Re: Fixing exchange of host keys in the SSH key exchange

[Mouse <mouse%Rodents-Montreal.ORG@localhost>]

>> Another possible benefit would be automatic defeat of
>> host-key-gathering bots.  [...]
> I assume this is for weak-key-checking/key-sharing detection for
> research purposes, or is there some malicious use for the info?

Well, I don't run one, and have never (knowingly) communicated with
anyone who does, so I don't actually know the intent behind them.  But
the way so many different hosts have been connecting and getting dumped
(and blocked at my border) after so long with the block in place makes
me think much of it is done by one or more botnets, which makes it
difficult for me to believe it's not malicious.  The few that are at
least a little honest about what they're doing (eg, ZGrab) have pretty
much gone away since the block went in.

Possible malicious use would be to break the host keys for hosts that
have too weak a key (whatever "too weak" means for the botnet herder in
question).

As for research, I don't consider it acceptable to co-opt others' hosts
for research without verifying their consent first, especially not when
it involves trawling for security-sensitive material.  I see no reason
anyone whom I don't want to actually authenticate to me should have a
copy of my host keys.

>> I can't help wondering if perhaps this is time to use the uint32 in
>> SSH_MSG_KEXINIT that is "0 (reserved for future extension)", [...]
> I think this was discussed in the context of SSH extensions and the
> conclusion was that far too many things would break if this was
> nonzero.  So even though it's marked as RFU, in practice it's "always
> set to zero".

Well, it seems to me that it could be used if the other end first
indicates support for whatever the use is.  There won't be many such,
since either that has to be done in the clear or it has to not apply to
the first kex, but this could be an example: the client indicates its
support before the server has to generate its KEXINIT packet.

/~\ The ASCII				  Mouse
\ / Ribbon Campaign
 X  Against HTML		mouse%rodents-montreal.org@localhost
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B