Formally Modeling the Terrapin Attack on SSH
Researchers formally model the Terrapin SSH attack and show which AEAD modes remain secure.
An arXiv cs.CR paper formally models SSH channel integrity when an attacker can partially choose channel state, using the sequence number as in the 2024 Terrapin attack. It gives pseudocode for eight prominent SSH AEAD modes and varies the sending oracle across ciphertext-only, known-plaintext, and chosen-plaintext attacks. All three Encrypt-then-MAC modes and ChaCha20-Poly1305 are insecure in the ciphertext-only model, while AES-GCM is secure in all three. Encrypt-and-MAC with CBC remains secure under known plaintext, but a new BEAST-like chosen-plaintext attack breaks its channel integrity.
- The model treats the SSH sequence number as partially chosen state.
- Encrypt-then-MAC modes and ChaCha20-Poly1305 fail ciphertext-only security.
- AES-GCM stays secure in ciphertext-only, known-plaintext, and chosen-plaintext models.
- A BEAST-like chosen-plaintext attack breaks Encrypt-and-MAC with CBC.
From the original article
1 min read at arxiv.orgThe Terrapin attack against SSH channel integrity (USENIX Security 2024) used a novel attack vector: attacks on the channel state. Surprisingly, not all AEAD modes of SSH were equally affected by this attack, and it remained an open question if "unaffected" meant "secure". Existing formal models for secure channels are based on stateful encryption.
By Jörg Schwenk · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.