Slashdot Mirror

← Back to Stories (view on slashdot.org)

OpenSSH Has a New Cipher — Chacha20-poly1305 — from D.J. Bernstein

Posted by Unknown on from the cha-cha-cha dept.

First time accepted submitter ConstantineM writes "Inspired by a recent Google initiative to adopt ChaCha20 and Poly1305 for TLS, OpenSSH developer Damien Miller has added a similar protocol to ssh, chacha20-poly1305@openssh.com, which is based on D. J. Bernstein algorithms that are specifically optimised to provide the highest security at the lowest computational cost, and not require any special hardware at doing so. Some further details are in his blog, and at undeadly. The source code of the protocol is remarkably simple — less than 100 lines of code!"

8 of 140 comments (clear)

  1. Pastebin mirror of code by Anonymous Coward · · Score: 5, Informative

    http://pastebin.com/3YaRWXFs

    1. Re:Pastebin mirror of code by damaki · · Score: 4, Informative

      Wow it's less 100 lines (excluding chacha_ivsetup, chacha_encrypt_bytes AND poly1305_auth). So I guess it's not 100 lines...

      --
      Stupidity is the root of all evil.
  2. Not less than 100 lines by Anonymous Coward · · Score: 2, Informative

    What on earth gave the submitter the idea that it was less than 100 lines? That file linked to is the interface, not the actual core implementation. I count 113 lines in that file, and 218-223 lines depending on which version of DJB's chacha-merged.c you look at (incorporated as chacha_private.h, several versions, several subdirectories).

  3. Re:Does DJB insist that the library ... by Anonymous Coward · · Score: 5, Informative

    /var is meant for variable content. Such as the mail spool and tmp directory. Data on this filesystem often comes from external sources such as email. It is recommended for this file system to be mounted with noexecute flag to reduce the likelihood of a downloaded data to be executed.

    Having binaries on /var means that this filesystem can not be mounted with this option and therefor reduces security a bit.

  4. Re:lame name by Anonymous Coward · · Score: 5, Informative

    SSH extensions are all specified by ASCII names. Standard extensions have names like "shell", "x11", and "port-forward", while vendor-specific extensions use names like "foo@openssh.com" or "bar@putty.org" so there's no naming collision risk.

  5. Re:Does DJB insist that the library ... by psmears · · Score: 3, Informative

    He's always insisted that his qmail binaries get installed under /var/qmail,

    Not true. He used to, but he has since placed qmail in the public domain, so you can do whatever you want.

    --
    Need to type accents and special characters in Windows? Use FrKeys
  6. Re:Does DJB insist that the library ... by Aighearach · · Score: 5, Informative

    Because on production servers it is common to have var on it's own partition, and that is the filesystem that holds the logs, which an attacker can cause data to be written to. Also it has to be writable by the running services, and allowing services to write and execute new binaries is a step in many attacks. So it is a typical thing a sysadmin wants to do, to prevent executing code there.

    That said, the distro I'm using puts the executables under /usr regardless of where the upstream developer wants them to go. That isn't a decision for the app, it is one for the distro.

  7. Re:100 lines is meaningless by Anonymous Coward · · Score: 5, Informative

    That's how you do a try...finally block in C.