Re: [Curdle] [saag] Time for SSH3?

[Theodore Ts'o <[e-mail]>]

On Wed, Dec 20, 2023 at 08:26:53AM -0500, Derek Atkins wrote:
> 
> The attack here is pretty clever, but (at least currently) is fairly
> limited to Chacha/Poly and CBC-etm.  The workaround is easy: don't
> use those methods, and use GCM or OCB methods.

Well, one of the algorithms in question is
[e-mail], which is the default for OpenSSH, which
is why the preprint claims that 77% of all ssh connections are
vulnerable.  Of course, it *also* requires a MITM attack, and if the
attacker has MITM capabilities, given that (a) SecureDNS isn't
generally deployed, and (b) most users can be tricked into accepting
unknown key's fingerprints, so there are probably easier way to attack
most users.

> I see no reason to throw out the whole protocol, including the
> decades of analysis and code reviews just because someone found an
> issue with a few added extensions.

In addition to the short-term fix of disabling the ciphers, there is
also an extension, strict key exchange, which will address the attack.
It requires that both the client and server be patched, but that's
going to be deployable much more quickly than a completly incompatible
protocol change that will take years to be fully deployed.

Moreover, if IETF tries to standardize a completely incompatible
protocol rewrite without close coperation with development team(s) of
the dominant implementation(s), the precedent of IPv6 of taking
**decades** to be fully rolled out may be the more relevant
comparison.

Cheers,

					- Ted