Re: [saag] A case against algorithm agility (long)

[ianG <[e-mail]>]

On 5/05/2014 18:32 pm, Paterson, Kenny wrote:
>>> Nonsense.  The CBC IV chaining bugs were exploited against SSHv2.  We
>>> were very glad back then to have deployed AES in counter mode as that
>>> saved our butts.
>>
>>
>> Any reference to that?
> 
> How about these:

Thanks!  Excellent.  Was there any fallout, any actual attacks or damages?

> http://www.kb.cert.org/vuls/id/958563
> 
> http://www.openssh.com/txt/cbc.adv

     "A future version of OpenSSH may make CTR mode ciphers the default
and/or implement other countermeasures, but at present we do not feel
that this issue is serious enough to make an emergency release."



On the face of those texts, this was a nice exploit of academic note,
but not a likely one, nor a practical one.  Something to be fixed, but
not something to inform our design choices in the future.

I'll let my point 7. stand unless there is some info about attacks and
damages.

(One question:  is Nico's claim that this is an example of "being saved"
more to do with commercial vendors' need to ship product with no
theoretical or known flaws?)



> 
> and
> 
> http://www.isg.rhul.ac.uk/~kp/SandPfinal.pdf
> 
> 
> (for details of the attack).
> 
> Cheers,
> 
> Kenny


thanks again,

iang