SSH/Server

topic kurze Beschreibung

Testfragen

Testfrage 1

Antwort1

Testfrage 2

Antwort2

Testfrage 3

Antwort3

Testfrage 4

Antwort4

Testfrage 5

Antwort5

Appendixes

Key material handling

Key material identifies the cryptographic secrets that compose a key. All key material must be treated as RESTRICTED data, meaning that: * Only individual with specific training and need-to-know should have access to key material.

• Key material must be encrypted on transmission.
• Key material can be stored in clear text, but only with proper access control (limited access).

This includes: * OpenSSH server keys (/etc/ssh/ssh_host_*key)

• Client keys (~/.ssh/id_{rsa,dsa,ecdsa,ed25519} and ~/.ssh/identity).

Client key size and login latency

In order to figure out the impact on performance of using larger keys - such as RSA 4096 bytes keys - on the client side, we have run a few tests:

On an idle, i7 4500 intel CPU using OpenSSH_6.7p1, OpenSSL 1.0.1l and ed25519 server keys the following command is ran 10 times:

time ssh localhost -i .ssh/id_thekey exit 

Results:

Client key	Minimum	Maximum	Average
RSA 4096	120ms	145ms	127ms
RSA 2048	120ms	129ms	127ms
ed25519	117ms	138ms	120ms

Keep in mind that these numbers may differ on a slower machine, and that this contains the complete login sequence and therefore is subject to variations. However, it seems safe to say that the latency differences are not significant and do not impact performance sufficiently to cause any concern regardless of the type of key used.

Reference documents

• Key Management
• Server Side TLS
• RFC4418 (umac)
• umac draft
• Safe curves
• DJM blog
• Stribika blog
• AES-GCM performance study
• CHACHA20 vs AES-GCM performance study
• PROTOCOL.certkeys
• rfc44880bis from GnuPG
• Weak Diffie-Hellman and the Logjam Attack
• On OpenSSH and Logjam, by Jethro Beekman