What is missing for ETM algorithms to work

[juchom]

Hello,

I'm facing an issue where a remote server has been updated and it only supports these two HMAC algorithms :
hmac-sha2-256-etm@openssh.com
hmac-sha2-512-etm@openssh.com

There are already some issues open for this, and I was wondering what is missing to have this working ?

Is it a matter of time for the developper ?
Is it something missing in the framework ?

Or anything else ?

And thanks for this great library and the work done on it 👍

[Rob-Hague]

It is just that nobody has contributed the changes. I have looked into it briefly.

Because the EtM (encrypt-then-MAC) algorithms change the way the packets are created, there would need to be some refactoring around here:

SSH.NET/src/Renci.SshNet/Session.cs

Lines 1052 to 1066 in 1c7166a

	if (_clientMac != null)
	{
	// write outbound packet sequence to start of packet data
	Pack.UInt32ToBigEndian(_outboundPacketSequence, packetData);
	// calculate packet hash
	hash = _clientMac.ComputeHash(packetData);
	}
	// Encrypt packet data
	if (_clientCipher != null)
	{
	packetData = _clientCipher.Encrypt(packetData, packetDataOffset, packetData.Length - packetDataOffset);
	packetDataOffset = 0;
	}

depending on whether the MAC algorithm is defined to be EtM or not.

More details at https://crypto.stackexchange.com/questions/202/should-we-mac-then-encrypt-or-encrypt-then-mac

[juchom]

Ok, thanks for the info.