Displaying 20 results from an estimated 58 matches for "ssh2_msg_kex_ecdh_init".
2017 Jan 31
2
No point compression in SSH2_MSG_KEX_ECDH_INIT
I have noticed that the EC public key sent in the SSH2_MSG_KEX_ECDH_INIT
message is sent without point compression. Are there any plans to use point
compression eventually? I imagine that, in part, you guys are not yet
implementing it for patent reasons, right?
2024 Jul 28
1
SSH time increased significantly after upgrade to OpenSSH 9.6p1
...significant increase in time to
do ssh to the listener. Normally, a single ssh does not matter much
but some of our workflows involve about 3000 to 4000 ssh connect and
close and this is hitting us hard,
I enabled logging on the server side. I see the most of the increase
is here in receiving 'SSH2_MSG_KEX_ECDH_INIT received'. There is
increase of about 336221 - 150435 = ~185 msec. In contrast, we do not
see such delay in receiving 'SSH2_MSG_KEX_ECDH_INIT received' with
OpenSSH 8.6p1
Please let me know if you have any info on this.
//OpenSSH 9.6p1 logs
Jul 23 17:42:50.131032 ifav87-apic2 sshd[108...
2017 Jan 23
2
Open SSH public key setup not working on windows 2012
....org
debug1: kex: host key algorithm: ecdsa-sha2-nistp521
debug1: kex: client->server cipher: chacha20-poly1305 at openssh.com MAC: <implicit> compression: none
debug1: kex: server->client cipher: chacha20-poly1305 at openssh.com MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_INIT
debug2: set_newkeys: mode 1
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: rekey after 134217728 blocks
debug1: SSH2_MSG_NEWKEYS received
debug1: KEX done
debug1: userauth-request for user agshah service ssh-...
2016 Jun 08
5
Problem with Active Directory authentication
...1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.0p1 Debian-4
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ECDSA ec:09:c1:bc:d0:11:f3:8c:45:3f:dd:3a:96:ba:2a:17
debug1: Host '<fully qualified domain name>' is known and matches the ECDSA host key.
debug1: Found key in /home/knoppix/.ssh/known_hosts:29
debug1: ssh_ecdsa_verif...
2017 Jan 19
4
Client fails kex after c38ea634893a1975dbbec798fb968c9488013f4a
I have a Putty variant that works well with openSSH up until 7.4. After
git bisecting I found that after the application of
c38ea634893a1975dbbec798fb968c9488013f4a the client fails with host key
mismatch. The commit in question appears to remove vestiges of ssh-1
support but my client is using 2.0. I am trying to work out what in that
commit would lead to the symptoms. I have been through the
2016 Sep 21
2
Where to look next?
...g KEX.
Complete client-side debug output is below, but I believe the relevant part is:
debug1: kex: server->client cipher: aes192-cbc MAC: hmac-sha1 compression: none
debug1: kex: client->server cipher: aes192-cbc MAC: hmac-sha1 compression: none
debug3: send packet: type 30
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug3: receive packet: type 1
Received disconnect from 1.2.3.4 port 32:2: Failed to read binary packet data!
Any suggestions about what's failing, and what the cause might be? We're trying to figure out where to go in our troubleshooting, and do...
2016 Jun 09
2
Problem with Active Directory authentication
...1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.0p1 Debian-4
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ECDSA ec:09:c1:bc:d0:11:f3:8c:45:3f:dd:3a:96:ba:2a:17
debug1: Host '<fully qualified domain name>' is known and matches the ECDSA host key.
debug1: Found key in /home/knoppix/.ssh/known_hosts:29
debug1: ssh_ecdsa_verif...
2016 Jun 10
1
Problem with Active Directory authentication
...for protocol 2.0
> debug1: Local version string SSH-2.0-OpenSSH_6.0p1 Debian-4
> debug1: SSH2_MSG_KEXINIT sent
> debug1: SSH2_MSG_KEXINIT received
> debug1: kex: server->client aes128-ctr hmac-md5 none
> debug1: kex: client->server aes128-ctr hmac-md5 none
> debug1: sending SSH2_MSG_KEX_ECDH_INIT
> debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
> debug1: Server host key: ECDSA ec:09:c1:bc:d0:11:f3:8c:45:3f:dd:3a:96:ba:2a:17
> debug1: Host '<fully qualified domain name>' is known and matches the ECDSA host key.
> debug1: Found key in /home/knoppix/.ssh/known_hosts:29
>...
2016 Jun 09
1
FW: Problem with Active Directory authentication
...sion string SSH-2.0-OpenSSH_6.0p1 Debian-4
>>> debug1: SSH2_MSG_KEXINIT sent
>>> debug1: SSH2_MSG_KEXINIT received
>>> debug1: kex: server->client aes128-ctr hmac-md5 none
>>> debug1: kex: client->server aes128-ctr hmac-md5 none
>>> debug1: sending SSH2_MSG_KEX_ECDH_INIT
>>> debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
>>> debug1: Server host key: ECDSA
>>> ec:09:c1:bc:d0:11:f3:8c:45:3f:dd:3a:96:ba:2a:17
>>> debug1: Host '<fully qualified domain name>' is known and matches the
>>> ECDSA host key.
>>>...
2013 Sep 24
9
[PATCH] curve25519-sha256@libssh.org key exchange proposal
...int rnd = 0, slen, sbloblen, hashlen, i;
+
+ /* generate private key */
+ for (i = 0; i < sizeof(client_key); i++) {
+ if (i % 4 == 0)
+ rnd = arc4random();
+ client_key[i] = rnd;
+ rnd >>= 8;
+ }
+ crypto_scalarmult_curve25519_base(client_pubkey, client_key);
+
+ packet_start(SSH2_MSG_KEX_ECDH_INIT);
+ packet_put_string(client_pubkey, sizeof(client_pubkey));
+ packet_send();
+ debug("sending SSH2_MSG_KEX_ECDH_INIT");
+
+#ifdef DEBUG_KEXECDH
+ dump_digest("client private key:", client_key, sizeof(client_key));
+#endif
+
+ debug("expecting SSH2_MSG_KEX_ECDH_REPLY")...
2016 Jun 09
2
FW: Problem with Active Directory authentication
...t; debug1: Local version string SSH-2.0-OpenSSH_6.0p1 Debian-4
>> debug1: SSH2_MSG_KEXINIT sent
>> debug1: SSH2_MSG_KEXINIT received
>> debug1: kex: server->client aes128-ctr hmac-md5 none
>> debug1: kex: client->server aes128-ctr hmac-md5 none
>> debug1: sending SSH2_MSG_KEX_ECDH_INIT
>> debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
>> debug1: Server host key: ECDSA
>> ec:09:c1:bc:d0:11:f3:8c:45:3f:dd:3a:96:ba:2a:17
>> debug1: Host '<fully qualified domain name>' is known and matches the
>> ECDSA host key.
>> debug1: Found key in /ho...
2024 Jul 28
1
SSH time increased significantly after upgrade to OpenSSH 9.6p1
...es not matter much
> but some of our workflows involve about 3000 to 4000 ssh connect and
> close and this is hitting us hard,
Aside: could you use connection multiplexing for this case?
> I enabled logging on the server side. I see the most of the increase
> is here in receiving 'SSH2_MSG_KEX_ECDH_INIT received'. There is
> increase of about 336221 - 150435 = ~185 msec.
Here's the reason:
> //OpenSSH 9.6p1 logs
> Jul 23 17:42:50.150288 ifav87-apic2 sshd[1090464]: debug1: kex:
> algorithm: sntrup761x25519-sha512 at openssh.com [preauth]
> //OpenSSH 8.6p1
> Jul 23 17:32...
2013 Dec 11
1
Why ssh client breaks connection in expecting SSH2_MSG_NEWKEYS state?
...list_hostkey_types: ssh-rsa,ssh-dss,ecdsa-sha2-nistp256 [preauth]
debug1: SSH2_MSG_KEXINIT sent [preauth]
debug1: SSH2_MSG_KEXINIT received [preauth]
debug1: kex: client->server aes128-ctr hmac-md5 none [preauth]
debug1: kex: server->client aes128-ctr hmac-md5 none [preauth]
debug1: expecting SSH2_MSG_KEX_ECDH_INIT [preauth]
debug1: SSH2_MSG_NEWKEYS sent [preauth]
debug1: expecting SSH2_MSG_NEWKEYS [preauth]
Connection closed by NNN.NNN.NNN.NNN [preauth]
Client breaks connection right after 'expecting SSH2_MSG_NEWKEYS'.
I can always successfully connect to this server myself, and successful
log con...
