Re: [Curdle] [saag] Time for SSH3?

HI,

I have to agree with Peter.

The attack here is pretty clever, but (at least currently) is fairly
limited to Chacha/Poly and CBC-etm.  The workaround is easy:  don't use
those methods, and use GCM or OCB methods.

I see no reason to throw out the whole protocol, including the decades of
analysis and code reviews just because someone found an issue with a few
added extensions.

Now, if it turns out this can be extended, then we can re-open the
discussion.

-derek

On Wed, December 20, 2023 6:35 am, Peter Gutmann wrote:
> John Mattsson <john.mattsson=40ericsson.com@dmarc.ietf.org> writes:
>
>>SSH was just hit by a major vulnerability.
>
> Is it?  It's more of a neat-trick attack [*], from a quick scan of the
> paper
> it only works if you implement one of two nonstandard modes invented by
> the
> OpenSSH guys, and then it only allows you to mess with extension packets,
> of
> which only server-sig-algs seems to be security-relevant.  Even in that
> case
> it's hard to tell whether it's a real vuln or not (my code ignores this
> packet
> because in practice you can tell from the handshake algos used what
> signature
> algo to apply).
>
>>I strongly think the right future for SSH is to not do more patching and
>>instead move to SSH3
>
> Please, no!  It's bad enough that the TLS folks decided to invent a
> completely
> new protocol breaking compatibility with all existing deployed systems so
> you
> now have to run two protocol stacks in parallel, doing the same thing for
> SSH
> when there's a simple fix available - don't use nonstandard mechanisms
> that
> one particular implementation invented - is completely unnecessary.
>
> In fact for the vast majority of legacy stuff out there which won't easily
> be
> able to move to any proposed SSHn+1 there's no fix necessary since they
> never
> supported the nonstandard OpenSSH modes in the first place.  So it's the
> very
> rush to new! shiny! that caused the problem in the first place.
>
> Peter.
>
> [*] Not meant to disparage the work of the attack authors, it is a pretty
> neat
>     trick :-).
>
> _______________________________________________
> saag mailing list
> saag@ietf.org
> https://www.ietf.org/mailman/listinfo/saag
>

-- 
       Derek Atkins                 617-623-3745
       derek@ihtfp.com             www.ihtfp.com
       Computer and Internet Security Consultant