History log of /openssh-portable/krl.h (Results 1 - 10 of 10)
Revision (<<< Hide revision tags) (Show revision tags >>>) Date Author Comments
# 4f7a56d5 21-Jun-2019 djm@openbsd.org

upstream: Add protection for private keys at rest in RAM against

speculation and memory sidechannel attacks like Spectre, Meltdown, Rowhammer
and Rambleed. This change encrypts private k

upstream: Add protection for private keys at rest in RAM against

speculation and memory sidechannel attacks like Spectre, Meltdown, Rowhammer
and Rambleed. This change encrypts private keys when they are not in use with
a symmetic key that is derived from a relatively large "prekey" consisting of
random data (currently 16KB).

Attackers must recover the entire prekey with high accuracy before
they can attempt to decrypt the shielded private key, but the current
generation of attacks have bit error rates that, when applied
cumulatively to the entire prekey, make this unlikely.

Implementation-wise, keys are encrypted "shielded" when loaded and then
automatically and transparently unshielded when used for signatures or
when being saved/serialised.

Hopefully we can remove this in a few years time when computer
architecture has become less unsafe.

been in snaps for a bit already; thanks deraadt@

ok dtucker@ deraadt@

OpenBSD-Commit-ID: 19767213c312e46f94b303a512ef8e9218a39bd4

show more ...


Revision tags: V_8_0_P1, V_7_9_P1
# 9405c621 11-Sep-2018 djm@openbsd.org

upstream: allow key revocation by SHA256 hash and allow ssh-keygen

to create KRLs using SHA256/base64 key fingerprints; ok markus@

OpenBSD-Commit-ID: a0590fd34e7f1141f2873ab3acc5744

upstream: allow key revocation by SHA256 hash and allow ssh-keygen

to create KRLs using SHA256/base64 key fingerprints; ok markus@

OpenBSD-Commit-ID: a0590fd34e7f1141f2873ab3acc57442560e6a94

show more ...


Revision tags: V_7_8_P1, V_7_7_P1, V_7_6_P1, V_7_5_P1, V_7_4_P1, V_7_3_P1, V_7_2_P2, V_7_2_P1, V_7_1_P2
# 6074c84b 30-Dec-2015 djm@openbsd.org

upstream commit

unused prototype

Upstream-ID: f3eef4389d53ed6c0d5c77dcdcca3060c745da97


Revision tags: V_7_1_P1, V_7_0_P1, V_6_9_P1, V_6_8_P1
# e7fd952f 13-Jan-2015 djm@openbsd.org

upstream commit

sync changes from libopenssh; prepared by markus@ mostly
debug output tweaks, a couple of error return value changes and some other
minor stuff


# 74de254b 03-Dec-2014 djm@openbsd.org

upstream commit

convert KRL code to new buffer API

ok markus@


Revision tags: V_6_7_P1, V_6_6_P1, V_6_5_P1, V_6_4_P1, V_6_3_P1, V_6_2_P2, V_6_2_P1
# f3747bf4 17-Jan-2013 Damien Miller

- djm@cvs.openbsd.org 2013/01/17 23:00:01
[auth.c key.c key.h ssh-keygen.1 ssh-keygen.c sshd_config.5]
[krl.c krl.h PROTOCOL.krl]
add support for Key Revocation Lists (KRLs

- djm@cvs.openbsd.org 2013/01/17 23:00:01
[auth.c key.c key.h ssh-keygen.1 ssh-keygen.c sshd_config.5]
[krl.c krl.h PROTOCOL.krl]
add support for Key Revocation Lists (KRLs). These are a compact way to
represent lists of revoked keys and certificates, taking as little as
a single bit of incremental cost to revoke a certificate by serial number.
KRLs are loaded via the existing RevokedKeys sshd_config option.
feedback and ok markus@

show more ...


# 6074c84b 30-Dec-2015 djm@openbsd.org

upstream commit

unused prototype

Upstream-ID: f3eef4389d53ed6c0d5c77dcdcca3060c745da97


# e7fd952f 13-Jan-2015 djm@openbsd.org

upstream commit

sync changes from libopenssh; prepared by markus@ mostly
debug output tweaks, a couple of error return value changes and some other
minor stuff


# 74de254b 03-Dec-2014 djm@openbsd.org

upstream commit

convert KRL code to new buffer API

ok markus@


# f3747bf4 17-Jan-2013 Damien Miller

- djm@cvs.openbsd.org 2013/01/17 23:00:01
[auth.c key.c key.h ssh-keygen.1 ssh-keygen.c sshd_config.5]
[krl.c krl.h PROTOCOL.krl]
add support for Key Revocation Lists (KRLs

- djm@cvs.openbsd.org 2013/01/17 23:00:01
[auth.c key.c key.h ssh-keygen.1 ssh-keygen.c sshd_config.5]
[krl.c krl.h PROTOCOL.krl]
add support for Key Revocation Lists (KRLs). These are a compact way to
represent lists of revoked keys and certificates, taking as little as
a single bit of incremental cost to revoke a certificate by serial number.
KRLs are loaded via the existing RevokedKeys sshd_config option.
feedback and ok markus@

show more ...