[JENKINS-39805] - Update SSHD module to 1.8

[oleg-nenashev]

The fix disables some obsolete Ciphers as per JENKINS-39805: AES128CBC, TripleDESCBC, and BlowfishCBC

All changes: jenkinsci/sshd-plugin@sshd-1.7...sshd-1.8

@jenkinsci/code-reviewers, @chillum, @ydubreuil, @aheritier

[daniel-beck]

👍 assuming sshd-core doesn't offer better ciphers as further alternatives.

[oleg-nenashev]

@daniel-beck It does. Many Ciphers have been introduced since 0.8.0 we use: https://github.com/apache/mina-sshd/tree/master/sshd-core/src/main/java/org/apache/sshd/common/cipher

[oleg-nenashev]

So the latest versions are incompatible. We could update to 0.14.0 and get several "new" ciphers: https://github.com/apache/mina-sshd/tree/sshd-0.14.0/sshd-core/src/main/java/org/apache/sshd/common/cipher . Upgrade to the latest version will be much more painful

[chillum]

I would say, there are no valuable ciphers in 0.14.0. That is: I see only EC-DSA ones, they're also considered insecure and not included into latest OpenSSH. CMIIW.

That is: a modern SSH implementation should support two ciphers: AES-CTR and ChaCha-Poly. I don't see the latter in the latest mina-sshd though.

Other things we could improve with time in Jenkins SSH support however are:

1. Support of ED25519 keys (seems to be in latest mina-sshd, but not in 0.14.0)
2. Support of SHA2 MACs
3. Support of curve25519-sha256 and diffie-hellman-group-exchange-sha256 key exchange algorithms

[oleg-nenashev]

Yes, 0.14.0 is 2 years old. So it is definitely not a state of the art. But
upgrade to it is something we could do more or less easily.

Upgrade to mina-ssh 2.x or migration to other lib will break the core's
binary compatibility. We could do it, but it is a big chunk of
investigation work.

On Nov 20, 2016 11:28, "Vasily Korytov" [email protected] wrote:

I was wrong, it seems like the latest mina-sshd supports ED25519, but
that's not the case with 0.14.0.

—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
#2641 (comment),
or mute the thread
https://github.com/notifications/unsubscribe-auth/AC3IoO4oV3OU3a3PrzzBzPrGsAX9ERkTks5rACDUgaJpZM4K3aND
.

[oleg-nenashev]

Merging the current PR. I hope to try updating to 0.14.0 and adding "new" Ciphers from there later