| Weekly edition | Kernel | Security | Distributions | Search |
| Archives | Calendar | Subscribe | Write for LWN | LWN.net FAQ |
Multi-threaded OpenSSH
Multi-threaded OpenSSH
Posted Feb 13, 2008 18:09 UTC (Wed) by tialaramex (subscriber, #21167)Parent article: Multi-threaded OpenSSH
For the special case of file transfers, I'd love to see a facility -- which I don't think can be added as a SSH 'service' with the current infrastructure -- that allowed me to transfer a file without encryption, ie using integrity checking only. To be quite specific: Only blocks of file data would be unencrypted - the metadata, including the crytographic checksums used to verify integrity, would be sent in the ordinary way for any SSH service, fully encrypted. This is quite different from the "None" cipher switch described by Pittsburgh, as far as I can tell. My proposal would significantly reduce CPU resources for the transfer, at a price of revealing to any adversary eavesdropping on the transfer what was transferred (existing SSH already reveals the origin, destination and approximate size). Every other advantage of SSH (secure authentication, safety against Man-in-the-middle attacks, etc.) would be preserved. For many purposes this would be acceptable.
(Log in to post comments)
Multi-threaded OpenSSH
Posted Feb 13, 2008 18:23 UTC (Wed) by eklitzke (subscriber, #36426) [Link]
What's the problem with using rsync? You can authenticate using your ssh keys and the transfer is unencrypted.
Multi-threaded OpenSSH
Posted Feb 13, 2008 18:47 UTC (Wed) by JoeBuck (subscriber, #2330) [Link]
That's incorrect; rsync over ssh is encrypted.
Multi-threaded OpenSSH
Posted Feb 14, 2008 5:43 UTC (Thu) by gdt (subscriber, #6284) [Link]
Rsync does have an option to authenticate using challenge-response. This prevents sniffing of the password, but the password is held as plain text on the server and asking users never to use the same password as elsewhere is rarely successful.
Rsyncd with MD5 can be an effective solution to high speed file transfers but performance is not as good as using a web server with MD5 authentication (rsync's use of blocks limits the effectiveness of sendfile() whereas even a bloated webserver can call sendfile() after generating the HTTP header).
Both of these options, as well as the plaintext variant of SSH, are fine if the data is not confidential. This is true of some science data, such as from radio telescope sensors (this is publicly available, nearly random and needs serious supercomputing to make any sense of). The problem this variant of SSH solves is the case when the confidentiality of the data needs to be retained as it crosses the network.
Multi-threaded OpenSSH
Posted Feb 13, 2008 21:16 UTC (Wed) by wahern (subscriber, #37304) [Link]
That patch exists, from the same people at PSU, IIRC. Grep the openssh dev mailing-list.
Multi-threaded OpenSSH
Posted Feb 14, 2008 4:03 UTC (Thu) by cajal (guest, #4167) [Link]
That's PSC - the Pittsburgh Supercomputing Center. PSU is Penn State University, which is about 3 hours north-east in PA :)