Breaking and provably repairing the SSH authenticated encryption scheme
ACM Transactions on Information and System SecurityPublished 1 May 2004
Mihir Bellare, Tadayoshi Kohno, Chanathip Namprempre
Citations112
Generate an AI Snapshot to get a quick, structured summary of this paper.
Study Snapshot
ObjectiveStudy objective
MethodsResearch methodology
PopulationPopulation studied
Sample sizeSample sizes
OutcomesStudy outcomes here
ResultsStudy results comes here
LimitationsResearch study limitations comes here
A concise AI-generated summary of the paper will appear here once you click Generate AI Snapshot.
TL;DR
This paper proposes several fixes to the SSH protocol and, using techniques from modern cryptography, it proves that their modified versions of SSH meet strong new chosen-ciphertext privacy and integrity requirements.
Abstract
The secure shell (SSH) protocol is one of the most popular cryptographic protocols on the Internet. Unfortunately, the current SSH authenticated encryption mechanism is insecure. In this paper, we propose several fixes to the SSH protocol and, using techniques from modern cryptography, we prove that our modified versions of SSH meet strong new chosen-ciphertext privacy and integrity requirements. Furthermore, our proposed fixes will require relatively little modification to the SSH protocol and to SSH implementations. We believe that our new notions of privacy and integrity for encryption schemes with stateful decryption algorithms will be of independent interest.
Keywords
Computer Science
Journal of Computer and System SciencesProbabilistic encryption
2,554 Citations1984Shafi Goldwasser, Silvio Micali
It is proved that extracting any information about the cleartext from the cyphertext is hard on the average for an adversary with polynomially bounded computational resources.
HMAC: Keyed-Hashing for Message Authentication
1,977 Citations1997Hugo Krawczyk, Mihir Bellare +1 more
This document describes HMAC, a mechanism for message authentication using cryptographic hash functions that can be used with any iterative cryptographic hash function, e.g., MD5, SHA-1, in combination with a secret shared key.
Lecture notes in computer scienceAnalysis of Key-Exchange Protocols and Their Use for Building Secure Channels
1,597 Citations2001Ran Canetti, Hugo Krawczyk
A formalism for the analysis of key-exchange protocols that combines previous definitional approaches and results in a definition of security that allows for simple modular proofs of security is presented.
A concrete security treatment of symmetric encryption
912 Citations2002Mihir Bellare, Anand Desai +2 more
This work studies notions and schemes for symmetric (ie. private key) encryption in a concrete security framework and gives four different notions of security against chosen plaintext attack, providing both upper and lower bounds, and obtaining tight relations.
Journal of CryptologyAuthenticated Encryption: Relations among Notions and Analysis of the Generic Composition Paradigm
641 Citations2008Mihir Bellare, Chanathip Namprempre
This work considers two possible notions of authenticity for authenticated encryption schemes, namely integrity of plaintexts and integrity of ciphertexts, and relates them to the standard notions of privacy IND-CCA and NM-CPA by presenting implications and separations between all notions considered.
Journal of Computer and System SciencesThe Security of the Cipher Block Chaining Message Authentication Code
600 Citations2000Mihir Bellare, Joe Kilian +1 more
A technical lemma of independent interest is bounding the success probability of a computationally unbounded adversary in distinguishing between a random ml-bit to l-bit function and the CBC MAC of a random l- bit to l -bit function.
Lecture notes in computer scienceOn the Security of Joint Signature and Encryption
576 Citations2002Jee Hea An, Yevgeniy Dodis +1 more
It is shown that gCCA2-security suffices for all known uses of CCA2-secure encryption, while no longer suffering from the definitional shortcomings of the latter.
Timing analysis of keystrokes and timing attacks on SSH
490 Citations2001Dawn Song, David Wagner +1 more
A statistical study of users' typing patterns is performed and it is shown that these patterns reveal information about the keys typed, which opens a new set of security risks, and hence caution must be taken when designing this type of protocol.
Proceedings of the IEEEPrivacy and authentication: An introduction to cryptography
466 Citations1979Whitfield Diffie, Martin E. Hellman
Authenticated-encryption with associated-data
434 Citations2002Phillip Rogaway
This paper formalizes and investigates the authenticated-encryption with associated-data (AEAD) problem, and studies two simple ways to turn an authenticated-Encryption scheme that does not support associated- data into one that does: nonce stealing and ciphertext translation.
Lecture notes in computer scienceThe Security of Cipher Block Chaining
391 Citations2007Mihir Bellare, Joe Kilian +1 more
This work provides its first formal justification, showing the following general lemma: that cipher block chaining a pseudorandom function gives a Pseudo-Cipher Block Chaining function.
Lecture notes in computer scienceThe Order of Encryption and Authentication for Protecting Communications (or: How Secure Is SSL?)
388 Citations2001Hugo Krawczyk
It is shown that any secure channels protocol designed to work with any combination of secure encryption (against chosen plaintext attacks) and secure MAC must use the encrypt-then-authenticate method.
