Comparison of various SSH implementations in terms of supported crypto protocols
Home Page: https://ssh-comparison.quendi.de/
A technical comparison of various SSH implementations (clients, servers and libraries), in terms of support SSH crypto protocols.
Pull requests are welcome! In particular for additional implementations as well as updates or corrections to existing entries.
This site is built using jekyll and required jekyll-redirect-from.
Get these packages installed on your OS and then run jekyll server to
have the site built and available for local testing.
This ties in with issue #8, but this information should not just be displayed when clicking on a protocol; rather, it should also be visible in the global comparision page. Say, by allowing users to only show secure protocols.
E.g. Kerberos (OID 1.2.840.113554.1.2.2) or NTLM (OID 1.3.6.1.4.1.311.2.2.10).
Support for "none" as a userauth can mean two different things: It can be used as a mode-query-mechanism (this is fine), or as an auth method (which probably is bad).
To quote Peter Gutmann: "I support 'none' as a query mechanism since some clients don't work without it, but not as an auth mechanism, and I suspect a number of other implementions listed as supporting 'none' wouldn't actually let you in without a password either."
It would be good to distinguish between the two methods somehow.
Until that happens, it would probably be best to not list this method at all, as its informational usefulness in the current state is limited, if it there is any at all.
I.e. a free form text field whose content is displayed on the implementation's dedicated page. This can be used to record historical information, special notes that don't fit elsewhere, links to pages with further information (such as Wikipedia articles), etc.
We could transpose the tables: I.e. right now, rows are feature, and columns are implementations. This could be swapped. Either way has pros and cons... Start by listing these pros and cons, so that they can evaluated and weighted
There could even be an option to dynamically switch rows/columns, but that might be overkill... The real question is: What kind of information do people want from these tables, and how can we arrange things to best provide it to them?
After the Terrapin attack a two new SSH Extensions were introduced: [email protected] (Client) and [email protected] (Server).
This is a feature request to add these extensions to the comparison.
I will quote the OpenSSH PROTOCOL page for more information:
1.10 transport: strict key exchange extension
OpenSSH supports a number of transport-layer hardening measures under
a "strict KEX" feature. This feature is signalled similarly to the
RFC8308 ext-info feature: by including a additional algorithm in the
initial SSH2_MSG_KEXINIT kex_algorithms field. The client may append
"[email protected]" to its kex_algorithms and the server
may append "[email protected]". These pseudo-algorithms
are only valid in the initial SSH2_MSG_KEXINIT and MUST be ignored
if they are present in subsequent SSH2_MSG_KEXINIT packets.
Currently, we store the list of supported protocols as arrays like this:
protocols:
cipher:
- aes256-cbc
- [email protected]
- [email protected]
- ...
I think this should be changed to a dictionary instead. This has multiple advantages:
Hypothetical example
protocols:
cipher:
aes256-cbc: yes
[email protected]: "since version 2.0"
[email protected]:
supported: yes
note: "since version 3.1"
bad-algo:
supported: no
note: "supported dropped for security reasons in 2.7"
...
(Not sure whether the last veriant, with a full sub-dictionary of data, is ever needed... perhaps skip it for now, and only add it if we encounter cases that would benefit form it?)
I.e. add an "based_on" field to the data files. This is in particular useful when adding Android, iOS etc. clients, as most (all?) of those are based on some existing code (PuTTY, libssh, ...)
Library available for many platforms and with higher level interfaces for many langes. See https://www.chilkatsoft.com/ssh-features.asp
Release notes: http://cknotes.com/category/release-notes/
Some strings from ruby bundle:
wodFTPD 2.1.4
FlowSsh
SSH-2.0-ChilkatSSH_2.1.0
diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,[email protected],ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521
ssh-rsa,ssh-dss
ssh-dss,ssh-rsa
aes128-cbc,twofish128-cbc,blowfish-cbc,3des-cbc,arcfour128,arcfour256
aes256-ctr,aes128-ctr,aes256-cbc,aes128-cbc,twofish256-cbc,twofish128-cbc,blowfish-cbc,3des-cbc,arcfour128,arcfour256
aes256-cbc,aes128-cbc,twofish256-cbc,twofish128-cbc,blowfish-cbc,3des-cbc,arcfour128,arcfour256
hmac-sha2-256,hmac-sha1,hmac-sha2-512,hmac-md5,hmac-ripemd160,none
zlib,[email protected],none
aes256-ctr
ServerDoesNotSupport
aes128-ctr
aes128-cbc
twofish256-cbc
twofish128-cbc
blowfish-cbc
3des-cbc
arcfour128
arcfour256
hmac-sha2-256
hmac-sha1
hmac-sha2-512
hmac-md5
hmac-ripemd160
[email protected]
diffie-hellman-group-exchange-sha256
diffie-hellman-group-exchange-sha1
diffie-hellman-group1-sha1
diffie-hellman-group14-sha1
[email protected]
ecdh-sha2-nistp256
ecdh-sha2-nistp384
ecdh-sha2-nistp521
A row for the streamlocal extension with which you can forward from and to unix domain sockets (from and to unix domain sockets or tcp ports) would be nice.
