Re: [Curdle] Time for SSH3?

[Peter Gutmann <[e-mail]>]

John Mattsson <john.mattsson=[e-mail]> writes:

>SSH was just hit by a major vulnerability.

Is it?  It's more of a neat-trick attack [*], from a quick scan of the paper
it only works if you implement one of two nonstandard modes invented by the
OpenSSH guys, and then it only allows you to mess with extension packets, of
which only server-sig-algs seems to be security-relevant.  Even in that case
it's hard to tell whether it's a real vuln or not (my code ignores this packet
because in practice you can tell from the handshake algos used what signature
algo to apply).

>I strongly think the right future for SSH is to not do more patching and
>instead move to SSH3

Please, no!  It's bad enough that the TLS folks decided to invent a completely
new protocol breaking compatibility with all existing deployed systems so you
now have to run two protocol stacks in parallel, doing the same thing for SSH
when there's a simple fix available - don't use nonstandard mechanisms that
one particular implementation invented - is completely unnecessary.

In fact for the vast majority of legacy stuff out there which won't easily be
able to move to any proposed SSHn+1 there's no fix necessary since they never
supported the nonstandard OpenSSH modes in the first place.  So it's the very
rush to new! shiny! that caused the problem in the first place.

Peter.

[*] Not meant to disparage the work of the attack authors, it is a pretty neat
    trick :-).