Plaintext-Dependent Decryption: A Formal Security Treatment of SSH-CTR

Abstract

This paper presents a formal security analysis of SSH in counter mode in a security model that accurately captures the capabilities
of real-world attackers, as well as security-relevant features of the SSH specifications and the OpenSSH implementation of
SSH. Under reasonable assumptions on the block cipher and MAC algorithms used to construct the SSH Binary Packet Protocol
(BPP), we are able to show that the SSH BPP meets a strong and appropriate notion of security: indistinguishability under
buffered, stateful chosen-ciphertext attacks. This result helps to bridge the gap between the existing security analysis of
the SSH BPP by Bellare et al. and the recently discovered attacks against the SSH BPP by Albrecht et al. which partially invalidate that analysis.

KeywordsSSH-counter mode-security proof

Full text

Page 1

SSH First Formal Security Analysis Attacks Against SSH New Formal Security Analysis Conclusion
Plaintext-Dependent Decryption:
A Formal Security Treatment of SSH-CTR
Kenneth G. Paterson and Gaven J. Watson
Information Security Group,
Royal Holloway, University of London
1st June 2010
Kenneth G. Paterson and Gaven J. Watson — Plaintext-Dependent Decryption: A Formal Security Treatment of SSH-CTR1/33

Page 2

SSH First Formal Security Analysis Attacks Against SSH New Formal Security Analysis Conclusion
1 SSH
2 First Formal Security Analysis
3 Attacks Against SSH
4 New Formal Security Analysis
5 Conclusion
Kenneth G. Paterson and Gaven J. Watson — Plaintext-Dependent Decryption: A Formal Security Treatment of SSH-CTR 2/33

Page 3

SSH First Formal Security Analysis Attacks Against SSH New Formal Security Analysis Conclusion
Outline
1 SSH
2 First Formal Security Analysis
3 Attacks Against SSH
4 New Formal Security Analysis
5 Conclusion
Kenneth G. Paterson and Gaven J. Watson — Plaintext-Dependent Decryption: A Formal Security Treatment of SSH-CTR3/33

Page 4

SSH First Formal Security Analysis Attacks Against SSH New Formal Security Analysis Conclusion
SSH
Wikipedia’s Description:
“Secure Shell or SSH is a network protocol that allows data to be
exchanged using a secure channel between two networked devices. Used
primarily on Linux and Unix based systems to access shell accounts, SSH
was designed as a replacement for TELNET and other insecure remote
shells, which send information, notably passwords, in plaintext, leaving
them open for interception. The encryption used by SSH provides
confidentiality and integrity of data over an insecure network, such as the
Internet.”
Kenneth G. Paterson and Gaven J. Watson — Plaintext-Dependent Decryption: A Formal Security Treatment of SSH-CTR 4/33

Page 5

SSH First Formal Security Analysis Attacks Against SSH New Formal Security Analysis Conclusion
SSH RFCs
SSHv2 was standardised in 2006 by the IETF in RFCs 4251-4254.
RFC 4253 specifies the SSH Binary Packet Protocol (BPP).
Symmetric encryption and integrity protection for SSH packets,
using keys agreed in an earlier exchange.
SSHv2 is widely regarded as being secure.
One minor flaw in the BPP that allows distinguishing attacks (Dai;
Bellare, Kohno and Namprempre).
Several minor variants of the SSH BPP were proven secure by
Bellare, Kohno and Namprempre (BKN) (ACM CCS 2002)
Kenneth G. Paterson and Gaven J. Watson — Plaintext-Dependent Decryption: A Formal Security Treatment of SSH-CTR5/33