Bug 1961387

Summary:	[RFE] Requesting HPN-SSH feature for openssh package in RHEL8
Product:	Red Hat Enterprise Linux 8	Reporter:	Daniel Chong <dchong>
Component:	openssh	Assignee:	Dmitry Belyavskiy <dbelyavs>
Status:	CLOSED DEFERRED	QA Contact:	BaseOS QE Security Team <qe-baseos-security>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	8.3	CC:	ccheney, hkario, jeharris, jjelen, ssorce
Target Milestone:	beta	Keywords:	FutureFeature, Triaged
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-05-26 10:50:41 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Comment 4 Jakub Jelen 2021-05-18 08:18:37 UTC

The None cipher/mac is certainly no-go. The SSH is secure shell and implementing none cipher and mac is explicitly not recommended by RFC4253 [1]. If you want to transfer files in plaintext, please use ftp or something like that.

I think the concerns stated in the bug #537198 still apply. Reading through the patches (not clear if you want just the first HPN one or some others) [2], it is several thousands lines long and really the only performance improvement that is viable would be the multi-threaded AES-CTR cipher, some buffer sizes and dynamic windows, which might be something we can consider to push upstream and maybe downstream, if there will be no other concerns.

The question is how this would work for FIPS/CC certifications, as mutli-threaded encryption is not common out there. Simo?

Maintaining two versions of OpenSSH is not something we have a cycles to do either.


[1] https://datatracker.ietf.org/doc/html/rfc4253#page-11
[2] https://sourceforge.net/projects/hpnssh/files/Patches/HPN-SSH%2015v2%208.5p1/