IETF-SSH archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

Re: applying AES-GCM to secure shell: proposed "tweak"



Even without the DISCONNECT and syslogging you still leak quite a bit
IFF the packet length decodes to something less than max packet.  Yes,
it's unlikely for an active attacker to cause that, since max packet
will usually be on the order of 2^16 but the truly max packet length is
on the order of 2^32, but surely you see the point.

It is not necessary to leak anything. If decoded packet length is invalid or exceeds MaxPacketLength (e.g. 2^16), then:

1. Select a random valid packet length between MinPacketLength and MaxPacketLength.

2. Read the randomly selected amount of data.

3. Choke as if MAC is incorrect.

This prevents the attacker from knowing whether the info they're getting is useful or not, and the likelihood is 1 against 2^N that it's not.

denis





Home | Main Index | Thread Index | Old Index