Opened 10 years ago

Closed 8 years ago

#8985 closed Feature request (fixed)

Add aes128-gcm@openssh.com and aes256-gcm@openssh.com Ciphers and umac-128-etm@openssh.com MAC support for SFTP

Reported by: Frankie Owned by:
Priority: normal Component: FileZilla Client
Keywords: aes128-gcm@openssh.com aes256-gcm@openssh.com umac-128-etm@openssh.com GCM UMAC EtM "Galois/Counter Mode" "Encrypt-then-MAC" ChaCha20 Poly1305 Cc: fz@…
Component version: Operating system type: Linux
Operating system version: Ubuntu 13.04

Description

These ciphers and MAC were added to OpenSSH 6.2 release. Unfortunately, FileZilla 3.7.3 wont connect via SFTP protocol to my servers that exclusively use these ciphers and MAC.

Change History (6)

comment:1 by Frankie, 10 years ago

Cc: fz@… added
Keywords: aes128-gcm@openssh.com aes256-gcm@openssh.com umac-128-etm@openssh.com GCM UMAC EtM "Galois/Counter Mode" "Encrypt-then-MAC" added

comment:2 by Alexander Schuch, 10 years ago

Status: newmoreinfo

Can you please provide logs?

comment:3 by Frankie, 10 years ago

Status: moreinfonew

Here you go:

Connects with no cipher & MAC restriction:

Status: Connecting to 142.4.32.215...
Trace: Going to execute /usr/bin/fzsftp
Response: fzSftp started
Trace: CSftpControlSocket::ConnectParseResponse(fzSftp started)
Trace: CSftpControlSocket::SendNextCommand()
Trace: CSftpControlSocket::ConnectSend()
Command: open "root@142.4.32.215" 22
Trace: Server version: SSH-2.0-OpenSSH_6.3p1-hpn14v2
Trace: Using SSH protocol version 2
Trace: We claim version: SSH-2.0-PuTTY_Local:_Sep_16_2013_20:31:59
Trace: Doing Diffie-Hellman group exchange
Trace: Doing Diffie-Hellman key exchange with hash SHA-256
Trace: Host key fingerprint is:
Trace: ssh-rsa 2048 ef:be:2b:1b:6e:f8:ec:27:16:dc:26:bb:28:5f:20:67
Trace: Initialised AES-256 SDCTR client->server encryption
Trace: Initialised HMAC-SHA1 client->server MAC algorithm
Trace: Initialised AES-256 SDCTR server->client encryption
Trace: Initialised HMAC-SHA1 server->client MAC algorithm
Trace: Pageant is running. Requesting keys.
Trace: Pageant has 1 SSH-2 keys
Trace: Trying Pageant key #0
Trace: Server refused public key
Trace: Keyboard-interactive authentication refused
Command: Pass: *
Trace: Sent password
Trace: Access granted
Trace: Server initiated key re-exchange
Trace: Doing Diffie-Hellman group exchange
Trace: Doing Diffie-Hellman key exchange with hash SHA-256
Trace: Initialised AES-256 SDCTR client->server encryption
Trace: Initialised HMAC-SHA1 client->server MAC algorithm
Trace: Initialised AES-256 SDCTR server->client encryption
Trace: Initialised HMAC-SHA1 server->client MAC algorithm
Trace: Opened channel for session
Trace: Started a shell/command
Status: Connected to 142.4.32.215
Trace: CSftpControlSocket::ConnectParseResponse()
Trace: CSftpControlSocket::ResetOperation(0)
Trace: CControlSocket::ResetOperation(0)
Status: Retrieving directory listing...
Trace: CSftpControlSocket::SendNextCommand()
Trace: CSftpControlSocket::ChangeDirSend()
Command: pwd
Response: Current directory is: "/root"
Trace: CSftpControlSocket::ResetOperation(0)
Trace: CControlSocket::ResetOperation(0)
Trace: CSftpControlSocket::ParseSubcommandResult(0)
Trace: CSftpControlSocket::ListSubcommandResult()
Trace: CSftpControlSocket::SendNextCommand()
Trace: CSftpControlSocket::ListSend()
Command: ls
Status: Listing directory /root
Trace: CSftpControlSocket::ListParseResponse()
Trace: CSftpControlSocket::SendNextCommand()
Trace: CSftpControlSocket::ListSend()
Status: Calculating timezone offset of server...
Command: mtime ".bash_history"
Response: 1382137924
Trace: CSftpControlSocket::ListParseResponse(1382137924)
Status: Timezone offsets: Server: -25200 seconds. Local: -25200 seconds. Difference: 0 seconds.
Trace: CSftpControlSocket::ResetOperation(0)
Trace: CControlSocket::ResetOperation(0)
Status: Directory listing successful
Status: Disconnected from server
Trace: CSftpControlSocket::ResetOperation(66)
Trace: CControlSocket::ResetOperation(66)

Won't connect with aes256-gcm and/or umac-218-etm:

Status: Connecting to 142.4.32.215...
Trace: Going to execute /usr/bin/fzsftp
Response: fzSftp started
Trace: CSftpControlSocket::ConnectParseResponse(fzSftp started)
Trace: CSftpControlSocket::SendNextCommand()
Trace: CSftpControlSocket::ConnectSend()
Command: open "root@142.4.32.215" 22
Trace: Server version: SSH-2.0-OpenSSH_6.3p1-hpn14v2
Trace: Using SSH protocol version 2
Trace: We claim version: SSH-2.0-PuTTY_Local:_Sep_16_2013_20:31:59
Trace: CSftpControlSocket::ResetOperation(66)
Trace: CControlSocket::ResetOperation(66)
Error: Could not connect to server
Status: Waiting to retry...
Status: Connecting to 142.4.32.215...
Trace: Going to execute /usr/bin/fzsftp
Response: fzSftp started
Trace: CSftpControlSocket::ConnectParseResponse(fzSftp started)
Trace: CSftpControlSocket::SendNextCommand()
Trace: CSftpControlSocket::ConnectSend()
Command: open "root@142.4.32.215" 22
Trace: Server version: SSH-2.0-OpenSSH_6.3p1-hpn14v2
Trace: Using SSH protocol version 2
Trace: We claim version: SSH-2.0-PuTTY_Local:_Sep_16_2013_20:31:59
Trace: CSftpControlSocket::ResetOperation(66)
Trace: CControlSocket::ResetOperation(66)
Error: Could not connect to server

comment:4 by Frankie, 10 years ago

Keywords: ChaCha20 Poly1305 added

I know this is likely a pipe dream because I think FileZilla uses PuTTY tools for SFTP. So this is more just me tossing a coin in a wishing well...

OpenSSH 6.5 added ChaCha20 cipher with Poly1305 MAC as an RC4 replacement. That would be nice too. I host a SFTP server and I've been forcing my Windows users to use Cygwin because of my cipher/MAC restrictions.

comment:5 by Tim Kosse, 8 years ago

ChaCha20 with Poly1305 is now supported, though has a lower priority than AES-based ciphers due to lack of hardware acceleration.

comment:6 by Tim Kosse, 8 years ago

Resolution: fixed
Status: newclosed

I've recently implemented support for the GCM ciphers, they'll be available in the next version of FileZilla.

Note: See TracTickets for help on using tickets.