From owner-freebsd-security@freebsd.org  Tue Dec  1 04:34:11 2015
Return-Path: <owner-freebsd-security@freebsd.org>
Delivered-To: freebsd-security@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id AEB8EA3D8EE
 for <freebsd-security@mailman.ysv.freebsd.org>;
 Tue,  1 Dec 2015 04:34:11 +0000 (UTC)
 (envelope-from julian@freebsd.org)
Received: from vps1.elischer.org (vps1.elischer.org [204.109.63.16])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id 832071119
 for <freebsd-security@freebsd.org>; Tue,  1 Dec 2015 04:34:11 +0000 (UTC)
 (envelope-from julian@freebsd.org)
Received: from Julian-MBP3.local
 (50-196-156-133-static.hfc.comcastbusiness.net [50.196.156.133])
 (authenticated bits=0)
 by vps1.elischer.org (8.15.2/8.15.2) with ESMTPSA id tB14Y4tH004047
 (version=TLSv1.2 cipher=DHE-RSA-AES128-SHA bits=128 verify=NO);
 Mon, 30 Nov 2015 20:34:07 -0800 (PST)
 (envelope-from julian@freebsd.org)
Subject: Re: OpenSSH HPN
To: Brooks Davis <brooks@freebsd.org>, Aaron Zauner <azet@azet.org>
References: <86y4e47uty.fsf@desk.des.no> <56436F4B.8050002@FreeBSD.org>
 <86r3jwfpiq.fsf@desk.des.no> <20151111181339.GE48728@zxy.spb.ru>
 <86io58flhk.fsf@desk.des.no> <20151111184448.GR31314@zxy.spb.ru>
 <CAGnMC6rMaY2a_F4qpxX4rB6n6n-tvijH74jxf8j94-2V8r_V8g@mail.gmail.com>
 <alpine.GSO.1.10.1511122120050.26829@multics.mit.edu>
 <86egfu9z0j.fsf@desk.des.no> <20151124212613.4ff9b25ea0@80601bfc61c7744>
 <20151130192348.GD81246@spindle.one-eyed-alien.net>
Cc: Dag-Erling Sm??rgrav <des@des.no>, freebsd-security@freebsd.org,
 freebsd-current@freebsd.org, Dewayne Geraghty <dewaynegeraghty@gmail.com>,
 Benjamin Kaduk <kaduk@MIT.EDU>
From: Julian Elischer <julian@freebsd.org>
Message-ID: <565D2336.60505@freebsd.org>
Date: Tue, 1 Dec 2015 12:33:58 +0800
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:38.0)
 Gecko/20100101 Thunderbird/38.4.0
MIME-Version: 1.0
In-Reply-To: <20151130192348.GD81246@spindle.one-eyed-alien.net>
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding: 7bit
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.20
Precedence: list
List-Id: "Security issues \[members-only posting\]"
 <freebsd-security.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/freebsd-security>, 
 <mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security/>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
 <mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 01 Dec 2015 04:34:11 -0000

On 1/12/2015 3:23 AM, Brooks Davis wrote:
> On Tue, Nov 24, 2015 at 09:29:44PM +0100, Aaron Zauner wrote:
>> Hi,
>>
>> Please forgive my ignorance but what's the reason FreeBSD ships
>> OpenSSH patched with HPN by default? Besides my passion for
>> security, I've been working in the HPC sector for a while and
>> benchmarked the patch for a customer about 1.5 years ago. The
>> CTR-multi threading patch is actually *slower* than upstream OpenSSH
>> with AES in CTR mode. GCM being, of course, the fastest mode on
>> AESNI plattforms.
> We never imported the AES bits as they were broken and AESNI was
> available.
>
>> The NULL mode is a security concern as some have noted, I can only
>> imagine that the window-scaling patch is of such importance?
> Both NULL and window-scaling were merged because both are useful in some
> environments.
yeah but Null was just unmerged.
window scaling is also on the block I think
>
> -- Brooks