openssh unix dev - Dec 2015 - Why hostkeys-00@openssh.com is following user authentication?

Hello,

This hostkeys extension is great, reading[1]:
"""
OpenSSH supports a protocol extension allowing a server to inform a
client of all its protocol v.2 host keys after user-authentication has
completed.
"""

I wonder, why should user authentication be completed before this
functionality is available? This means that ssh-keyscan tool (for
example) cannot take advantage of the functionality.

The only reason I could think of (apart of sshd internal
implementation ordering) is to avoid cpu load attack of anonymous
clients forcing server to perform expensive operations.

However, a similar attack can be achieved by multiple connections and/or re-kex.

In sshd.c I see hostkeys-00 at openssh.com sent before calling
do_authenticated(), so I even more curios.

Thanks!
Alon Bar-Lev.

[1] https://github.com/openssh/openssh-portable/blob/master/PROTOCOL#L284

On Wed, 23 Dec 2015, Alon Bar-Lev wrote:
> Hello,
> 
> This hostkeys extension is great, reading[1]:
> """
> OpenSSH supports a protocol extension allowing a server to inform a
> client of all its protocol v.2 host keys after user-authentication has
> completed.
> """
> 
> I wonder, why should user authentication be completed before this
> functionality is available? This means that ssh-keyscan tool (for
> example) cannot take advantage of the functionality.
It's done this way because the only extensible messages in the protocol
are channel and global requests, which are only valid after the
"ssh-connection" (channels) service has been requested. This only
happens
after userauth.

It would be better to do it after key exchange and before user
authentication, but it would also be less compatible with other
implementations.

-d

On 23 December 2015 at 23:30, Damien Miller <djm at mindrot.org>
wrote:
>
> On Wed, 23 Dec 2015, Alon Bar-Lev wrote:
>
> > Hello,
> >
> > This hostkeys extension is great, reading[1]:
> > """
> > OpenSSH supports a protocol extension allowing a server to inform a
> > client of all its protocol v.2 host keys after user-authentication has
> > completed.
> > """
> >
> > I wonder, why should user authentication be completed before this
> > functionality is available? This means that ssh-keyscan tool (for
> > example) cannot take advantage of the functionality.
>
> It's done this way because the only extensible messages in the protocol
> are channel and global requests, which are only valid after the
> "ssh-connection" (channels) service has been requested. This only
happens
> after userauth.
>
> It would be better to do it after key exchange and before user
> authentication, but it would also be less compatible with other
> implementations.
>
> -d
Thank you for quick response!
I was under the impression that global requests can be sent before
user authentication.