From owner-ssh@clinet.fi Tue Mar 13 01:55:45 2001 Received: from mail.clinet.fi (mail.clinet.fi [194.100.0.7]) by hutcs.cs.hut.fi (8.9.3/8.9.3) with ESMTP id BAA22621; Tue, 13 Mar 2001 01:55:45 +0200 (EET) Received: (from majordom@localhost) by mail.clinet.fi (8.9.3/8.9.3) id BAA03148 for ssh-outgoing; Tue, 13 Mar 2001 01:13:00 +0200 Received: from mail.lysator.liu.se (mail.lysator.liu.se [130.236.254.3]) by mail.clinet.fi (8.9.3/8.9.3) with ESMTP id BAA03145 for ; Tue, 13 Mar 2001 01:12:59 +0200 Received: from sture.lysator.liu.se (sture.lysator.liu.se [130.236.254.21]) by mail.lysator.liu.se (Postfix) with ESMTP id 3E05282F559; Tue, 13 Mar 2001 00:12:50 +0100 (MET) Received: (from nisse@localhost) by sture.lysator.liu.se (8.9.0/8.8.7) id AAA15881; Tue, 13 Mar 2001 00:12:46 +0100 (MET) To: tls@rek.tjls.com Cc: Markus Friedl , ssh@clinet.fi, openssh-unix-dev@mindrot.org, ietf-ssh@netbsd.org Subject: Re: OpenSSH/scp ->> F-Secure SSH server Problems References: <20010312144035.A1174@faui02.informatik.uni-erlangen.de> <20010312173130.A2713@rek.tjls.com> Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit From: nisse@lysator.liu.se (Niels Möller) Date: 13 Mar 2001 00:12:46 +0100 In-Reply-To: Thor Lancelot Simon's message of "Mon, 12 Mar 2001 17:31:30 -0500" Message-ID: Lines: 34 X-Mailer: Gnus v5.7/Emacs 20.7 Sender: owner-ssh@clinet.fi Precedence: bulk Thor Lancelot Simon writes: > But then again, I think that reinventing most of what TLS does for > the SSHv2 transport layer instead of politely asking the TLS folks > for a record-oriented interface was rather silly, too. I've implemented both TLS (ok, it was actually SSL version 3 back then) and ssh2. I'd say the ssh2 transport is better. It's cleaner, more secure, more flexible, and its spec is a lot easier to understand. And then a lot of the complexity in ssh is in the connection layer, which isn't comparable to TLS in any way. > Ergo, a small, lightweight SSH implementation, even one that did v2, > might quite reasonably choose to *not* implement SFTP; to me, at least, > it sure seems to bring very little to the table in return for a lot > of increase in code size and maintenance. The ssh implementation and the sftp implementation are quite independent. They have a common origin and uses a common language and terminology, but you can run the sftp over any secure bidirectional connection. The only feature in the ssh core protocol that makes sftp easier is the subsystem request that lets a client start a program without knowing an exact path, and without knowing whether or not it is an external program or part of the ssh server. If I get involved in a complete sftp implementation, it will run just as well using lsh, kerberized rsh, or plain old insecure rsh if anybody is still using that. Furthermore, the server part (i.e. the subsystem) is not big, I expect the one I started to write to be a self contained program of at most 5000-10000 lines of C code. Say about twice as large as GNU ls. /Niels