Skip to content

HPN-SSH 18.7.1

Choose a tag to compare

@rapier1 rapier1 released this 30 Sep 15:51
· 372 commits to master since this release
1f58137

There are 2 main changes since 18.7.0.

RFC 8305 aka Happy Eyeballs
This is for use on dual stack systems meaning that they have both IPv4 and IPv6 TCP stacks. When enabled this option will try to connect to the target over both IPv4 and IPv6 with preference given to IPv6. This preference is created by giving IPv6 a 250ms head start over the IPv4 connection. Users can change this with the HappyDelay option. The first connection that completes successfully will be used. Any outstanding connection attempts will be closed. As of version 18.7.1 this option should be considered somewhat experimental. Usage:

-oHappyEyes  = [Yes|No] will enable Happy Eyeballs. The default is no.
-oHappyDelay = [N] where N is a positive integer expressed in
                  milliseconds. The default value of 250ms 
                  is suggested by RFC 8305.

e.g. hpnssh -oHappyEyes=yes -oHappyDelay=125 [email protected]

FIPS Mode and Parallel Ciphers
Using HPN-SSH in operating systems working in FIPS mode (e.g. RHEL with FIPS enabled) preclude the use of parallel ciphers. This is because the parallel AES-CTR implementation is not FIPS certified and will cause FIPS to exit with an error when loaded. In the case of the parallel ChaCha20 cipher the algorithm itself has not been FIPS certified and no implementation of ChaCha20 should be allowed in FIPS mode. We suggest the use of the AES-GCM cipher when operating under FIPS mode for optimal performance. This is behaviour is not user adjustable.

Minor Changes
The 64bit XOR method used in AES-CTR-MT was causing undefined behaviour. We have reduce the maximum bit size of an XOR to 32 bits until we develop a better XOR method. XORing is one of those things that can have an outsized impact on performance so please let us know if you see any noticeable performance hit. Also, if anyone wants to solve the XOR issue for us we'd love the help. Various changes have been made to the CI system on github and we've changed some minor parts of the regression test suites.