When using kex: 'diffie-hellman-group-exchange-sha256','diffie-hellman-group-exchange-sha1', do not show up in actual server kex list

[developer94404]

Hi,

For what it's worth, I'm running your library in docker and built off of docker's node 7.6 image.

The issue / question is:
When I put the two kex: 'diffie-hellman-group-exchange-sha256','diffie-hellman-group-exchange-sha1' in the custom kex list, and enable the server's debug: console.log mode, I do not see those two listed in the server's kex list.

Ones that do appear when I put them in the custom kex list:
''diffie-hellman-group1-sha1"
'ecdh-sha2-nistp256','ecdh-sha2-nistp384','ecdh-sha2-nistp521','diffie-hellman-group14-sha1' (the default ones)

Have I made a user error with the 'diffie-hellman-group-exchange-sha256','diffie-hellman-group-exchange-sha1' kex's ? Or is there an issue causing them to not be used / show up in the server's kex list ?

Thanks!

[mscdex]

Group exchange is not supported yet for ssh.Server instances because it more or less requires some more infrastructure for the best security.

For example, OpenSSH keeps some pre-computed primes around in a flat file (/etc/ssh/moduli) that it uses when performing group-exchange-based key exchanges (to avoid heavy computation per connection). These primes are typically refreshed at some interval in the background. However, if this file isn't accessible or does not contain any primes, then OpenSSH will use some fixed, static primes compiled into the OpenSSH binary.

ssh2-streams could go the route of adding at least the fixed primes, but I'm not sure how beneficial/secure that really is since I would guess for most OpenSSH installations, /etc/ssh/moduli is usable and thus OpenSSH would typically not ever use the fixed primes.

[developer94404]

Ah, that makes alot of sense now. Thanks for kindly explaining the issue. I believe this can be closed, then.

[xMarkusSpringerx]

@mscdex is 'diffie-hellman-group-exchange-sha256' already supported? Do you have any info about this?

[mscdex]

@xMarkusSpringerx The lists of supported algorithms are listed in the readme.

[xMarkusSpringerx]

new ssh2.Server({
    hostKeys: [fs.readFileSync(hostKey)],
    algorithms: {
        kex: ['diffie-hellman-group-exchange-sha256', 'ecdh-sha2-nistp256', 'ecdh-sha2-nistp384', 'ecdh-sha2-nistp521', 'diffie-hellman-group14-sha1'],
        cipher: ['aes128-ctr', 'aes192-ctr', 'aes256-ctr', 'aes128-gcm', 'aes128-gcm@openssh.com', 'aes256-gcm', 'aes256-gcm@openssh.com', 'aes256-cbc', 'aes192-cbc', 'aes128-cbc']
    }
}, (client: Connection, info: ClientInfo) => {

@mscdex this is weird. I added those keys to my ssh server config.
But still my server doesn't provide the diffie-hellman-group-exchange-sha256 key. Do you know what could be the issue here?

PORT     STATE SERVICE VERSION
8022/tcp open  ssh     (protocol 2.0)
| fingerprint-strings:
|   NULL:
|_    SSH-2.0-ssh2js0.4.4srv
| ssh2-enum-algos:
|   kex_algorithms: (4)
|       ecdh-sha2-nistp256
|       ecdh-sha2-nistp384
|       ecdh-sha2-nistp521
|       diffie-hellman-group14-sha1
|   server_host_key_algorithms: (1)
|       ssh-rsa
|   encryption_algorithms: (10)
|       aes128-ctr
|       aes192-ctr
|       aes256-ctr
|       aes128-gcm
|       aes128-gcm@openssh.com
|       aes256-gcm
|       aes256-gcm@openssh.com
|       aes256-cbc
|       aes192-cbc
|       aes128-cbc
|   mac_algorithms: (3)
|       hmac-sha2-256
|       hmac-sha2-512
|       hmac-sha1
|   compression_algorithms: (3)
|       none
|       zlib@openssh.com
|_      zlib

[mscdex]

Ah, it's not supported for servers because additional infrastructure (typically outside of node) would be required.

[xMarkusSpringerx]

Ah okay thx @mscdex, but in theory it's doable? If yes do you have any documentation for it? Some firewalls mark the ecdh-sha2-nistp... algos as secure but with a possible NSA backdoor. So I'm just curious if there is a solution for it.

_{Sent with GitHawk}

[mscdex]

It's not really feasible without additional infrastructure outside of node and without comprising the security of the algorithm.

At this stage it'd be better to support something like curve25519, but node core needs to support it first.

[xMarkusSpringerx]

Thx for this info. I really appreciate it :) Let's see how long it'll take for node to implement it.

_{Sent with GitHawk}