bugzilla-daemon at bugzilla.mindrot.org
2009-Jun-18 21:13 UTC
[Bug 1611] New: ssh-keygen prints wrong randomart if bubblebabble is also printed
https://bugzilla.mindrot.org/show_bug.cgi?id=1611 Summary: ssh-keygen prints wrong randomart if bubblebabble is also printed Product: Portable OpenSSH Version: 5.2p1 Platform: All OS/Version: All Status: NEW Severity: normal Priority: P2 Component: ssh-keygen AssignedTo: unassigned-bugs at mindrot.org ReportedBy: fwojcik+openssh at besh.com Created an attachment (id=1651) --> (http://bugzilla.mindrot.org/attachment.cgi?id=1651) Suggested fix to always print out randomart based on MD5 If ssh-keygen is used with both the -B option (to print the bubblebabble digest of a key) and the -v option (which prints the randomart), then the randomart will be different than if the -B option was not used. Steps to reproduce: 1) Generate a key: <blockquote> # ssh-keygen -v -t rsa -b 2048 -f /tmp/garbage Generating public/private rsa key pair. Enter passphrase (empty for no passphrase): Enter same passphrase again: Your identification has been saved in /tmp/garbage. Your public key has been saved in /tmp/garbage.pub. The key fingerprint is: eb:19:8d:76:9e:d8:ee:63:6a:3c:9f:19:d4:37:1c:cc user at hostname The key's randomart image is: +--[ RSA 2048]----+ | | | o | | E | | . . . | | S . . + | | = . . | | .= + | | o+Bo= | | .=BX. | +-----------------+ </blockquote> 2) Display the fingerprint with ssh-keygen: <blockquote> # ssh-keygen -v -l -f /tmp/garbage 2048 eb:19:8d:76:9e:d8:ee:63:6a:3c:9f:19:d4:37:1c:cc /tmp/garbage.pub (RSA) +--[ RSA 2048]----+ | | | o | | E | | . . . | | S . . + | | = . . | | .= + | | o+Bo= | | .=BX. | +-----------------+ </blockquote> 3) Display the fingerprint and bubblebabble with ssh-keygen: <blockquote> # ssh-keygen -B -v -l -f /tmp/garbage 2048 xecen-telud-badez-sozic-hopyd-cacov-tanig-dimov-monef-sytym-haxax /tmp/garbage.pub (RSA) +--[ RSA 2048]----+ | .+.. ....+ | |... = * =.= | |o E * B *.. | |. + = . =.o | | . . S. | | | | | | | | | +-----------------+ </blockquote> The problem is that bubblebabble uses the SHA1 digest to generate the fingerprint, while randomart usually uses the MD5 digest. ssh-keygen.c will generate randomart with the SHA1 digest if it is also producing bubblebabble output. This problem was found on openssh v5.2p1. It also appears to be in OpenBSD's ssh-keygen.c v1.173. Diff for fix attached. -- Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching the assignee of the bug.
bugzilla-daemon at bugzilla.mindrot.org
2009-Jul-31 02:08 UTC
[Bug 1611] ssh-keygen prints wrong randomart if bubblebabble is also printed
https://bugzilla.mindrot.org/show_bug.cgi?id=1611 Damien Miller <djm at mindrot.org> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |djm at mindrot.org Blocks| |1626 -- Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching the assignee of the bug. You are watching someone on the CC list of the bug.
bugzilla-daemon at bugzilla.mindrot.org
2009-Aug-27 17:42 UTC
[Bug 1611] ssh-keygen prints wrong randomart if bubblebabble is also printed
https://bugzilla.mindrot.org/show_bug.cgi?id=1611 Damien Miller <djm at mindrot.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution| |FIXED --- Comment #1 from Damien Miller <djm at mindrot.org> 2009-08-28 03:42:12 EST --- Fix applied. This will be in openssh-5.4 -- Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching the assignee of the bug. You are watching someone on the CC list of the bug.
bugzilla-daemon at bugzilla.mindrot.org
2009-Oct-06 04:02 UTC
[Bug 1611] ssh-keygen prints wrong randomart if bubblebabble is also printed
https://bugzilla.mindrot.org/show_bug.cgi?id=1611 Damien Miller <djm at mindrot.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |CLOSED --- Comment #2 from Damien Miller <djm at mindrot.org> 2009-10-06 15:02:27 EST --- Mass move of RESOLVED bugs to CLOSED now that 5.3 is out. -- Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching the assignee of the bug. You are watching someone on the CC list of the bug.
bugzilla-daemon at bugzilla.mindrot.org
2010-Mar-25 23:51 UTC
[Bug 1611] ssh-keygen prints wrong randomart if bubblebabble is also printed
https://bugzilla.mindrot.org/show_bug.cgi?id=1611 --- Comment #3 from Darren Tucker <dtucker at zip.com.au> 2010-03-26 10:51:17 EST --- With the release of 5.4p1, this bug is now considered closed. -- Configure bugmail: https://bugzilla.mindrot.org/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching the assignee of the bug. You are watching someone on the CC list of the bug.
Apparently Analagous Threads
- [Bug 1759] New: allow display of bubblebabble fingerprint when connecting
- Usefulness of randomart for user keys?
- bubblebabble patch
- Article on Fingerprinting Public/Private Keypairs
- [Bug 1872] Support better hash algorithms for key fingerprints (FIPS compat)