Skip to content

Key exchange negotiation failed when speak to OpenSSH 6.5 and 6.6 #1191

Closed
@scott-xu

Description

@scott-xu

OpenSSH 6.5 and 6.6 has a bug that causes ~0.2% of connections using the curve25519-sha256@libssh.org KEX exchange method to fail when connecting with something that implements the spec properly, for instance, SSH.NET

The bug is fixed in OpenSSH 6.6.1 and 6.7 onwards, see openssh/openssh-portable@adbfdbb

They also implemented a compatibility logic in newer OpenSSH so that when newer OpenSSH client speaks to OpenSSH 6.5/6.6, the client will NOT propose curve25519-sha256 nor curve25519-sha256@libssh.org key exchange method.

Currently, when SSH.NET speaks to OpenSSH 6.5/6.6, ~0.2% of connections will throw below exception:

Renci.SshNet.Common.SshConnectionException: Key exchange negotiation failed.
at Renci.SshNet.Session.WaitOnHandle(WaitHandle waitHandle, TimeSpan timeout) in \SSH.NET-rsa-sha2-256\src\Renci.SshNet\Session.cs:line 977
at Renci.SshNet.Session.WaitOnHandle(WaitHandle waitHandle) in \SSH.NET-rsa-sha2-256\src\Renci.SshNet\Session.cs:line 874
at Renci.SshNet.Session.ConnectAsync(CancellationToken cancellationToken) in \SSH.NET-rsa-sha2-256\src\Renci.SshNet\Session.cs:line 739
at Renci.SshNet.BaseClient.CreateAndConnectSessionAsync(CancellationToken cancellationToken) in \SSH.NET-rsa-sha2-256\src\Renci.SshNet\BaseClient.cs:line 545
at Renci.SshNet.BaseClient.ConnectAsync(CancellationToken cancellationToken) in \SSH.NET-rsa-sha2-256\src\Renci.SshNet\BaseClient.cs:line 284

Options:

  • We could consider removing curve25519-sha256 and curve25519-sha256@libssh.org key exchange algorithms when and only when speak to OpenSSH 6.5 and 6.6.
  • We could expose some event during negotiation so that user can attach a handler to the event and filter the key exchange algorithems based on server identification. For example: event EventHandler<SshIdentificationEventArgs> ServerIdentificationReceived
  • Or we could do both.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions