From: Bruno Thomsen <bth@kamstrup.com>
To: "ptxdist@pengutronix.de" <ptxdist@pengutronix.de>
Subject: Re: [ptxdist] OpenSSH patches
Date: Tue, 7 Jul 2015 09:13:09 +0000 [thread overview]
Message-ID: <915054555B5659448ACF8A70E114824D01BD2C5ECE@Exchange2010.kamstrup.dk> (raw)
In-Reply-To: <20150707085252.GA26480@pqgruber.com>
Hey Clemens,
> what do you think about my recent OpenSSH patches (not the version bumps) but enabling the sandbox per default (to use seccomp if available) and the switch from DSA to Ed25519. ArchLinux and current Debian both generate Ed25519 pubkeys by default and add them as HostKey to sshd_config.
> They keep DSA and ECDSA but as they fall apart completely if the random numbers used are not good, I am not sure this is a good idea for embedded systems where entropy is often very scarce. Ed25519 is not that sensitive to entropy problems.
I agree, when possible we should use ed25519. Adam Langley blog entry[1].
/Bruno
[1] https://www.imperialviolet.org/2013/06/15/suddendeathentropy.html
--
ptxdist mailing list
ptxdist@pengutronix.de
next prev parent reply other threads:[~2015-07-07 7:13 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-07-07 8:52 Clemens Gruber
2015-07-07 9:13 ` Bruno Thomsen [this message]
2015-07-07 9:35 ` Clemens Gruber
2015-07-14 10:03 ` Michael Olbrich
2015-07-29 20:05 ` Clemens Gruber
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=915054555B5659448ACF8A70E114824D01BD2C5ECE@Exchange2010.kamstrup.dk \
--to=bth@kamstrup.com \
--cc=ptxdist@pengutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox