Re: [ssh] Host key sync - "global-requests-ok" extension

[denis bider <ietf-ssh3%denisbider.com@localhost>]

You're focusing on an outdated aspect of the spec instead of widely 
known best practice.

CBC algorithms are known to have security problems in the way they are 
used in SSH. They haven't been recommended for use in years.

If we ship the SSH Server with CBC algorithms enabled, we get support 
cases from users failing security scans.


On 2018-12-19 04:24, Peter Gutmann wrote:
> denis bider <ietf-ssh3%denisbider.com@localhost> writes:
>
> > > Do you have a test server up that we can run clients against?
> > We do now:
> >
> > ssh -P 10999 test%experiment.bitvise.com@localhost
> You know how I complained about OpenSSH not supporting any of the MTI
> symmetric ciphers in the SSH spec?  Well...
>
> Error: No algorithm compatible with the remote system's selection was found: 'aes256-gcm%openssh.com@localhost,aes128-gcm%openssh.com@localhost,aes256-ctr,aes192-ctr,aes128-ctr,3des-ctr'.
>
> Peter.