<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thanks Matt, I'll give that a shot when I get a build environment set up for the server-side/openwrt.
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I also plan to look at the RSA blinding logic in buf_put_rsa_sign(). Considering the intermittency of the issue I'm thinking the issue has some correlation or dependency to the random data generated or transformed by that logic. Crypto is well outside my core
competency so it'll be slow-going.<br>
</div>
<div>
<div id="appendonsend"></div>
<div style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> Matt Johnston <matt@ucc.asn.au><br>
<b>Sent:</b> Thursday, March 19, 2020 7:04 AM<br>
<b>To:</b> Horshack <horshack@live.com><br>
<b>Cc:</b> dropbear@ucc.asn.au <dropbear@ucc.asn.au><br>
<b>Subject:</b> Re: SSH key exchange fails 30-70% of the time on Netgear X4S R7800</font>
<div> </div>
</div>
<div class="" style="word-wrap:break-word; line-break:after-white-space">Hi,
<div class=""><br class="">
</div>
<div class="">The first thing I'd try would be to build with -O0 compilation flags to rule out compiler optimisations doing something strange. </div>
<div class=""><br class="">
</div>
<div class="">Cheers,</div>
<div class="">Matt</div>
<div class=""><br class="">
<div><br class="">
<blockquote type="cite" class="">
<div class="">On Thu 19/3/2020, at 3:42 pm, Horshack <<a href="mailto:horshack@live.com" class="">horshack@live.com</a>> wrote:</div>
<br class="x_Apple-interchange-newline">
<div class="">
<div class="" style="font-style:normal; font-variant-caps:normal; font-weight:normal; letter-spacing:normal; text-align:start; text-indent:0px; text-transform:none; white-space:normal; word-spacing:0px; text-decoration:none; font-family:Calibri,Helvetica,sans-serif; font-size:12pt">
Update - I cloned and built the dbclient source so I could enable the debug tracing facility to get more information about the 'Bad hostkey signature'. The intermittent failure is detected in recv_msg_kexdh_reply() -> buf_rsa_verify() -> mp_cmd(). If I bypass
the buf_rsa_verify() call then the session proceeds normally without issue, which indicates everything else in the key exchange is working 100% of the time. I'll dig deeper to see why the signed host key sent by the server is wrong.<br class="">
</div>
<div class="" style="font-style:normal; font-variant-caps:normal; font-weight:normal; letter-spacing:normal; text-align:start; text-indent:0px; text-transform:none; white-space:normal; word-spacing:0px; text-decoration:none; font-family:Calibri,Helvetica,sans-serif; font-size:12pt">
<br class="">
</div>
<div class="" style="font-family:Helvetica; font-size:13px; font-style:normal; font-variant-caps:normal; font-weight:normal; letter-spacing:normal; text-align:start; text-indent:0px; text-transform:none; white-space:normal; word-spacing:0px; text-decoration:none">
<hr tabindex="-1" class="" style="display:inline-block; width:605.625px">
<div id="x_divRplyFwdMsg" dir="ltr" class=""><font class="" style="font-size:11pt" face="Calibri, sans-serif"><b class="">From:</b><span class="x_Apple-converted-space"> </span>Horshack <br class="">
<b class="">Sent:</b><span class="x_Apple-converted-space"> </span>Wednesday, March 18, 2020 9:36 AM<br class="">
<b class="">To:</b><span class="x_Apple-converted-space"> </span><a href="mailto:dropbear@ucc.asn.au" class="">dropbear@ucc.asn.au</a> <<a href="mailto:dropbear@ucc.asn.au" class="">dropbear@ucc.asn.au</a>><br class="">
<b class="">Subject:</b><span class="x_Apple-converted-space"> </span>SSH key exchange fails 30-70% of the time on Netgear X4S R7800</font>
<div class=""> </div>
</div>
<div dir="ltr" class="">
<div class="" style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt">
<div class="" style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt">Hi,</div>
<div class="" style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt"><br class="">
</div>
<div class="" style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt">I have a strange issue on my Netgear X4S R7800. Running either DD-WRT or OpenWrt, approximately 30-70% of my SSH login attempts fail. For OpenSSH clients the error reported is "error
in libcrypto". For the PuTTY client the error is more descriptive - "Signature from server's host key is invalid". The failure occurs even when using the OpenSSH client built in to OpenWrt itself (ie, SSH'ing into the router from the router via an existing
remote SSH session).</div>
<div class="" style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt"><br class="">
</div>
<div class="" style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt">The failure appears to be at the tail end of the key exchange, before authentication. I've tried varying the cipher (aes128-ctr / aes256-ctr), the MAC (hmac-sha1 / hmac-sha2-256),
and the key exchange algo (curve25519-sha256 / <a href="mailto:curve25519-sha256@libssh.org" class="">
curve25519-sha256@libssh.org</a> / diffie-hellman-group14-sha256 / diffie-hellman-group14-sha1) but the intermittent failure still occurs. The frequency of failure is about the same for all these configuration options except for diffie-hellman-group14-sha256,
which fails much more frequently - it sometimes takes hundreds of attempts to succeed. Perhaps that will provide a clue to the underlying cause.<br class="">
</div>
<div class="" style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt"><br class="">
</div>
<div class="" style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt">Once an SSH login succeeds the connection is stable. However if I initiate a manual rekey operation via ~R then the key re-exchange fails. The router is otherwise very stable with
no noticeable issues.</div>
<div class="" style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt"><br class="">
</div>
<div class="" style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt">I'm an embedded firmware engineer but have never worked on DD-WRT/OpenWrt firmware or dropbear. I have a conceptual understanding of the key exchange algo but haven't looked at the
actual code of any implementation including Dropbear's. I'm seek ideas on how to troubleshoot this issue. Considering the problem is intermittent I'm thinking it's some variant in the key generation/exchange algorithm that's failing due to some issue with
the router, or a more remote possibility, an issue with the Dropbear implementation.<br class="">
</div>
<div class="" style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt"><br class="">
</div>
<div class="" style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt">Here are pastebin links to the PuTTY full debug logs (w/raw data dumps) for both the failure and success cases:</div>
<div class="" style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt">Failure Case:<span class="x_Apple-converted-space"> </span><a href="https://pastebin.com/MS2BtFmW" target="_blank" rel="noopener noreferrer" class="">https://pastebin.com/MS2BtFmW</a><br class="">
</div>
<div class="" style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt">Success Case:<span class="x_Apple-converted-space"> </span><a href="https://pastebin.com/c4j66Ga9" target="_blank" rel="noopener noreferrer" class="">https://pastebin.com/c4j66Ga9</a><br class="">
</div>
<div class="" style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt"><br class="">
</div>
<div class="" style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt">The only message I see from dropbear for a failed connection attempt is:</div>
<div class="" style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt"><br class="">
</div>
<div class="" style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt"><span class=""><a href="http://authpriv.info" class="">authpriv.info</a> dropbear[15948]: Child connection from 192.168.1.249:54819<br class="">
</span><span class=""><a href="http://authpriv.info" class="">authpriv.info</a> dropbear[15948]: Exit before auth: Disconnect received</span><br class="">
</div>
<div class="" style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt"><br class="">
</div>
<div class="" style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt"><br class="">
</div>
<div class="" style="font-family:Calibri,Helvetica,sans-serif; font-size:12pt">Thanks!</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<br class="">
</div>
</div>
</div>
</body>
</html>