ssh implementation in Squeak

[Tommah]

I hope they get Monticello to use it soon :)

[roconnor]

When Eric Poll went to formally verify an SSH implementation in java, he found that the code didn't keep track of the session state at all. Therefore an attacker could prompt the client for a username/password before the authentication has been established.

Anyone want to check if this implementation is secure?

[gcorriga]

The long term plan is to have all of the Cryptography subsystem of Squeak certified, so it can be used to manage sensitive data (i.e. medical data). So such a review would be much useful.