F15-RA: Pending
Rationale
The selected AuthSSH2 responder decodes authentication options and allocates an SSH2SecurityContext before completing peer authentication. It loads pinned keys, generates DH keys and computes the shared secret before the challenge-response completes. Missing peer keys reject unknown names, but an asserted known name is not yet proof of possession. This locates pre-authentication CPU and state costs; it does not establish the rate or number of attempts that can reach this boundary through the selected lower DIFs.
Assessment method
Pinned responder authentication ordering; lower admission bounds unresolved
Source context
IRATI AuthSSH2 responder
Outstanding qualification
Trace lower-flow admission, concurrent enrollment/context limits, queues and cleanup for attempts claiming a configured peer name. Identify a selected policy that bounds pre-authentication CPU/state or defers expensive work until admission. Per-session duplicate-context rejection and missing-key rejection alone do not establish an aggregate bound. Do not infer vulnerability or protection from this source ordering alone.
Public sources
Editorial evidence references
The following identifiers refer to research records not included in this public package; they are not public links.
- round669.html
- round672.html