freebsd security - Nov 2015 - OpenSSH HPN

Bryan Drewery wrote this message on Tue, Nov 10, 2015 at 16:32
-0800:
> On 11/10/15 9:52 AM, John-Mark Gurney wrote:
> > My vote is to remove the HPN patches.  First, the NONE cipher made
more
> > sense back when we didn't have AES-NI widely available, and you
were
> > seriously limited by it's performance.  Now we have both aes-gcm
and
> > chacha-poly which it's performance should be more than acceptable
for
> > today's uses (i.e. cipher performance is 2GB/sec+).
> 
> AES-NI doesn't help the absurdity of double-encrypting when using scp
or
> rsync/ssh over an encrypted VPN, which is where NONE makes sense to use
> for me.
Different layers of protection...

Do you disable all encryption when you're transiting trusted networks
like your VPN?  If you don't, why is that ssh session so special?

-- 
  John-Mark Gurney				Voice: +1 415 225 5579

     "All that I will do, has been done, All that I have, has not."

I don't think there is such a thing as a trusted network. That is a unicorn
these days.

If you are using ssh to connect to the VPN server itself over the VPN
connection, I can see why that would be useless double encryption. However,
if you are connecting to a server on the network on the other side of the
VPN, I would still use ssh. No networks should be considered trusted.

Here is a great article about Beyond Corp, a Google project based on the
idea that trusted networks do not exist in reality, and that systems need
to be built with this in mind.
https://static.googleusercontent.com/media/research.google.com/en//pubs/archive/43231.pdf


On Tue, Nov 10, 2015 at 8:41 PM, John-Mark Gurney <jmg at funkthat.com>
wrote:
> Bryan Drewery wrote this message on Tue, Nov 10, 2015 at 16:32 -0800:
> > On 11/10/15 9:52 AM, John-Mark Gurney wrote:
> > > My vote is to remove the HPN patches.  First, the NONE cipher
made more
> > > sense back when we didn't have AES-NI widely available, and
you were
> > > seriously limited by it's performance.  Now we have both
aes-gcm and
> > > chacha-poly which it's performance should be more than
acceptable for
> > > today's uses (i.e. cipher performance is 2GB/sec+).
> >
> > AES-NI doesn't help the absurdity of double-encrypting when using
scp or
> > rsync/ssh over an encrypted VPN, which is where NONE makes sense to
use
> > for me.
>
> Different layers of protection...
>
> Do you disable all encryption when you're transiting trusted networks
> like your VPN?  If you don't, why is that ssh session so special?
>
> --
>   John-Mark Gurney                              Voice: +1 415 225 5579
>
>      "All that I will do, has been done, All that I have, has
not."
> _______________________________________________
> freebsd-security at freebsd.org mailing list
> https://lists.freebsd.org/mailman/listinfo/freebsd-security
> To unsubscribe, send any mail to "freebsd-security-unsubscribe at
freebsd.org
> "
>