openssh bugs - Jun 2005 - [Bug 1055] Problem with arcfour cipher and OpenSSL 0.9.7g

http://bugzilla.mindrot.org/show_bug.cgi?id=1055

           Summary: Problem with arcfour cipher and OpenSSL 0.9.7g
           Product: Portable OpenSSH
           Version: 4.1p1
          Platform: Itanium2
        OS/Version: Linux
            Status: NEW
          Severity: major
          Priority: P2
         Component: sshd
        AssignedTo: bitbucket at mindrot.org
        ReportedBy: imorgan at nas.nasa.gov


When building OpenSSH 4.1p1 against OpenSSL 0.9.7g, 'make tests'
indicates that the arcfour cipher fails in regress/try-ciphers.sh. All
other ciphers are successful.

The ssh client can successfully use arcfour when talking to previous
builds of OpenSSH compiled against OpenSSL 0.9.7e. However, when connecting
to the newly built sshd with either the newly built ssh or the previous
(OpwnSSH 3.9p1) build, the connection is broken immediately after
authentication with a "Bad packet length" message.

Note that OpenSSL 0.9.7f introduced assembler code for the RC4 algorithm
on the IA64 architecture. Building OpenSSL with the 'no_asm' flag
eliminates
the issue, but also kills performance. Running OpenSSL's 'make test'
shows no problem with the RC4 algorithm. Further, comparing the output
from 'make test' for version 0.9.7g against 0.9.7e shows no difference
in regards to RC4.

A slightly more elegant workaround for this issue is to set the RC4_CHAR
flage _and_ edit crypto/rc4/asm/rc4-ia64.S; changing SZ=4 to SZ=1.

Since this problem seems to only affect sshd and only occurs after
authentication, I'm wondering if there could be an issue with the key
exchange that appears to occur after authentication.



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

http://bugzilla.mindrot.org/show_bug.cgi?id=1055





------- Additional Comments From djm at mindrot.org  2005-06-14 09:10 -------
Have you filed a bug with the OpenSSL developers. If so, could you please
provide a link or tracking number?



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

http://bugzilla.mindrot.org/show_bug.cgi?id=1055





------- Additional Comments From imorgan at nas.nasa.gov  2005-06-15 07:47
-------
The issue has also been filed with openssl.org as bug #1114.



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

http://bugzilla.mindrot.org/show_bug.cgi?id=1055





------- Additional Comments From imorgan at nas.nasa.gov  2005-06-17 05:08
-------
Correction: The two workarounds mentioned in the initial bug report were
erroneous. I had temporarily removed the reference to arcfour in
try-ciphers.sh in order to see if there were any issues with any of the
other regression tests. Apparently, I forgot to clean up after myself.

I started over from scratch and tried the 'no-asm' workaround and the
RC4_CHAR workaround. Both failed.

Even using the no-asm flag and setting RC4_CHAR when building OpenSSL
does not fix the issue.OB



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

http://bugzilla.mindrot.org/show_bug.cgi?id=1055


t8m at centrum.cz changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |t8m at centrum.cz






------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

http://bugzilla.mindrot.org/show_bug.cgi?id=1055





------- Additional Comments From imorgan at nas.nasa.gov  2005-06-29 01:45
-------
Bug resolved by Andy Polyakov at openssl.org:

Summary can be found at http://cvs.openssl.org/chngview?cn=14145. Point
is that I assumed that RC4_KEY structure initialized by RC4_set_key is
passed down to RC4 verbatim in its original memory location, while
OpenSSH takes freedom to swap the structures initialized in different
locations. One can argue that the latter is inappropriate design choice,
but it works on too many other platforms to argue. And so IA64 was
"reduced" to common denominator. Case dismissed. A.



------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.