ecdsa-sha2-nistp<256/384/521>
See original GitHub issue@jtesta , ssh-audit 2.4.0 returns the following for host key algorithms ecdsa-sha2-nistp256
, ecdsa-sha2-nistp384
and ecdsa-sha2-nistp521
:
# host-key algorithms
(key) ecdsa-sha2-nistp521 -- [fail] using weak elliptic curves
`- [warn] using weak random number generator could reveal the key
`- [info] available since OpenSSH 5.7, Dropbear SSH 2013.62
(key) ecdsa-sha2-nistp384 -- [fail] using weak elliptic curves
`- [warn] using weak random number generator could reveal the key
`- [info] available since OpenSSH 5.7, Dropbear SSH 2013.62
(key) ecdsa-sha2-nistp256 -- [fail] using weak elliptic curves
`- [warn] using weak random number generator could reveal the key
`- [info] available since OpenSSH 5.7, Dropbear SSH 2013.62
Would it be possible to update the [fail]
message to include a citation to a credible source that backs up the claim of using weak elliptic curves
?
I’ve seen that you presented on the topic of Problems With Elliptic Curves In TLS and SSH at Rochester Security Summit (RSS) 2017.
Perhaps ssh-audit could cite your presentation?
Issue Analytics
- State:
- Created 2 years ago
- Comments:13 (10 by maintainers)
Top Results From Across the Web
Why OpenSSH prefers ECDSA nistp256 keys over -384 and
NIST keys are probably preferred over ED25519 for compatibility ... E.g. ssh-rsa is going to use sha1 and ecdsa-sha2-nistp521 is going to ...
Read more >Error reading entry '[...]ecdsa-sha2-nistp256[...]' could not ...
Hi Swapnil,. Prefer to use Github to file issues and to keep track with what's implemented. ECDSA-SHA2-NISTP<256,384,521> have all been implemented some time ......
Read more >KeyPairProvider (Apache Mina SSHD - javadoc.io
SSH identifier for EC keys in NIST curve P-256 ... Load a key of the specified type which can be "ssh-rsa", "ssh-dss", or...
Read more >mina-sshd/KeyPairProvider.java at master - GitHub
SSH identifier for EC keys in NIST curve P-256. */. String ECDSA_SHA2_NISTP256 = ECCurves.nistp256. ... "ecdsa-sha2-nistp{256,384,521}".
Read more >Generating SSH keys with a command - IBM Cloud Docs
The following cryptographic algorithms are supported by Hyper Protect Virtual Servers for generating SSH keys: ssh-rsa (the default); ssh-ed25519; ecdsa-sha2- ...
Read more >
Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free
Top Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Yep, that looks good.
When verbose mode is enabled, the JSON output should include the references as well.
I think it would make more sense to include it along the error:
As you could have multiple references:
Although I guess you could use the same format for adding references in a new sublevel: