On-going portability issue with 9.9p2

[Dennis Clarke]

On 3/1/25 18:09, Damien Miller wrote:
> On Sat, 1 Mar 2025, Dennis Clarke via openssh-unix-dev wrote:
> 
>> On 3/1/25 00:40, Darren Tucker wrote:
>>> On Sat, 1 Mar 2025 at 14:23, Dennis Clarke via openssh-unix-dev <
>> ...
>>> You can try this patch (
>>> https://www.dtucker.net/tmp/openssh-mlkem-popcount.patch) against the V_9_9
>>> branch from github or mindrot, which is the same thing except it includes
>>> the autoconf changes.  It seems to work for me (on Linux anyway, while I do
>>> have a sparc it is not easily accessible, and doesn't have the Sun
>>> compiler anyway).
>>>
>>
>> Making progress !
>>
>>
>>      checking whether compiler supports __builtin_popcount... no
>>
>> Looks good.
> 
> Did it compile? Did it successfully connect to a different operating
> system using the mlkem768x25519-sha256 KEX?
> 
> You can test the latter using:
> 
> ssh -oKEXAlgorithms=mlkem768x25519-sha256 host
> 

Looks good here :

sparc64$ ./ssh -V
OpenSSH_9.9p2, OpenSSL 3.4.1 11 Feb 2025
sparc64$


sparc64$
sparc64$ ./ssh -oKEXAlgorithms=mlkem768x25519-sha256 -v hermes
OpenSSH_9.9p2, OpenSSL 3.4.1 11 Feb 2025
debug1: Reading configuration data /export/home/dclarke/.ssh/config
debug1: Reading configuration data /opt/bw/etc/ssh_config
debug1: Authenticator provider $SSH_SK_PROVIDER did not resolve; disabling
debug1: Connecting to hermes [172.16.35.24] port 22.
debug1: Connection established.
debug1: identity file /export/home/dclarke/.ssh/id_rsa type -1
debug1: identity file /export/home/dclarke/.ssh/id_rsa-cert type -1
debug1: identity file /export/home/dclarke/.ssh/id_ecdsa type -1
debug1: identity file /export/home/dclarke/.ssh/id_ecdsa-cert type -1
debug1: identity file /export/home/dclarke/.ssh/id_ecdsa_sk type -1
debug1: identity file /export/home/dclarke/.ssh/id_ecdsa_sk-cert type -1
debug1: identity file /export/home/dclarke/.ssh/id_ed25519 type -1
debug1: identity file /export/home/dclarke/.ssh/id_ed25519-cert type -1
debug1: identity file /export/home/dclarke/.ssh/id_ed25519_sk type -1
debug1: identity file /export/home/dclarke/.ssh/id_ed25519_sk-cert type -1
debug1: identity file /export/home/dclarke/.ssh/id_xmss type -1
debug1: identity file /export/home/dclarke/.ssh/id_xmss-cert type -1
debug1: Local version string SSH-2.0-OpenSSH_9.9
debug1: Remote protocol version 2.0, remote software version OpenSSH_9.9
debug1: compat_banner: match: OpenSSH_9.9 pat OpenSSH* compat 0x04000000
debug1: Authenticating to hermes:22 as 'dclarke'
debug1: load_hostkeys: fopen /export/home/dclarke/.ssh/known_hosts2: No 
such file or directory
debug1: load_hostkeys: fopen /opt/bw/etc/ssh_known_hosts: No such file 
or directory
debug1: load_hostkeys: fopen /opt/bw/etc/ssh_known_hosts2: No such file 
or directory
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: algorithm: (no match)
Unable to negotiate with 172.16.35.24 port 22: no matching key exchange 
method found. Their offer: 
sntrup761x25519-sha512 at openssh.com,curve25519-sha256,curve25519-sha256 at libssh.org,ext-info-s,kex-strict-s-v00 at openssh.com
sparc64$


So the patch from Darren Tucker seems to work neatly :)


-- 
--
Dennis Clarke
RISC-V/SPARC/PPC/ARM/CISC
UNIX and Linux spoken