K4 USBNet - No Matching Key Exchange. Their offer: diffie-hellman-group1-sha1

[lianove3]

Hello!

I'm having trouble getting USBNet to work on my K4NT. Mine is one of the weird cases described here where the built in USBNet still works.

I have:

1. Successfully completed the Jailbreak

2. Booted to the diagnostics and navigated to the Enable USBnet page

3. Configured the network interface for IP 192.168.15.201 & subnet 255.255.255.0

When I try to `ssh root@192.168.15.244`, I am met with the following error:

`Unable to negotiate with 192.168.15.244 port 22: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1`

I have tried the solutions detailed in this stackexchange but to no avail. Attempting `ssh -oKexAlgorithms=+diffie-hellman-group1-sha1 root@192.168.15.244` results in:

`Unable to negotiate with 192.168.15.244 port 22: no matching host key type found. Their offer: ssh-rsa`

I'd much appreciate any insight into this If I cannot get the built in USBNet working, would I be able to go the route of installing USBNet manually? TIA

[dont_panic]

The reason for this is quite simple imo: The kindle uses 14-year-old crypto routines (rsa), which are not accepted by any modern ssh implementation.
The reason for this is the 'downgrading attack': The attacker just politely asks the victim 'why can't whe use the old unsafe standard like we always did'. That's why your ssh just says 'nope wont do'.
On my win machine I use kitty (a putty fork) as ssh client, and there is a settings page that lets you enable unsafe stuff. I don't know how to do it on linux, and it should depend on your distro. Also, don't do this when your device is connected to the interwebz

My guess would be to just 'give them what they want' and match their offer:

`ssh -oKexAlgorithms=+ssh-rsa root@192.168.15.244`

This is my first post here, so please be patient with a poor noob...

[ratinox]

TL;DR: use RSA if you need portable keys, ED25519 otherwise.

Nit-pick, but the problem isn't RSA which is still secure for larger keys (2048 bit and 4096 bit). Anything smaller than 2048 bit is generally discouraged. ED25519 is preferred when available. At this time, ED25519 appears to be more secure and faster than RSA, though RSA is technically stronger given the larger key sizes.

The real problem here is DSA which has been deprecated and disabled by OpenSSH for almost a decade now due to its general weakness, and will be entirely removed from OpenSSH source code next year. You can read more here:
https://www.openssh.com/legacy.html

Note: your distribution maintainers may have taken steps to remove DSA in advance of the formal removal.

[j.p.s]

Installing the USBNetwork hack that targets the K4 should work.