2016 Aug 24
3
kex protocol error: type 7 seq xxx error message
Hi,
mancha and me debugged a problem with OpenSSH 7.3p1 that was reported on
the #openssh freenode channel. Symptoms were that this message was
popping on the console during a busy X11 session:
kex protocol error: type 7 seq 1234
I managed to reproduce the problem, it is related to the SSH_EXT_INFO
packet that is send by the server every time it is sending an
SSH_NEWKEYS packet, hence after
2013 Jun 25
1
RFC: encrypted hostkeys patch
...fatal("Unsupported hostkey type %d", kex->hostkey_type);
server_host_private = kex->load_host_private_key(kex->hostkey_type);
- if (server_host_private == NULL)
- fatal("Missing private key for hostkey type %d",
- kex->hostkey_type);
debug("expecting SSH2_MSG_KEX_ECDH_INIT");
packet_read_expect(SSH2_MSG_KEX_ECDH_INIT);
@@ -139,9 +136,8 @@ kexecdh_server(Kex *kex)
}
/* sign H */
- if (PRIVSEP(key_sign(server_host_private, &signature, &slen,
- hash, hashlen)) < 0)
- fatal("kexdh_server: key_sign failed");
+ kex->sign(server_hos...
2016 Jun 10
2
Problem with Active Directory authentication
...t; debug1: Local version string SSH-2.0-OpenSSH_6.0p1 Debian-4
>> debug1: SSH2_MSG_KEXINIT sent
>> debug1: SSH2_MSG_KEXINIT received
>> debug1: kex: server->client aes128-ctr hmac-md5 none
>> debug1: kex: client->server aes128-ctr hmac-md5 none
>> debug1: sending SSH2_MSG_KEX_ECDH_INIT
>> debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
>> debug1: Server host key: ECDSA ec:09:c1:bc:d0:11:f3:8c:45:3f:dd:3a:96:ba:2a:17
>> debug1: Host '<fully qualified domain name>' is known and matches the ECDSA host key.
>> debug1: Found key in /home/knoppix/.ssh/kn...
2016 Jun 08
0
Problem with Active Directory authentication
...for protocol 2.0
> debug1: Local version string SSH-2.0-OpenSSH_6.0p1 Debian-4
> debug1: SSH2_MSG_KEXINIT sent
> debug1: SSH2_MSG_KEXINIT received
> debug1: kex: server->client aes128-ctr hmac-md5 none
> debug1: kex: client->server aes128-ctr hmac-md5 none
> debug1: sending SSH2_MSG_KEX_ECDH_INIT
> debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
> debug1: Server host key: ECDSA
> ec:09:c1:bc:d0:11:f3:8c:45:3f:dd:3a:96:ba:2a:17
> debug1: Host '<fully qualified domain name>' is known and matches the
> ECDSA host key.
> debug1: Found key in /home/knoppix/.ssh/known_ho...
2016 Jun 09
0
FW: Problem with Active Directory authentication
...1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_6.0p1 Debian-4
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-md5 none
debug1: kex: client->server aes128-ctr hmac-md5 none
debug1: sending SSH2_MSG_KEX_ECDH_INIT
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ECDSA ec:09:c1:bc:d0:11:f3:8c:45:3f:dd:3a:96:ba:2a:17
debug1: Host '<fully qualified domain name>' is known and matches the ECDSA host key.
debug1: Found key in /home/knoppix/.ssh/known_hosts:29
debug1: ssh_ecdsa_verif...
2014 May 16
2
? about portable version of sshd crashing
...kex_parse_kexinit: reserved 0
debug2: mac_setup: setup umac-64-etm at openssh.com
debug1: kex: client->server aes128-ctr umac-64-etm at openssh.com none
debug2: mac_setup: setup umac-64-etm at openssh.com
debug1: kex: server->client aes128-ctr umac-64-etm at openssh.com none
debug1: expecting SSH2_MSG_KEX_ECDH_INIT
debug2: kex_derive_keys
debug2: set_newkeys: mode 1
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug2: set_newkeys: mode 0
debug1: SSH2_MSG_NEWKEYS received
debug1: KEX done
debug1: userauth-request for user admin service ssh-connection method none
debug1: attempt 0 failures 0...
2016 Jun 10
0
Problem with Active Directory authentication
...for protocol 2.0
> debug1: Local version string SSH-2.0-OpenSSH_6.0p1 Debian-4
> debug1: SSH2_MSG_KEXINIT sent
> debug1: SSH2_MSG_KEXINIT received
> debug1: kex: server->client aes128-ctr hmac-md5 none
> debug1: kex: client->server aes128-ctr hmac-md5 none
> debug1: sending SSH2_MSG_KEX_ECDH_INIT
> debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
> debug1: Server host key: ECDSA ec:09:c1:bc:d0:11:f3:8c:45:3f:dd:3a:96:ba:2a:17
> debug1: Host '<fully qualified domain name>' is known and matches the ECDSA host key.
> debug1: Found key in /home/knoppix/.ssh/known_hosts:29
>...