OA51665: OPENSSL AES128-CTR CIPHER MAY FAIL LARGE TRANSFERS

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• When using OpenSSL version 1.0.2h for cryptographic
  functionality in OpenSSH, the algorithm aes128-ctr (or
  aes192-ctr or aes256-ctr) may fail a large sftp transfer with
  messages similar to:
  
  Corrupted MAC on input.
  or
  Disconnecting: Packet corrupt.
  
  Verification Steps:
  1) Ensure OpenSSH for z/OS version 1.3 or 2.2 is in use with
     OpenSSL version 1.0.2h  (command 'ssh -V' will give you this
     information).
  
  2) Using the -vvv flag on the sftp invocation observe if the
     following debug entries are present:
  debug1: kex: server->client aes128-ctr
  debug1: kex: client->server aes128-ctr
     (or aes192-ctr or aes256-ctr)
  
  
  
  Keywords:
  FOTS1189 Corrupted MAC on input.
  msgFOTS1189
  

Local fix

• Use ICSF or a non aes128-ctr, aes192-ctr or aes256-ctr cipher.
  

Problem summary

• ****************************************************************
  * USERS AFFECTED: All z/OS Ported Tools OpenSSH                *
  *                 V1R3(HOS1130), z/OS OpenSSH V2R2 (HOS2220)   *
  *                 and above.                                   *
  ****************************************************************
  * PROBLEM DESCRIPTION: When using OpenSSL version 1.0.2h       *
  *                      for cryptographic functionality in      *
  *                      OpenSSH, the ciphers of aes128-ctr      *
  *                      aes192-ctr and aes256-ctr               *
  *                      may fail a large file transfer with     *
  *                      messages similar to:                    *
  *                      Corrupted MAC on input.                 *
  *                      or                                      *
  *                      Disconnecting: Packet corrupt.          *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  When OpenSSH is used to transfer large files and ciphers of
  aes128-ctr, aes192-ctr and aes256-ctr from OpenSSL are used,
  it may fail.
  

Problem conclusion

• The OpenSSH was updated to be able to send or receive large
  files using OpenSSL 1.0.2h ciphers of aes128-ctr aes192-ctr
  and aes256-ctr.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  UA91138 UA91139

Modules/Macros

• FOTSXADD FOTSXAGT FOTSXKGN FOTSXKSC FOTSXKSN FOTSXSHD FOTSXSSH
  

Fix information

• Fixed component name

  OPENSSH FOR Z/O

• Fixed component ID

  5655M2301

Applicable component levels

• R130 PSY UA91138

     UP17/03/15 P F703  

• R220 PSY UA91139

     UP17/03/15 P F703  

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.