And then make it possible to sort by that, to quickly see "common" vs. "uncommon" protocols.
The generator plugin currently hardcodes a lot of HTML. It should instead either use templates, so that one can tweak how things look without having to dive into the plugin code.
As the number of implementation grows, those tables become quite bloated. If one wants to e.g. select a client for Windows, or find a library usable on Mac OS X, then being able to filter becomes massively helpful.
I guess for platforms, there could be a popup menu with choices "Any" plus the various operating systems (of course, the information about platforms first needs to be added to the datafiles, see issue #4); for client/server it could be checkboxes or a popup with "don't care", "client", "server", "client & server"; etc.
(Of course one might also argue that clients and servers should be shown on separate pages in the first place, and also libraries vs. standalone, etc., but sometimes it is also useful to see all implementation on a single page, to determine whether a given protocoll is widely available or not).
This could probably be implemented in pure JavaScript.
Just in case the information would be used for Wikipedia's comparison page.
Apparently quite some people in academia use this. See https://github.com/globus/gsi-openssh and http://grid.ncsa.illinois.edu/ssh/
In particular, adding iOS and Android clients might be useful for quite some people. Also, look at the Wikipedia lists:
SVN repository at http://svn.osdn.jp/svnroot/ttssh2/trunk/
If I'm for example searching a Java implementation that supports a specific extension, it would be nice to be able to find out or even filter for the language of an implementation if it is a library.
Right now, one can only say that an implementation supportes a freature, or not. But one may want more fine-grained information (see also issue #7), e.g. to record this:
E.g. hmac-md5-96 may be in principle available in an implementation, but turned off by default for security reasons. In this case, show it as "Off by default" or "Yes*" (with * hyperlink to a ref), or perhaps add a tooltip. Also, change the color from green to yellow or so?
Hi,
It would be great if you could add the details of golang golang.org/x/crypto/ssh
I found out that it supports these kex
[email protected] ecdh-sha2-nistp256 ecdh-sha2-nistp384 ecdh-sha2-nistp521 diffie-hellman-group14-sha1 diffie-hellman-group1-sha1
but not diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1
We currently have pages for each SSH implementation. We might want to also provide pages for each protocol (such as "aes128-ctr"), or protocol family (such as "aes*-ctr", i.e. "aes128-ctr,aes192-ctr,aes256-ctr").
On these pages, we could
Some starting places:
It has been committed, but not out yet. Expected in the next release:
libssh2/libssh2@a53cebb
A newer version of OpenSSH is available!
In fact, a few versions have been missed.
This is in particular useful when people want to find e.g. a client for Windows, iOS, Android, ...
Use a "note" (see issue #9) to enhance the OpenSSH implementation page to list which versions of OpenSSH ship with which OS versions. So that one can quickly find out that Mac OS X ships OpenSSH 5.9p1 (perhaps even give the full output of openssh -v), or that "Ubuntu 14.04.2 LTS" ships OpenSSH 6.6.1p1, etc.
The idea being that this way, one can quickly check which versions of OpenSSH (and hence which features, weaknesses, etc.) are available where. This can be helpful when one wants to e.g. establish company wide SSH policies (enabling / disabling certain protocols).
It would useful to have a portable test client / test server, ideally with minimal dependencies, which knows just enough to begin a connection to an existing SSH client or server, and record the protocol exchange. This way, one can at least get a rough idea which protocols an implementation purports to implement.
Then people who want to contribute to this site by e.g. testing Android clients, can use that tool to get a quick first version of the .yaml file (to this end, the tool might even output a .yml file?)
I am tempted to write such a thing in pure python 2 (not using a lib like paramiko), in the hopes that everbody, even Windows users, can run that, to test their implementations.
It would be nice if a table for the extensions defined in draft-ssh-ext-info could be added.
https://tools.ietf.org/html/draft-ssh-ext-info
OpenSSH, Bitvise and SmartFTP have already implemented some extensions.
Also related to this PR: #38
This may be useful when one wants to compare one specific implementation against others.
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
Django
The Web framework for perfectionists with deadlines.
Laravel
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft
Open source projects and samples from Microsoft.
Google
Google ❤️ Open Source for everyone.
Alibaba
Alibaba Open Source for everyone
D3
Data-Driven Documents codes.
Tencent
China tencent open source team.