https://bugzilla.mindrot.org/show_bug.cgi?id=3387
Bug ID: 3387
Summary: Will future versions of openssh not support DHE
because of "dheater" vulnerability :CVE-2002-20001?
Product: Portable OpenSSH
Version: 8.8p1
Hardware: Other
OS: All
Status: NEW
Severity: enhancement
Priority: P5
Component: sshd
Assignee: [email protected]
Reporter: [email protected]
The Diffie-Hellman Key Agreement Protocol allows remote attackers (from
the client side) to send arbitrary numbers that are actually not public
keys, and trigger expensive server-side DHE modular-exponentiation
calculations, aka a D(HE)ater attack. We have repeated the attack when
establish ssh connections. What will openssh do to avoid dheater?
--
You are receiving this mail because:
You are watching the assignee of the bug.
_______________________________________________
openssh-bugs mailing list
[email protected]
https://lists.mindrot.org/mailman/listinfo/openssh-bugs
