Displaying 2 results from an estimated 2 matches for "ssh_service_request".
2023 Dec 20
1
Discussion: new terrapin resisting ciphers and macs (alternative to strict-kex) and -ctr mode question.
...rcfour, just for reference). As far as
we are aware, there is no way for an attacker to realign the keystream
to allow the session to continue. Note however, that the attack still
passes MAC verification and that an exception is only thrown at the
application layer (i.e. wrong message format of SSH_SERVICE_REQUEST /
_ACCEPT).
> So is keeping hmac-etm iff aes-ctr is offered used still a safe option (or just "not broken"). Because luckily many
> have removed CBC already.
From our current point of view, this combination can be used without
risking any real world attack. However, this may cha...
2023 Dec 20
1
Discussion: new terrapin resisting ciphers and macs (alternative to strict-kex) and -ctr mode question.
Hello,
in addition to my last thread about a new config option to make strict-kex mandatory,
I also wonder if a new mechanism for ciphers/macs can be introduced and is reliable
by simple both sides using it.
So there could be a Chacha20-Poly1305v2 at openssh.com which uses AD data to chain the
messages together, so it will be resistant against terrapin even without the strict-kex.
Consequently