New answers tagged

0

You use tools to generate safe DH groups for you, so you don't generate them entirely randomly. These tools put them through strict tests which ensure they do not have properties which make them unsafe. The tests are so accurate that the probability that one of the chosen parameters will be insecure is exceptionally low. There are two types of generators, ...


1

It is in the source code of openssh as described in the RFC and we can simply trace its source from there: /* K1 = HASH(K || H || "A" || session_id) */ if ((hashctx = ssh_digest_start(kex->hash_alg)) == NULL || ssh_digest_update_buffer(hashctx, shared_secret) != 0 || ssh_digest_update(hashctx, hash, hashlen) != 0 || ssh_digest_update(hashctx, ...


1

Don't discourage these arguments : A quantum computer prototype is already working and making something. Guess what? A GPU farm is very affordable nowdays, even for a private researchers. And, yes - 10xGeForce Titan Z can make A GOOD KICK-ASS There's no actual problem generating/calculating groups "on-site", it's a way faster nowdays So I do agree with ...


2

The weird thing is that I get a different key when accessing the Pi over the internet instead of via LAN: Manual page for sshd describes format of your known_hosts file: SSH_KNOWN_HOSTS FILE FORMAT Each line in these files contains the following fields: markers (optional), hostnames, [...]. The fields are separated by spaces. Se we got to ...


1

The left hand side of the output of ssh-keygen -H -F 192.168.1.92 is the hash of the IP address. If you were to run the command without the -H option you'd get something similar to: christoph@christoph-laptop-14-04:~$ ssh-keygen -F 192.168.1.92 # Host 192.168.1.92 found: line 9 type ECDSA 192.168.1.92 ecdsa-sha2-nistp256 ...


0

Yes, EVP_{Seal,Open}* do 'hybrid' encryption: symmetric-encrypt the data with a nonce key, and publickey-encrypt that key to the recipient(s), and decrypt accordingly. (EVP_Digest{Sign,Verify}* similarly do hybrid signing: symmetric-hash the data and public-key sign the hash.) If you don't want this functionality, don't use these routines. If you want to ...



Top 50 recent answers are included