IETF-SSH archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

Re: applying AES-GCM to secure shell: proposed "tweak"



--On Thursday, April 09, 2009 10:33:52 AM -0400 der Mouse <mouse%Rodents-Montreal.ORG@localhost> wrote:

I think any option that changes the binary packet format would need
to be included in the kex hash to prevent downgrade/upgrade attacks.
This is somewhat annoying implementation-wise if it is a separate
packet.

Is there any way of doing some sort of pre-auth to prevent tampering
with the options packets?

You could simply decree that options packets for the option in question
are not acceptable if sent before the first kex completes.  (I'd
hesitate to do that for all options packets, but it may be necessary.)

The problem with doing it for all option packets is that doing so precludes negotiating cleartext-packet-lengths before the first kex completes, which is necessary if the first kex selects an encryption algorithm requiring cleartext packet lengths.



Home | Main Index | Thread Index | Old Index