- djm@cvs.openbsd.org 2008/11/04 08:22:13

[openssh.git] / ChangeLog

diff --git a/ChangeLog b/ChangeLog
index 96ea33e83c24a2aa43941f45cc0b4cb715d3fae4..df219f01df98d7f8d5ddbd417d0dbf3523cdeefe 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -7,6 +7,25 @@
      [auth.c]
      need unistd.h for close() prototype
      (ID sync only)
+   - djm@cvs.openbsd.org 2008/11/04 08:22:13
+     [auth.h auth2.c monitor.c monitor.h monitor_wrap.c monitor_wrap.h]
+     [readconf.c readconf.h servconf.c servconf.h ssh2.h ssh_config.5]
+     [sshconnect2.c sshd_config.5 jpake.c jpake.h schnorr.c auth2-jpake.c]
+     [Makefile.in]
+     Add support for an experimental zero-knowledge password authentication
+     method using the J-PAKE protocol described in F. Hao, P. Ryan,
+     "Password Authenticated Key Exchange by Juggling", 16th Workshop on
+     Security Protocols, Cambridge, April 2008.
+     
+     This method allows password-based authentication without exposing
+     the password to the server. Instead, the client and server exchange
+     cryptographic proofs to demonstrate of knowledge of the password while
+     revealing nothing useful to an attacker or compromised endpoint.
+     
+     This is experimental, work-in-progress code and is presently
+     compiled-time disabled (turn on -DJPAKE in Makefile.inc).
+     
+     "just commit it.  It isn't too intrusive." deraadt@
 
 20081103
  - OpenBSD CVS Sync