OCB
362 Citations2001Phillip Rogaway, Mihir Bellare +2 more
It is proved OCB secure, quantifying the adversary's ability to violate the mode's privacy or authenticity in terms of the quality of its block cipher as a pseudorandom permutation (PRP) or as a strong PRP, respectively.
Counter with CBC-MAC (CCM)
327 Citations2003Doug Whiting, R. Housley +1 more
Counter with CBC-MAC (CCM) is a generic authenticated encryption block cipher mode for use with 128-bit block ciphers, such as the Advanced Encryption Standard (AES).
Lecture notes in computer scienceThe EAX Mode of Operation
260 Citations2004Mihir Bellare, Phillip Rogaway +1 more
A block-cipher mode of operation, EAX, for solving the problem of authenticated-encryption with associated-data (AEAD), which is on-line and a fixed header can be pre-processed, effectively removing the per-message cost of binding it to the ciphertext.
Lecture notes in computer scienceEncryption Modes with Almost Free Message Integrity
249 Citations2001Charanjit S. Jutla
Lecture notes in computer scienceEncode-Then-Encipher Encryption: How to Exploit Nonces or Redundancy in Plaintexts for Efficient Cryptography
190 Citations2000Mihir Bellare, Phillip Rogaway
This work investigates the following approach to symmetric encryption: first encode the message via some keyless transform, and then encipher the encoded message, meaning apply a permutation FK based on a shared key K.
Lecture notes in computer scienceCBC MACs for Arbitrary-Length Messages: The Three-Key Constructions
188 Citations2000John Black, Phillip Rogaway
Lecture notes in computer scienceUnforgeable Encryption and Chosen Ciphertext Secure Modes of Operation
183 Citations2001Jonathan Katz, Moti Yung
This work presents definitions of a new notion of security for private-key encryption called encryption unforgeability which captures an adversary's inability to generate valid ciphertexts and presents and analyzes a new mode of encryption, RPC, which is unforgeable in the strongest sense.
Lecture notes in computer sciencePassword Interception in a SSL/TLS Channel
178 Citations2003Brice Canvel, Alain P. Hiltgen +2 more
Simple password authentication is often used e.g. from an email software application to a remote IMAP server, frequently done in a protected peer-to-peer tunnel, e.G. by SSL/TLS.
Comments to NIST concerning AES Modes of Operations: CTR-Mode Encryption
147 Citations2000Helger Lipmaa, Phillip Rogaway +1 more
It is suggested that NIST, in standardizing AES modes of operation, should include CTR-mode encryption as one possibility for the next reasons, because it has significant efficiency advantages over the standard encryption modes without weakening the security.
Columbia Academic Commons (Columbia University)Problem Areas for the IP Security Protocols
138 Citations1996Steven M. Bellovin
A number of attacks against various versions of IP-layer encryption and authentication protocols, including confidentiality failures and authentication failures are described, which are troubling for the utility of this entire effort.
Lecture notes in computer scienceCWC: A High-Performance Conventional Authenticated Encryption Mode
117 Citations2004Tadayoshi Kohno, John Viega +1 more
C, a new block cipher mode of operation for protecting both the privacy and the authenticity of encapsulated data, is introduced, the first such mode having all five of the following properties: provable security, parallelizability, high performance in hardware, highperformance in software, and no intellectual property concerns.
Authenticated encryption in SSH
110 Citations2002Mihir Bellare, Tadayoshi Kohno +1 more
This paper proposes several fixes to the SSH protocol and, using techniques from modern cryptography, proves that their modified versions of SSH meet strong new chosen-ciphertext privacy and integrity requirements.
Lecture notes in computer scienceReaction Attacks against Several Public-Key Cryptosystem
89 Citations1999Chris Hall, Ian Goldberg +1 more
The attacks presented do not violate the intractibility of the underlying problems, but instead obtain information about the private key or plaintext by watching the reaction of someone decrypting a given ciphertext with the privateKey.
The Secure Shell (SSH) Transport Layer Encryption Modes
23 Citations2006Mihir Bellare, Tadayoshi Kohno +1 more
This document describes new symmetric encryption methods for the Secure Shell (SSH) Transport Protocol and gives specific recommendations on how frequently SSH implementations should rekey.
Lecture notes in computer scienceSecure Channels Based on Authenticated Encryption Schemes: A Simple Characterization
21 Citations2002Chanathip Namprempre
This work considers communication sessions in which a pair of parties begin by running an authenticated key-exchange protocol to obtain a shared session key, and then secure successive data transmissions between them via an authenticated encryption scheme based on the session key.
Cryptographic Modes of Operation for the Internet
20 Citations2001Steven M. Bellovin, Matt Blaze
Some of the security properties, and pitfalls, of several stream modes are discussed, and several ways in which these modes would be difficult to use securely in the context of Internet Network-, Transport and Application-layer protocols are noted.