Timeline for Can you tell OpenSSH to force a rekey according to a packet number limit?
Current License: CC BY-SA 3.0
5 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Apr 27, 2016 at 12:52 | comment | added | munkeyoto | @Pandrei "Standards consist of specific low level mandatory controls that help enforce and support the information security policy." OpenSSH was written to RFC specs (which IS THE STANDARD). I have NEVER EVER EVER in my career see an organization be OUT of compliance with default out of the box OpenSSH installed which is the case on hundreds of thousands or routers (JunOS, IOS, etc), systems (RHEL, Solaris, etc). So I think your interpretation of things is off. | |
| Apr 27, 2016 at 12:42 | comment | added | Pandrei | while I can understand the "between 1G and 4G depending on the cipher", and the reason to choose amount of traffic over amount of packets, it does not help when you want to prove you are complaint with a standard which specifies: no mode than N packets can be encrypted using the same key. | |
| Apr 27, 2016 at 12:34 | comment | added | munkeyoto |
Please re-read what is says, the answer was given to you. In OpenSSH, by DEFAULT this was ALREADY PROGRAMMED and is modified by changing the rekeylimit: The default is between "1G' and 4G', depending on the cipher" This means not matter the packet amount it will be changed. At some point OpenSSH developers felt that no matter the amount of packets, it would be the VOLUME OF DATA that would play the most critical part of the attack.
|
|
| Apr 27, 2016 at 12:30 | comment | added | Pandrei | It is important to set the limit in packets because of rfc4344 recommendation and FCS_SSHC_EXT.1.8 in this document niap-ccevs.org/pp/cpp_nd_v1.0.pdf. Plus CISCO do the same thing: ip ssh rekey volume 500 sets the number of packet to be transmitted before a rekey. | |
| Apr 27, 2016 at 12:16 | history | answered | munkeyoto | CC BY-SA 3.0 |