorithm.cipher.blacklist ssh.algorithm.mac.blacklist ssh.algorithm.kex.blacklist ssh.algorithm.signature.blacklist
in r16820.
comment:12 Changed on Feb 17, 2015 at 2:42:08 PM by dkocher
- Resolution set to fixed
- Status changed from assigned to closed
The current default setting for these preferences is empty.
Changed on Feb 17, 2015 at 2:46:54 PM by dkocher
comment:13 Changed on Feb 17, 2015 at 2:47:15 PM by dkocher
Sample message with ssh.algorithm.kex.blacklist set to diffie-hellman-group14-sha1 diffie-hellman-group1-sha.
We might want to add a callback for negotiated algorithms and let the user choose to continue for weak ciphers as the insecure connection warning when connection to a FTP server with no TLS.