2
$\begingroup$

I am trying to figure out if we need to use single hash function across all the places in a ssh session. i.e – signature generation/verification and HMAC calculation/validation. Is it possible to use two different hash function for signature and HMAC?

I am planning to implement SHA-256 for signature generation/verification in an embedded system. But I am concerned that if I use SHA-256 for HMAC also then there will be much impact on performance considering the lesser CPU capacity of the embedded system. I am new to cryptography so I am not much aware of these things. It will be great if anyone could help.

Improve this question
$\endgroup$
5
  • 3
    $\begingroup$ SSH supports two AEAD cipher suites that don't use HMAC, AES-GCM and ChaCha20-Poly1305. (Or at least recent OpenSSH releases support them.) ChaCha20-Poly1305 in particular is intended to be easy to implement and very fast in software. I question whether you should be especially concerned about SSH or HMAC-SHA256 performance, though. I suspect you would have to be transferring a lot of data on a really bad CPU for it to be a problem. I also note that implementations of everything you want should already exist. Edit: OpenSSH typically uses HMAC-MD5 by default, by the way. $\endgroup$
    – Matt Nordhoff
    Feb 18, 2014 at 4:47
  • 1
    $\begingroup$ @MattNordhoff Just hinting at something… $\endgroup$
    – e-sushi
    Feb 18, 2014 at 14:50
  • $\begingroup$ @e-sushi The other day I posted a really short answer, and got both down- and up-voted. Here I didn't say much about the SSH protocol (since I don't know it) or give more concrete performance details, so I chickened out. Also it had been shorter in my head... $\endgroup$
    – Matt Nordhoff
    Feb 18, 2014 at 23:36
  • $\begingroup$ @MattNordhoff fortunately upvotes and downvotes only cancel each other out with regard to the answer, upvotes win from downvotes hands down regarding rep. Of course, if you are like me, that does not mean much, but it should keep you from becoming CodesInChaos :P $\endgroup$
    – Maarten Bodewes ♦
    Apr 23, 2014 at 0:46
  • $\begingroup$ @owlstead But they don't win hands down in my heart. :'( $\endgroup$
    – Matt Nordhoff
    Apr 23, 2014 at 8:11

1 Answer 1

Reset to default
2
$\begingroup$

As both of us recently learned, the public key signature hash algorithm is negotiated completely separately from the MAC algorithm. DSA and RSA use SHA-1, ECDSA uses SHA-2, and Ed25519 uses, um, Ed25519.

I'm skeptical that SSH crypto performance will be a serious issue for you. I suspect you would have to be transferring a lot of data on a really bad CPU for it to be a problem, that any performance issues you have will probably be elsewhere, and that tinkering with SSH won't make a big difference. Nonetheless, HMAC-MD5 should be the fastest HMAC variant. On the other hand, SHA-1 or SHA-2 are only like twice as slow as MD5, and using one of them may save you from having to implement two different hash functions.

SSH supports other MAC schemes that don't use HMAC at all, and are likely faster. OpenSSH supports UMAC, and there are two AEADs available as well: the standard AES-GCM (implemented incompatibly by OpenSSH) and the new and OpenSSH-only ChaCha20-Poly1305. Without hardware support, ChaCha20-Poly1305 would probably be faster than AES-GCM, and definitely easier to implement safely.

I'd also caution you that writing crypto code is extremely dangerous, with many sharp edges and ways to shoot yourself -- and, worse, your users -- in the feet. It would be better to rely on well-vetted, preexisting software if at all possible.

(Hi e-sushi. :-)

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.