SSH (Product): news timeline & CVEs

Formally Modeling the Terrapin Attack on SSH

Researchers formally model the Terrapin SSH attack and show which AEAD modes remain secure.

An arXiv cs.CR paper formally models SSH channel integrity when an attacker can partially choose channel state, using the sequence number as in the 2024 Terrapin attack. It gives pseudocode for eight prominent SSH AEAD modes and varies the sending oracle across ciphertext-only, known-plaintext, and chosen-plaintext attacks. All three Encrypt-then-MAC modes and ChaCha20-Poly1305 are insecure in the ciphertext-only model, while AES-GCM is secure in all three. Encrypt-and-MAC with CBC remains secure under known plaintext, but a new BEAST-like chosen-plaintext attack breaks its channel integrity.

arXiv cs.CRSep 22, 13:00 UTC · 4d agoResearch

Transcript-Bound Combiners for Downgrade-Resilient Hybrid Post-Quantum Key Establishment: Definition, Proof, and Embedded-Device Cost

Researchers prove transcript-bound hybrid KEM combiners stop downgrade attacks, adding one hash and no extra messages.

Hybrid key establishment with ML-KEM and classical Diffie-Hellman protects the session key but not negotiation integrity when deployed without a handshake transcript. The paper defines a combiner-layer security game and proves that a combiner ignoring the transcript can be downgraded with certainty, while binding the session key and confirmation tag to a transcript hash blocks such attempts up to a negligible term for a 256-bit hash. On Cortex-M4, transcript binding adds one hash per party—about 11.8% of handshake computation and 1.5% of radio-inclusive energy—with no extra messages or bytes. Measurements come from a released harness that passes a 30-check validation gate.

arXiv cs.CRSep 18, 03:37 UTC · 9d agoResearch

SSH

Timeline2 articles

Appears with

Formally Modeling the Terrapin Attack on SSH

Transcript-Bound Combiners for Downgrade-Resilient Hybrid Post-Quantum Key Establishment: Definition, Proof, and Embedded-Device Cost