[ssh_x509] Minimum supported version of OpenSSL and Post-Quantum key exchange

[ssh_x509 at roumenpetrov.info]

Hello,

I would like to share in advance changes in build by default key exchange algorithms.

The build process does not restrict explicitly supported minimum OpenSSL release.
Code is tested with OpenSSL 0.9.7 as minimum. It is not tested with 0.9.6 as this OpenSSL release fail to build on 64-bit.

As before the new minimum will not be set explicitly. It will be managed indirectly - cryptographic library with SHA-256 support.
Please, read the e-mail to the end for all details.



A) Retrospection/Retrospective

1) SHA-256 availability

The current PKIX-SSH implementation still builds and runs with OpenSSL 0.9.7.
Issue is that this release does not support SHA-256.
Modern OS cryptographic policies exclude SHA-1.

Information for original release date from WikipediA - https://en.wikipedia.org/wiki/OpenSSL:
0.9.7		31 December 2002
0.9.8		5 July 2005


2) SHA-1 use

SHA-1 is used only in a number of Diffie-Hellman(DH) key exchange algorithms (KEX).
The rest of DH and other algorithms use SHA-256 as minimum.

PKIX-SSH allows to disable DH KEX.
Configuration script prevent to disable DH if builds is with OpenSSL 0.9.7.


3) Build targets

All most all build targets are in green on OpenSUSE build services - https://build.opensuse.org/package/show/home:petrov_r/pkixssh .
Exception are:
  - openSUSE_13.2 (wrong VM or hardware setup)
  - openSUSE_Factory_RISCV (non-significant fail on LDAP tests, I guess that will be fixed in the future)

Above means that finally is found balance between cryptographic library capabilities like what is allowed to use in FIPS mode, is engine module allowed, does OS use systemd or System V startup, and etc..
The information is detailed in rpm-spec files.


4) Test environments
This is the another issue.
It starts to be more difficult to test enable/disable functionality. For instance 10 rules means 2^10=1024 test environments.


5) Enterprise Linux releases.
Build services tests are for:

https://en.wikipedia.org/wiki/Red_Hat_Enterprise_Linux
  - RHEL 5:	15 March 2007 - 30 November 2020(End of Extended Lifecycle Support)


https://en.wikipedia.org/wiki/SUSE_Linux_Enterprise
  - SLES 11:	24 March 2009  - 31 March 2025(LTSS Core Ends)

Note error on page: ...Long Term Service Pack Support (LTSS), and 3 years more of LTSS Core i.e., 2022 + 3 years is 2025, not 2028!



B) Future - Post-Quantum Traditional (PQ/T) Hybrid key exchange

Next PKIX-SSH will enable by default ML-KEM embed (build-in) key exchange i.e., mlkem768x25519-sha256.
This means that OpenSSL 0.9.7 cannot be supported - lack of SHA-256.

Note if is detected (at run-time) that library supports ML-KEM, this implementation will be preferred - mlkem768nistp256-sha256, mlkem1024nistp384-sha384, and mlkem768x25519-sha256.


In addition configuration script will disable by default DH.
So, If is needed connection to "ancient" OS releases it must be enabled explicitly. It seems to me RHEL 5 only offers DH SSH1 KEX!


All above means:

1) Configure script will be updated to request SHA-256 support.

2) The ML-KEM option will be added to the RPM spec-files and will be enabled by default in spec and configure.

3) Status of DH in RPM spec-files will not be changed i.e., remains enabled by default.

4) Code that checks for SHA-256 or SHA-1 will remain as is. New code must assume availability of SHA-256 and will not fail back to SHA-1 even if possible.

5) OpenSSL 0.9.7 compatibility code will remain unchanged

6) Freezing the DH code - without improvements, without upgrade to OPENSSL 3 API, and most probably without security fixes.


Regards,
Roumen Petrov