New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Investigate using BouncyCastle for bcrypt #1482

Open

Rob-Hague opened this issue Sep 1, 2024 · 0 comments

Collaborator

Rob-Hague commented Sep 1, 2024

We support encrypted OpenSSH keys (defined at https://github.com/openssh/openssh-portable/blob/master/PROTOCOL.key) for which we have a bcrypt implementation (from somewhere) for the key derivation (kdf).

Now that we depend on BouncyCastle and have replaced a lot of internal crypto with a BouncyCastle implementation, we may also be able to use https://github.com/bcgit/bc-csharp/blob/master/crypto/src/crypto/generators/BCrypt.cs

As far as I can tell, the OpenSSH kdf does a little bit on top of straight bcrypt, probably encapsulated here:

SSH.NET/src/Renci.SshNet/Security/Cryptography/Bcrypt.cs

Line 853 in fe827a5

public void Pbkdf(byte[] password, byte[] salt, int rounds, byte[] output)

It may be possible to replace all or some of our Bcrypt.cs with BouncyCastle

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment