Re: ssh primer (was Re: pull vs push (was Re: [bk patch] Make cardbus compile in -pre4))

Re: ssh primer (was Re: pull vs push (was Re: [bk patch] Make cardbus compile in -pre4))

[Jesse Pollard]

------HEADER END-DONT REMOVE------ 
> Rob Landley <landley@trommello.org> writes:
> 
> > Not that it's worth it. Keys get exponentially more difficult to
> > brute force as the key length increases. I read part of a book a
> > long time ago (might have been called "applied cryptography") that
> > figured out that if you could build a perfectly efficient computer
> > that could do 1 bit's worth of calculation with the the amount of
> > energy in the minimal electron state transition in a hydrogen atom,
> > and you built a dyson sphere around the sun to capture its entire
> > energy output for the however many billion years its expected to
> > last, you wouldn't even brute-force exhaust a relatively small
> > keyspace (128 bits? 256 bits? Something like that).
> >
> > Somebody else here is likely to recognize the above anecdote and give a more 
> > accurate reference.  Book title and page number would be good...
> 
> Bruce Schneier's "Applied Cryptography" (second edition, may be in the
> first edition as well), pages 157-158 ("Thermodynamic Limitations").
Remember - this is a dated example, since some theories are beginning
to consider storing & computing data with photons/interference patterns...
-------------------------------------------------------------------------
Jesse I Pollard, II
Email: pollard@navo.hpc.mil
Any opinions expressed are solely my own.

Re: ssh primer (was Re: pull vs push (was Re: [bk patch] Make cardbus compile in -pre4))

[Harald Arnesen]

Rob Landley <landley@trommello.org> writes:

> Not that it's worth it. Keys get exponentially more difficult to
> brute force as the key length increases. I read part of a book a
> long time ago (might have been called "applied cryptography") that
> figured out that if you could build a perfectly efficient computer
> that could do 1 bit's worth of calculation with the the amount of
> energy in the minimal electron state transition in a hydrogen atom,
> and you built a dyson sphere around the sun to capture its entire
> energy output for the however many billion years its expected to
> last, you wouldn't even brute-force exhaust a relatively small
> keyspace (128 bits? 256 bits? Something like that).
>
> Somebody else here is likely to recognize the above anecdote and give a more 
> accurate reference.  Book title and page number would be good...

Bruce Schneier's "Applied Cryptography" (second edition, may be in the
first edition as well), pages 157-158 ("Thermodynamic Limitations").
-- 
Hilsen Harald.

Re: ssh primer (was Re: pull vs push (was Re: [bk patch] Make cardbus compile in -pre4))

[Aaron Lehmann]

On Wed, Feb 13, 2002 at 07:22:57PM -0500, Rob Landley wrote:
> In terms of brute forcing the key, the passphrase adds a fairly trivial 
> number of bits to the key.  It's not "far" easer, an 8 character mixed case 
> nonsense password with numbers and punctuation mixed in is still less than 6 
> bits per character, or at best an extra 48 bits.  You can select a 1024 bit 
> key if you want to be really really paranoid.

I agree that it isn't worth it.

I assume that Jeff didn't understand the principles behind public key
cryptography that SSH uses which keep communications secure unless the
private key is compromised (and the private key should never leave
client machine). When you have a passphrase, you encrypt this private
key with a hash of it. Not having a passphrase removes this layer of
security, but if you include the passphrase in a script for automatic
use you're undoing any advantage that a passphrase gives you in the
first place.

In short, to compromise a private key without access to that key
(which presumably only you would have if the key was on your system,
and you must assume that if someone could access your private key they
could access any passphrase you were storing in a script to facilitate
automatic use of it), you'd have to either have unheard of amounts of
computational power and a few millenia on your hands, or come across a
mathematical breakthrough. I certainly hope that Mr. Garzik has not
broken public key cryptography!

Note that you can't compare public key bits to passphrase bits (which
are more like symmetric key bits). You probably know this.

> Not that it's worth it.  Keys get exponentially more difficult to brute force 
> as the key length increases.  I read part of a book a long time ago (might 
> have been called "applied cryptography") that figured out that if you could 
> build a perfectly efficient computer that could do 1 bit's worth of 
> calculation with the the amount of energy in the minimal electron state 
> transition in a hydrogen atom, and you built a dyson sphere around the sun to 
> capture its entire energy output for the however many billion years its 
> expected to last, you wouldn't even brute-force exhaust a relatively small 
> keyspace (128 bits?  256 bits?  Something like that).

That was Applied Cryptography. I believe he said that the energy
output of a supernova was insufficient to cycle a counter through
about 2^190, based on accepted thermodynamic principles and data. Of
course, this makes brute force of something like a 256 bit symmetric
key completely infeasible and bounded by physical law. Not that 128
bits is very shabby, but it only takes a few billion years of all the
current computing power on earth to brute force something like that.

