Abstract

The Secure Shell (SSH) protocol is one of the most popular cryptographic protocols on the Internet. Unfortunately, the current SSH authenticated encryption mechanism is insecure. In this paper, we propose several fixes to the SSH protocol and, using techniques from modern cryptography, we prove that our modified versions of SSH meet strong new chosen-ciphertext privacy and integrity requirements. Furthermore, our proposed fixes will require relatively little modification to the SSH protocol and to SSH implementations. We believe that our new notions of privacy and integrity for encryption schemes with stateful decryption algorithms will be of independent interest.

Citations

1001	Probabilistic encryption - Goldwasser, Micali - 1984
296	A Concrete Security Treatment of Symmetric Encryption - Bellare, Desai, et al. - 1997
204	Analysis of key-exchange protocols and their use for building secure channels - Canetti, Krawczyk
172	Authenticated encryption: Relations among notions and analysis of the generic composition paradigm - Bellare, Namprempre
163	The security of the cipher block chaining message authentication code - Bellare, Kilian, et al.
113	On the security of joint signature and encryption - An, Dodis, et al. - 2002
90	Encryption modes with almost free message integrity - Jutla - 2001
77	Problem Areas for the IP Security Protocols - Bellovin - 1996
73	Privacy and authentication: An introduction to cryptography - Diffie, Hellman - 1979
52	Encode-then-encipher encryption: How to exploit nonces or redundancy in plaintexts for efficient cryptography - Bellare, Rogaway
51	Fast encryption and authentication: XCBC encryption and XECB authentication modes - Gligor, Donescu - 2001
48	CBC MACs for arbitrary-length messages: The three-key constructions - Black, Rogaway
46	On the cryptographic applications of random functions - Goldreich, Goldwasser, et al. - 1985
37	The EAX mode of operation - Bellare, Rogaway, et al. - 2004
34	Password interception in a ssl/tls channel - Canvel, Hiltgen, et al. - 2003
28	Unforgeable encryption and chosen ciphertext secure modes of operation - Katz, Yung
26	Reaction attacks against several public-key cryptosystems - Hall, Goldberg, et al. - 1999
23	D.: CWC: A high-performance conventional authenticated encryption mode - Kohno, Viega, et al. - 2004
16	Authenticated encryption in SSH: provably fixing the SSH binary packet protocol - Bellare, Kohno, et al.
15	modes of operation - DES - 1980
13	Cryptographic modes of operation for the Internet - Bellovin, Blaze - 2001
8	Concealment and its applications to authenticated encryption - An, Dodis - 2003
3	An Attack Against SSH2 Protocol. Email to the SECSH Working Group available from ftp://ftp.ietf.org - Dai - 2002
1	SSH transport layer encryption modes. Available at http://www.ietf.org/html.charters/secsh-charter.html - Bellare, Kohno, et al. - 2004