OpenSSH with 'none' cipher (after reading bug #877)

[Yaniv Aknin]

Hi,

I'd like to argue in favor of bug #877 (
https://bugzilla.mindrot.org/show_bug.cgi?id=877) from a new perspective.
Instead of performance, I wish to raise the issue of regulatory compliance
and auditing.

I read all of #877 and I understand the arguments for and against, but I
felt at the end the decisive comment by Damien was mostly based on 'We don't
want users to use "none" because we think it is an unacceptable tradeoff'. I
can relate to that comment when said in regard to performance - indeed, the
benefit of 'none' over 'arcfour' is negligible.

However, It seems that a solution I'm implementing may require cleartext
transport due to regulation / auditing compliance reasons. Turns out that
the government suits of some countries mandated that some institutions are
required to keep a cleartext copy of all communications ever sent from their
premises for a while, and I can't use my SSH based solution for these
customers (Please, I don't want to argue about whether it's a good or a bad
idea).

For my solution, I can easily make sure my session passes in the clear only
over pipes which are deemed secured by those owning the information, so
encryption is unnecessary. I would like to have all the authentication
features of SSH though. The only piece I'm missing for this is that SSH
support the none cipher.

I will not repeat the rest of the arguments, but I definitely agree with the
sides of the discussion in bug #877 that claimed that just like allowing
password authenticated access to the Root user or non-strict host-key
checking, the none cipher should be implemented and be a part of the OpenSSH
source tree, and not a hack an admin/integrator will insert as an
afterthought into version so-and-so, fragile, untested and vanishing with
version so-and-so+1.

I think providing patches is irrelevant, as there are enough implementations
around there and they're simple enough as it is. I just want the feature in
OpenSSH's tree please.

Comments? Thoughts? Verbal-exothermic reactions?

- Yaniv
  "vs gur abar pvcure vf bhgynjrq, only outlaws will have the none cipher."
  me, just now.