Subject: draft-ietf-secsh-newmodes-01.txt: WG Last Call!

From: Bill Sommerfeld <[email-masked]>
Date: Sun, 09 Nov 2003 21:03:55 -0500

The revision appears to have resolved the WG chair nits; however, it
appears that some sort of formatting glitch occurred.  It appears that
a number of the "'s" -- cipher's, Protocol's, etc., got mangled into
non-ascii characters (it renders in emacs as "a-circumflex", octal
200, octal 231, 's').

We will need to respin the document to correct this, but this is such
a minor thing that I feel it's time to start a working group last call
*now*.

WG Members: please send comments on this document to this mailing list
and the author as soon as possible.

This WG last call period ends on 11/23/2003.

				- Bill

---

From: [email-masked] (Niels Möller)
Date: 11 Nov 2003 13:03:42 +0100

> and the author as soon as possible.

Section 5.1, rekeying considerations, third paragraph, says

   Similarly, the use of random (and unpredictable to
   an adversary) padding will not prevent information leakage through
   the underlying MAC [BKN].

I don't think this statement is quite right.

The attacker needs MAC:s for identical plaintexts to collide, and uses
this to confirm that a guessed plaintext and an actual plaintext
match. For fix padding, this happens with probability 1, which implies
that a *single* chosen plaintext message is sufficient to confirm one
correctly guessed message. With four bytes of random padding, it
happens with probability (1/2)^32, which is a significant difference.

Reading of the BKN paper seems to confirm that random padding makes
the attack considerably less practical.

Of course, this doens't mean that it's harmless to reuse the sequence
number. Reusing the sequence number makes it possible for an attacker
to replay ssh packets (this is also documented in the BKN paper).

To me, replay attacks are a more compelling reason to avoid sequence
number reuse than the information leak, and I think the newmodes
document should mention this class of attacks.

Regards,
/Niels

---

From: Yoshi Kohno <[email-masked]>
Date: Wed, 12 Nov 2003 11:30:31 -0800

> document should mention this class of attacks.

Thank you for pointing this out.  Yes, we seem to have failed to mention 
this in the current version of the Internet-Draft.  We will fix this in 
the next version.

Yoshi