Re: ssh primer (was Re: pull vs push (was Re: [bk patch] Make cardbus compile in -pre4))

[Rob Landley]

On Wednesday 13 February 2002 12:13 pm, Aaron Lehmann wrote:
> On Sat, Feb 09, 2002 at 08:24:46PM -0500, Jeff Garzik wrote:
> > It is far easier to guess your private key with a blank passphrase.
>
> I challenge you to present a method for doing so.

Your public/private key pair are pretty straightforward public key 
cryptography.  If you can brute force one given the other, it wouldn't be 
safe to use it over the wire in the first place.

The point of having a passphrase is that some really paranoid people want to 
have both a key AND a password to get into their box.  A password in and of 
itself isn't all that secure, since any human memorizable password contains 
so little information it would be trivial to break computationally via brute 
force (if you can arrange a brute force attack, which login tries to prevent 
with the ~3 second delay between attempts, but they still tend to get written 
down, or people watch keystrokes over your shoulder...).  And a key you carry 
around with you on a floppy or propogate to multiple boxes can be stolen 
(copied) from any of those places without you necessarily knowing about it.

In terms of brute forcing the key, the passphrase adds a fairly trivial 
number of bits to the key.  It's not "far" easer, an 8 character mixed case 
nonsense password with numbers and punctuation mixed in is still less than 6 
bits per character, or at best an extra 48 bits.  You can select a 1024 bit 
key if you want to be really really paranoid.

Not that it's worth it.  Keys get exponentially more difficult to brute force 
as the key length increases.  I read part of a book a long time ago (might 
have been called "applied cryptography") that figured out that if you could 
build a perfectly efficient computer that could do 1 bit's worth of 
calculation with the the amount of energy in the minimal electron state 
transition in a hydrogen atom, and you built a dyson sphere around the sun to 
capture its entire energy output for the however many billion years its 
expected to last, you wouldn't even brute-force exhaust a relatively small 
keyspace (128 bits?  256 bits?  Something like that).

Somebody else here is likely to recognize the above anecdote and give a more 
accurate reference.  Book title and page number would be good...

Rob

Re: ssh primer (was Re: pull vs push (was Re: [bk patch] Make cardbus compile in -pre4))

[Aaron Lehmann]

On Sat, Feb 09, 2002 at 08:24:46PM -0500, Jeff Garzik wrote:
> It is far easier to guess your private key with a blank passphrase.

I challenge you to present a method for doing so.

Re: ssh primer (was Re: pull vs push (was Re: [bk patch] Make cardbus compile in -pre4))

[Herbert Xu]

On Sat, Feb 09, 2002 at 08:24:46PM -0500, Jeff Garzik wrote:
> 
> It is far easier to guess your private key with a blank passphrase.

Please show me how to do this without gaining access to the machine
in question.
-- 
Debian GNU/Linux 2.2 is out! ( http://www.debian.org/ )
Email:  Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: ssh primer (was Re: pull vs push (was Re: [bk patch] Make cardbus compile in -pre4))

[Jeff Garzik]

Herbert Xu wrote:
> 
> On Sat, Feb 09, 2002 at 07:54:29PM -0500, Jeff Garzik wrote:
> > Herbert Xu wrote:
> > >
> > > Setup your key with an empty passphrase should do the trick.
> >
> > Ug.  no.  That is way way insecure.
> >
> > Most modern distros have an ssh-agent running as a parent of all
> > X-spawned processed (including processes spawned by xterms).  So, one
> > only needs to run
> >       ssh-add ~/.ssh/id_dsa ~/.ssh/identity
> > once, and input your password once.  After that, no passwords are
> > needed.
> 
> This is fine for interactive use.  But for a daily cron job, it's
> just as insecure as no passphrases at all.

It is far easier to guess your private key with a blank passphrase.

	Jeff


-- 
Jeff Garzik      | "I went through my candy like hot oatmeal
Building 1024    |  through an internally-buttered weasel."
MandrakeSoft     |             - goats.com

Re: ssh primer (was Re: pull vs push (was Re: [bk patch] Make cardbus compile in -pre4))

[David Lang]

how does this work when running something from cron? (I think that's the
type of thing Larry is trying to do)

David Lang

On Sat, 9 Feb 2002, Jeff Garzik wrote:

