OpenSSH Has a New Cipher — Chacha20-poly1305 — from D.J. Bernstein 140
First time accepted submitter ConstantineM writes "Inspired by a recent Google initiative to adopt ChaCha20 and Poly1305 for TLS, OpenSSH developer Damien Miller has added a similar protocol to ssh, chacha20-poly1305@openssh.com, which is based on D. J. Bernstein algorithms that are specifically optimised to provide the highest security at the lowest computational cost, and not require any special hardware at doing so. Some further details are in his blog, and at undeadly. The source code of the protocol is remarkably simple — less than 100 lines of code!"
Pastebin mirror of code (Score:5, Informative)
http://pastebin.com/3YaRWXFs [pastebin.com]
Not less than 100 lines (Score:2, Informative)
What on earth gave the submitter the idea that it was less than 100 lines? That file linked to is the interface, not the actual core implementation. I count 113 lines in that file, and 218-223 lines depending on which version of DJB's chacha-merged.c you look at (incorporated as chacha_private.h, several versions, several subdirectories).
Re:Pastebin mirror of code (Score:5, Informative)
Re:Does DJB insist that the library ... (Score:5, Informative)
/var is meant for variable content. Such as the mail spool and tmp directory. Data on this filesystem often comes from external sources such as email. It is recommended for this file system to be mounted with noexecute flag to reduce the likelihood of a downloaded data to be executed.
Having binaries on /var means that this filesystem can not be mounted with this option and therefor reduces security a bit.
Re:lame name (Score:5, Informative)
SSH extensions are all specified by ASCII names. Standard extensions have names like "shell", "x11", and "port-forward", while vendor-specific extensions use names like "foo@openssh.com" or "bar@putty.org" so there's no naming collision risk.
Re:Does DJB insist that the library ... (Score:4, Informative)
He's always insisted that his qmail binaries get installed under /var/qmail,
Not true. He used to, but he has since placed qmail in the public domain [cr.yp.to], so you can do whatever you want.
Re:Does DJB insist that the library ... (Score:5, Informative)
Because on production servers it is common to have var on it's own partition, and that is the filesystem that holds the logs, which an attacker can cause data to be written to. Also it has to be writable by the running services, and allowing services to write and execute new binaries is a step in many attacks. So it is a typical thing a sysadmin wants to do, to prevent executing code there.
That said, the distro I'm using puts the executables under /usr regardless of where the upstream developer wants them to go. That isn't a decision for the app, it is one for the distro.
Re:100 lines is meaningless (Score:5, Informative)
That's how you do a try...finally block in C.