https://bugzilla.novell.com/show_bug.cgi?id=393186
User meissner@novell.com added comment
https://bugzilla.novell.com/show_bug.cgi?id=393186#c6
--- Comment #6 from Marcus Meissner
Are any other distros, besides Debian, Ubuntu, and derived ones, going to implement key blacklisting in OpenSSH - or are considering it?
We are considering it for Openwall GNU/*/Linux, and if our effort would be reused by others, or if others join us in developing and/or testing the patch, this would be a reason for us to go for it.
Gentoo is discussing the feature in bug #221759 [1]. Until now, I have not heard a reaction to the patch from our OpenSSH maintainers, so I cannot judge on the technical side of the inclusion.
I don't think we'll take the Debian/Ubuntu patch as-is. Rather, we are likely to use a trivial binary encoding/compression method for the partial fingerprints. We'd also use smaller partial fingerprints. With the approach I have in mind, it'd take around 4.55 bytes per key to store 48-bit partial fingerprints, bringing the installed file size for 3 arch types and 2 key types/sizes in under 1 MB (or just over 1 MB for 3 key types/sizes).
I assume whichever version has the acceptance of the OpenSSH upstream is what most of us would be willing to go with. Did you discuss either blacklist format with them already? Personally, I would like to see the feature ported to our distribution sooner than later, but neither at the cost of maintaining patchsets for the rest of existance, nor with high transition cost once upstream accepts another format. Robert [1] https://bugs.gentoo.org/show_bug.cgi?id=221759 [-- Ende der signierten Daten --] -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.