Stories
Slash Boxes
Comments

SoylentNews is people

OpenSSH No Longer has to Depend on OpenSSL

posted by janrinok on Thursday May 01 2014, @12:14PM   Printer-friendly
from the its-progress dept.

cnst writes:

What has been planned for a long time now, prior to the infamous heartbleed fiasco of OpenSSL (which does not affect SSH at all), is now officially a reality - with the help of some recently adopted crypto from DJ Bernstein. OpenSSH now finally has a compile-time option to no longer depend on OpenSSL, the option `make OPENSSL=no` has now been introduced for a reduced-configuration OpenSSH to be built without OpenSSL.

The result would leave you with no legacy SSH-1 baggage at all, and on the SSH-2 front with only AES-CTR and chacha20+poly1305 ciphers, ECDH/curve25519 key exchange and Ed25519 public keys.

[Editor's Note: This appears to be very much a Work-in-Progress, so might not be available for your distro or via standard repositories.]

 
This discussion has been archived. No new comments can be posted.
OpenSSH No Longer has to Depend on OpenSSL | Log In/Create an Account | Top | 14 comments | Search Discussion
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

  • (Score: 2, Informative) by cnst on Thursday May 01 2014, @02:00PM

    by cnst (4275) on Thursday May 01 2014, @02:00PM (#38482)

    > [Editor's Note: This appears to be very much a Work-in-Progress, so might not be available for your distro or via standard repositories.]

    Yes, it hasn't been tagged and shipped yet. Expect it to be part of OpenSSH 6.7 (e.g. the next release); these algorithms are already part of OpenSSH 6.5 and 6.6, so you can already start using them today.

    Starting Score:    1  point
    Moderation   +1  
       Informative=1, Total=1
    Extra 'Informative' Modifier   0  
    Total Score:   2  

  • (Score: 1) by jasassin on Thursday May 01 2014, @11:09PM

    by jasassin (3566) <jasassin@gmail.com> on Thursday May 01 2014, @11:09PM (#38680) Homepage Journal

    [Editor's Note: This appears to be very much a Work-in-Progress, so might not be available for your distro or via standard repositories.]

    Yes, it hasn't been tagged and shipped yet. Expect it to be part of OpenSSH 6.7 (e.g. the next release); these algorithms are already part of OpenSSH 6.5 and 6.6, so you can already start using them today.

    Don't worry. Theo de Raadt will remove a few million lines of code and sort it all out!

    --
    jasassin@gmail.com GPG Key ID: 0xE6462C68A9A3DB5A