Weak DH primes and openssh

Darren Tucker dtucker at zip.com.au
Wed May 27 13:12:52 AEST 2015

On Wed, May 27, 2015 at 12:55 PM, mancha <mancha1 at zoho.com> wrote:

>  I think Darren uses k=100 (confirmation?)

Yes.  I use all of the default settings to ssh-keygen and the default for
number of rounds is 100.

The exact commands used for the single threaded version are here:

As previously mentioned I have a wrapper script to split up work over
multiple processors but it only adds -J/-j flags for "start here" and
"process this many" which I run over multiple machines.  I will tidy up
this script and publish that too when I get a chance.

Once I have the complete list assembled I re-screen it on OpenBSD and make
sure the output agrees (other than the timestamp).  I would be happy to add
a verification by an independent software implementation (for practical
purposes it'd probably need to be free-as-in-speech; it sounds like ecpp-dj
might be a candidate).

Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.

More information about the openssh-unix-dev mailing list