OpenSSH Security Advisory: cbc.adv Regarding the "Plaintext Recovery Attack Against SSH" reported as CPNI-957037[1]: The OpenSSH team has been made aware of an attack against the SSH protocol version 2 by researchers at the University of London. Unfortunately, due to the report lacking any detailed technical description of the attack and CPNI's unwillingness to share necessary information, we are unable to properly assess its impact. Based on the description contained in the CPNI report and a slightly more detailed description forwarded by CERT this issue appears to be substantially similar to a known weakness in the SSH binary packet protocol first described in 2002 by Bellare, Kohno and Namprempre[2]. The new component seems to be an attack that can recover 14 bits of plaintext with a success probability of 2^-14, though we suspect this underestimates the work required by a practical attack. For most SSH usage scenarios, this attack has a very low likelihood of being carried out successfully - each attempt has a low probability of success and each failure will cause connection termination with a fatal error. It is therefore very unlikely for an interactive session to be usefully attacked using this protocol weakness: an attacker would expect around 32768 connection-killing attempts before they are likely to succeed. This level of disruption would certainly be noticed and it is highly unlikely that any user would retry the connection enough times for the attack to succeed. The usage pattern where the attack is most likely to succeed is where an automated connection is configured to retry indefinitely in the event of errors. In this case, it might be possible to recover as much as 14 bits of plaintext per hour (assuming a very fast 10 connections per second). Implementing a limit on the number of connection retries (e.g. 256) is sufficient to render the attack infeasible for this case. AES CTR mode and arcfour ciphers are not vulnerable to this attack at all. These may be preferentially selected by placing the following directive in sshd_config and ssh_config: Ciphers aes128-ctr,aes256-ctr,arcfour256,arcfour,aes128-cbc,aes256-cbc A future version of OpenSSH may make CTR mode ciphers the default and/or implement other countermeasures, but at present we do not feel that this issue is serious enough to make an emergency release. -d [1] http://www.cpni.gov.uk/Docs/Vulnerability_Advisory_SSH.txt [2] http://www.cs.washington.edu/homes/yoshi/papers/TISSEC04/
Circa 2008-11-21 05:19 dixit Damien Miller: : OpenSSH Security Advisory: cbc.adv : : Regarding the "Plaintext Recovery Attack Against SSH" reported as : CPNI-957037[1]: [...] : AES CTR mode and arcfour ciphers are not vulnerable to this attack at : all. These may be preferentially selected by placing the following : directive in sshd_config and ssh_config: : : Ciphers aes128-ctr,aes256-ctr,arcfour256,arcfour,aes128-cbc,aes256-cbc As I recall, the 'arcfour' cipher (no keysize in the name) has its own potential vulnerability, in that it fails to discard the initial 1536 bytes of the kesystream <http://www.ietf.org/rfc/rfc4345.txt>. The 'arcfour128' cipher is the one which mixes the keystream before using it. The following 'Ciphers' spec is probably what Damien intended: Ciphers aes128-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,aes256-cbc --jim -- jim knoble | jmknoble at pobox.com | http://www.pobox.com/~jmknoble/ (GnuPG key ID: C6F31FFA >>>>>> http://www.pobox.com/~jmknoble/keys/ ) (GnuPG fingerprint: 99D8:1D89:8C66:08B5:5C34::5527:A543:8C33:C6F3:1FFA) +----------------------------------------------------------------------+ |[L]iberty, as we all know, cannot flourish in a country that is perma-| | nently on a war footing, or even a near-war footing. --Aldous Huxley| +----------------------------------------------------------------------+
Damien Miller wrote:> OpenSSH Security Advisory: cbc.adv > [text deleted] > > AES CTR mode and arcfour ciphers are not vulnerable to this attack at > all. These may be preferentially selected by placing the following > directive in sshd_config and ssh_config: > > Ciphers aes128-ctr,aes256-ctr,arcfour256,arcfour,aes128-cbc,aes256-cbc >Hi, I have been reading the documentation and had a look into the source but finally did not manage to understand the selection method. (For SSL it is the server that selects "based on the clients preferences" which means that depending on the server settings the client's or the server's preference will be used.) Where can I find respective documentation (or the location in the source to find out myself :-) Best regards, Lutz
On Thu, Nov 27, 2008 at 09:06:00AM +0100, Lutz Jaenicke wrote:> I have been reading the documentation and had a look into the source > but finally did not manage to understand the selection method. > (For SSL it is the server that selects "based on the clients preferences"same applies to ssh.