Subject: [Ssh] Re: New draft: draft-miller-sshm-strict-kex
From: Peter Gutmann <[email-masked]>
To: Damien Miller <[email-masked]>, Loganaden Velvindron <[email-masked]>
Cc: Fabian Bäumer <[email-masked]>, "[email-masked]" <[email-masked]>
Date: Wed, 12 Nov 2025 01:44:38 +0000
List-Id: "The SSH mail list will allow discussions on improving aspects of the Secure Shell (SSH) protocol." <ssh.ietf.org>

Damien Miller <[email-masked]> writes:

>Strict KEX improves the properties of the key exchange regardless of the
>transport cipher/MAC, so IMO it's highly desirable.

It's also so tricky to implement that it's incredibly hard to get right, see
"Finding SSH Strict Key Exchange Violations by State Learning", only two
implementations they tested didn't contain strict KEX violations (one of them
was OpenSSH).  And those were significant public implementations, not the long
tail of lesser-visible SSH implementations which are likely to be much worse.

Based on the data we have I think it's safe to assume that the strict KEX
band-aid doesn't work in practice because it's too difficult to get right.

>At some point in the future, OpenSSH will warn when strict KEX is not offered
>by the peer

What will it do if the peer doesn't offer the vulnerable mechanism that needs
the strict KEX band-aid in the first place?

Peter.