Call for testing: OpenSSH 8.0
It includes an interesting comment on the scp vulnerability.<p>&gt; This release contains mitigation for a weakness in the scp(1) tool and protocol (CVE-2019-6111) [...] <i>The scp protocol is outdated, inflexible and not readily fixed. We recommend the use of more modern protocols like sftp and rsync for file transfer instead.</i><p>I think it&#x27;s the time to &quot;alias scp=sftp&quot;. If the developers officially believe that scp should be retired, let&#x27;s do the switch. Both are parts of OpenSSH and the commandline argument is almost identical.<p>Also, it has<p>&gt; <i>ssh(1), sshd(8): Add experimental quantum-computing resistant key exchange method, based on a combination of Streamlined NTRU Prime 4591^761 and X25519.</i><p>This is big. Together with XMSS signature, it means we already have a complete suite of post-quantum cryptography (experimentally) deployed in OpenSSH! It may be the first mass deployment of post-quantum cryptography in a major protocol.<p>One month ago, I commented that the introduction of XMSS post-quantum signature as &quot;useless&quot; (<a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=19160739" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=19160739</a>), as the decryption of key exchange is much more vulnerable than spoofing the signature. But now NTRU+X25519 is deployed, great progress here!