Re: [Curdle] [saag] Time for SSH3?

[Watson Ladd <[e-mail]>]

On Wed, Dec 20, 2023 at 5:10 PM Peter Gutmann <[e-mail]> wrote:
>
> Theodore Ts'o <[e-mail]> writes:
>
> >Well, one of the algorithms in question is [e-mail],
> >which is the default for OpenSSH, which is why the preprint claims that 77%
> >of all ssh connections are vulnerable.
>
> And this is a major part of the problem.  If you look at what this
> vulnerability involves, the exploitable issue is a combination of an
> @openssh.com crypto mechanism, another @openssh.com crypto mechanism, and an
> @openssh.com crypto extension (assuming server-sig-algs, ping, etc aren't a
> big deal).
>
> You may be seeing a pattern here.
>
> Not wanting to specifically bash OpenSSH but simply pointing out a problem,
> these are homebrew crypto mechanisms that never went through any kind of
> independent review like the rest of the SSH crypto but merely appeared one day
> in the dominant implementation, which forced everyone else to track down where
> they were documented (in the bottom of a locked filing cabinet stuck in a
> disused lavatory with a sign on the door saying 'Beware of the Leopard') and
> figure out a compatible implementation.
>
> In contrast TLS' EtM went through the full RFC process with independent review
> and plenty of nitpicking (RFC 7366), and AFAIK no such attack exists for that.
> This wasn't a failure of the SSH standards process or protocol because it's
> something that was never part of the SSH standard or (RFC-documented) SSH
> protocol, it's a third-party homebrew add-on that everyone else was forced to
> adopt.

Are you sure you want to say the RFC process provides the sort of
security analysis that prevents these attacks in TLS?

Bleichenbacher, Insecure rengotiation, bodos doc on CBC, BREACH,
CRIME, Poodle,  Insecure DH params,  Triple Handshake, Lucky 13.

What's really stopped this dismal parade is actual analysis by people
who know what they are doing, together with motivated deployers of
properly analyzed protocols.

Sincerely,
Watson Ladd



-- 
Astra mortemque praestare gradatim