Re: Albrecht/Paterson/Watson's attack
[email protected] (Niels Möller)
| Newsgroups | gmane.ietf.secsh |
|---|---|
| Message-ID | <[email protected]> |
"Mark D. Baushke" <[email protected]> writes: > fwiw: I believe that OpenSSL extensions to KEX_DEFAULT_MAC do this: > > "[email protected]," \ > "[email protected]," \ > "[email protected]," \ > "[email protected]," \ > "[email protected]," \ > "[email protected]," \ > "[email protected]," \ > "[email protected]," \ > "[email protected]," \ > > which seems to work for them. I don't know if we want to try to make the > -etm alternatives available as a part of the SSHv2 defined set of MACs. I think that would be good. Back when the ssh protocols were designed, applying the MAC to the cleartext was uncontroversial. I think Schneier's Applied Cryptography recommended it, with the motivation that message authentication ought to be applied to the data that has meaning to the receiver. A possible attack was that the enemy might tamper with the encryption key used; this clearly changes the cleartext message, but if the MAC is applied to the cryptotext, that type of change isn't detected. The somewhat counter intuitive advice that the MAC should be applied to the cryptotext is more recent, and if it's not too painful to incorporate that in ssh in general, that would be a good thing. Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid C0B98E26. Internet email is subject to wholesale government surveillance.