> Date: Sat, 09 Feb 2002 19:54:29 -0500
> From: Jeff Garzik <jgarzik@mandrakesoft.com>
> To: Herbert Xu <herbert@gondor.apana.org.au>
> Cc: Larry McVoy <lm@bitmover.com>, linux-kernel@vger.kernel.org
> Subject: ssh primer (was Re: pull vs push (was Re: [bk patch] Make
>     cardbus  compile in -pre4))
>
> Herbert Xu wrote:
> >
> > Larry McVoy <lm@bitmover.com> wrote:
> >
> > > This is my problem.  You could help if you could tell me what exactly
> > > are the magic wands to wave such that you can ssh in without typing
> > > a password.  I know about ssh-agent but that doesn't help for this,
> >
> > Setup your key with an empty passphrase should do the trick.
>
> Ug.  no.  That is way way insecure.
>
> Most modern distros have an ssh-agent running as a parent of all
> X-spawned processed (including processes spawned by xterms).  So, one
> only needs to run
> 	ssh-add ~/.ssh/id_dsa ~/.ssh/identity
> once, and input your password once.  After that, no passwords are
> needed.
>
>
> For those with multiple peer shells and no X-parented ssh-agent, you
> will need to run ssh-agent ONCE, like so:
>
> 	ssh-agent > ~/tmp/ssh-agent.out
>
> and then for each shell, you need to run:
>
> 	eval `cat ~/tmp/ssh-agent.out`
>
> and then run the ssh-add command from above.
>
> --
> Jeff Garzik      | "I went through my candy like hot oatmeal
> Building 1024    |  through an internally-buttered weasel."
> MandrakeSoft     |             - goats.com
> -
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/
>

Re: ssh primer (was Re: pull vs push (was Re: [bk patch] Make cardbus compile in -pre4))

[Ben Pfaff]

Jeff Garzik <jgarzik@mandrakesoft.com> writes:

> For those with multiple peer shells and no X-parented ssh-agent, you
> will need to run ssh-agent ONCE, like so:
> 
> 	ssh-agent > ~/tmp/ssh-agent.out
> 
> and then for each shell, you need to run:
> 
> 	eval `cat ~/tmp/ssh-agent.out`
> 
> and then run the ssh-add command from above.

I keep the following in my .bashrc and use the `agent' command to
initialize the ssh-agent.

# Allow `agent' to start the ssh-agent usefully on all running
# bash instances.  SIGQUIT was chosen because it is ignored by
# bash by default, even in non-interactive shells, so that a
# shell not trapping it by some chance won't be terminated.
if test -f ~/.ssh/agent; then 
    . ~/.ssh/agent
fi
function agent {
    killall -q ssh-agent
    ssh-agent > ~/.ssh/agent
    killall -QUIT bash >/dev/null 2>&1
    ssh-add ~/.ssh/identity
    ssh-add ~/.ssh/id_dsa
}
trap -- '. ~/.ssh/agent' SIGQUIT

-- 
"Be circumspect in your liaisons with women.
 It is better to be seen at the opera with a man
 than at mass with a woman."
--De Maintenon

Re: ssh primer (was Re: pull vs push (was Re: [bk patch] Make cardbus compile in -pre4))

[Herbert Xu]

On Sat, Feb 09, 2002 at 07:54:29PM -0500, Jeff Garzik wrote:
> Herbert Xu wrote:
> > 
> > Setup your key with an empty passphrase should do the trick.
> 
> Ug.  no.  That is way way insecure.
> 
> Most modern distros have an ssh-agent running as a parent of all
> X-spawned processed (including processes spawned by xterms).  So, one
> only needs to run
> 	ssh-add ~/.ssh/id_dsa ~/.ssh/identity
> once, and input your password once.  After that, no passwords are
> needed.

This is fine for interactive use.  But for a daily cron job, it's
just as insecure as no passphrases at all.
-- 
Debian GNU/Linux 2.2 is out! ( http://www.debian.org/ )
Email:  Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

ssh primer (was Re: pull vs push (was Re: [bk patch] Make cardbus compile in -pre4))

[Jeff Garzik]

Herbert Xu wrote:
> 
> Larry McVoy <lm@bitmover.com> wrote:
> 
> > This is my problem.  You could help if you could tell me what exactly
> > are the magic wands to wave such that you can ssh in without typing
> > a password.  I know about ssh-agent but that doesn't help for this,
> 
> Setup your key with an empty passphrase should do the trick.

Ug.  no.  That is way way insecure.

Most modern distros have an ssh-agent running as a parent of all
X-spawned processed (including processes spawned by xterms).  So, one
only needs to run
	ssh-add ~/.ssh/id_dsa ~/.ssh/identity
once, and input your password once.  After that, no passwords are
needed.


For those with multiple peer shells and no X-parented ssh-agent, you
will need to run ssh-agent ONCE, like so:

	ssh-agent > ~/tmp/ssh-agent.out

and then for each shell, you need to run:

	eval `cat ~/tmp/ssh-agent.out`

and then run the ssh-add command from above.

-- 
Jeff Garzik      | "I went through my candy like hot oatmeal
Building 1024    |  through an internally-buttered weasel."
MandrakeSoft     |             - goats.com