RE: Security Practices

> -----Original Message-----
> From: David Busby [mailto:busby@edoceo.com] 
> Sent: Tuesday, May 17, 2005 1:28 AM
> To: secureshell@securityfocus.com
> Subject: Security Practices
>
>
> List,
>   I'm trying to get my a sshd setup as secure as possible, 
> some folks I 
> know what to send financial data over this.  Right now I've 
> got 2048bit 
> RSA keys, aes256-cbc cipher (only), but all the MACs.  I'm 
> thinking that 
> I'll make my key 4096bits to add some security.  Which cipher is the 
> best?  I picked AES256 cause I believe AES to be the best, 256 was the 
> largest.  What is the difference between CBC and CTR?  MAC of hmac-md5 
> is the best choice there correct?  Assume best means most 
> secure even at 
> the sacrifice of performance.  Thanks!
>
> imperium bin # ssh -V
> OpenSSH_3.9p1, OpenSSL 0.9.7e 25 Oct 2004
> imperium bin # uname -a
> Linux imperium 2.6.10-gentoo-r6-edoceo #4 Sun May 1 03:48:25 PDT 2005 
> i686 AMD Athlon(TM) XP 1700+ AuthenticAMD GNU/Linux
>
> /djb

What cipher is the best? Best is a relative term so I won't answer that.
According to http://csrc.nist.gov/cryptval/des.htm, AES is the FIPS-Approved
symmetric encryption algorithm of choice. In choosing the mode, cipher block
chaining mode is a block cipher and ctr is a stream cipher. Do some research
into these, as I can't answer what the specific (practical) differences are
without a lengthy email. You're assumption on MAC is correct.

My 2 cents,
Nathan Grandbois
Cerdant, Inc.
614.717.0123 ext. 26