FIPS mode OpenSSH suggestion

电磁波 qianbohound at hotmail.com
Thu Jun 12 17:28:24 EST 2008


Hi OpenSSH team,

I find a url http://www.gossamer-threads.com/lists/openssh/dev/42808?do=post_view_threaded#42808, which provides unofficial patch for FIPS Capable OpenSSH. I try it and it seems working for some cases. 
(BTW, I also find that aes128-ctr, aes192-ctr and aes256-ctr ciphers can't work in FIPS mode properly. 
 The fips mode sshd debug info is as following.
***************************
debug2: set_newkeys: mode 1
cipher_init: EVP_CipherInit: set key failed for aes128-ctr
debug1: do_cleanup
    发送
debug3: PAM: sshpam_thread_cleanup entering
debug1: audit event euid 0 user (unknown user) event 12 (CONNECTION_ABANDON)
***************************
I don't know why. Are these three ciphers FIPS forbidden?)

    发送
As you know, FIPS 1.1.2  module has been officially released for some period and FIPS Capable OpenSSL may become one of the important main branches of OpenSSL in the near future. So if openssh can provide built-in FIPS Capable functionality, it will be highly appreciated.

Would you please take this suggestion into consideration for future openssh release?

Thank you!

_________________________________________________________________
新年换新颜,快来妆扮自己的MSN给心仪的TA一个惊喜!
http://im.live.cn/emoticons/?ID=18


More information about the openssh-unix-dev mailing list