From owner-freebsd-stable@FreeBSD.ORG  Tue Aug 17 18:55:40 2004
Return-Path: <owner-freebsd-stable@FreeBSD.ORG>
Delivered-To: freebsd-stable@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 95EFB16A4CE
	for <freebsd-stable@freebsd.org>;
	Tue, 17 Aug 2004 18:55:40 +0000 (GMT)
Received: from root.ucsc.edu (root.ucsc.edu [128.114.2.225])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 84EF343D3F
	for <freebsd-stable@freebsd.org>;
	Tue, 17 Aug 2004 18:55:40 +0000 (GMT)
	(envelope-from booloo@root.ucsc.edu)
Received: from root.ucsc.edu (localhost.ucsc.edu [127.0.0.1])
	by root.ucsc.edu (8.12.11/8.12.11) with ESMTP id i7HItbTO006767;
	Tue, 17 Aug 2004 11:55:37 -0700 (PDT)
	(envelope-from booloo@root.ucsc.edu)
Received: (from booloo@localhost)
	by root.ucsc.edu (8.12.11/8.12.11/Submit) id i7HItbLd006766;
	Tue, 17 Aug 2004 11:55:37 -0700 (PDT)
	(envelope-from booloo)
Date: Tue, 17 Aug 2004 11:55:37 -0700
From: Mark Boolootian <booloo@ucsc.edu>
To: freebsd-stable@freebsd.org
Message-ID: <20040817185537.GA6694@root.ucsc.edu>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.4.2.1i
cc: tweten@nas.nasa.gov
cc: desjardins@canada.com
Subject: key_verify failed for server_host_key solution
X-BeenThere: freebsd-stable@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
Reply-To: booloo@ucsc.edu
List-Id: Production branch of FreeBSD source code
	<freebsd-stable.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>,
	<mailto:freebsd-stable-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-stable>
List-Post: <mailto:freebsd-stable@freebsd.org>
List-Help: <mailto:freebsd-stable-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>,
	<mailto:freebsd-stable-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 17 Aug 2004 18:55:40 -0000


Folks,

I found that SSH broke after an upgrade to 4.10 stable.  The
problem I saw was the same one reported by Daren Desjardins
back in March.  The symptom is a client failing to establish a
connection with the complaint:

  key_verify failed for server_host_key

The culprit turns out to be a problem in libcrypto that is tickled 
by too aggressive optimization settings.

When building 4.10, my make.conf included:

  CFLAGS= -O -pipe -funroll-loops -ffast-math
  COPTFLAGS= -O -pipe -funroll-loops -ffast-math

By removing both the unroll-loops and fast-math optimizations,
and rebuilding libcrypto, the problem disappears.  For anyone
unfamiliar with rebuilding libcrypto, the following should do the
job:

  cd /usr/src/secure/lib/libcrypto
  make clean
  make obj && make depend && make all install

mb