FazBrowse Wikipedia Viewer | Main Page |
Search Wikipedia:
|
Viewing: https://en.wikipedia.org/wiki/Secure_Shell

SSH

Contents
Algorithms
Vulnerabilities
    SSH-1
    CBC plaintext recovery
    Suspected decryption by NSA
    Terrapin attack

SSH
Protocol stack
Purposesecure connection, remote access
DevelopersTatu Ylönen, Internet Engineering Task Force (IETF)
Introduction1995;31 years ago (1995)
OSI layerTransport layer through application layer
Port22
RFCs4250, 4251, 4252, 4253, 4254
Internet protocol suite
Application layer
Transport layer
Internet layer
Link layer
rsh and RFC 4253) typically uses the Transmission Control Protocol (TCP) of TCP/IP, reserving port number 22 as a server listening port. This layer handles initial key exchange as well as server authentication, and sets up encryption, compression, and integrity verification. It exposes to the upper layer an interface for sending and receiving plaintext packets with a size of up to 32,768 bytes each, but more can be allowed by each implementation. The transport layer also arranges for key re-exchange, usually after 1 GB of data has been transferred or after one hour has passed, whichever occurs first.
  • The user authentication layer (RFC 4254) defines the concept of channels, channel requests, and global requests, which define the SSH services provided. A single SSH connection can be multiplexed into multiple logical channels simultaneously, each transferring data bidirectionally. Channel requests are used to relay out-of-band channel-specific data, such as the changed size of a terminal window or the exit code of a server-side process. Additionally, each channel performs its own flow control using the receive window size. The SSH client requests a server-side port to be forwarded using a global request. Standard channel types include:
    • shell for terminal shells, SFTP and exec requests (including SCP transfers)
    • direct-tcpip for client-to-server forwarded connections
    • forwarded-tcpip for server-to-client forwarded connections
  • The SSHFP DNS record (RFC 4255) provides the public host key fingerprints in order to aid in verifying the authenticity of the host.

    • This open architecture provides considerable flexibility, allowing the use of SSH for a variety of purposes beyond a secure shell. The functionality of the transport layer alone is comparable to Transport Layer Security (TLS); the user-authentication layer is highly extensible with custom authentication methods; and the connection layer provides the ability to multiplex many secondary sessions into a single SSH connection, a feature comparable to BEEP and not available in TLS.

    Algorithms

    edit

    Vulnerabilities

    edit

    SSH-1

    edit

    In 1998, a vulnerability was described in SSH 1.5 which allowed the unauthorized insertion of content into an encrypted SSH stream due to insufficient data integrity protection from CRC-32 used in this version of the protocol. A fix known as SSH Compensation Attack Detector was introduced into most implementations. Many of these updated implementations contained a new integer overflow vulnerability that allowed attackers to execute arbitrary code with the privileges of the SSH daemon, typically root.

    In January 2001 a vulnerability was discovered that allows attackers to modify the last block of an IDEA-encrypted session. The same month, another vulnerability was discovered that allowed a malicious server to forward a client authentication to another server.

    Since SSH-1 has inherent design flaws that make it vulnerable, it is now generally considered obsolete and should be avoided by explicitly disabling fallback to SSH-1. Most modern servers and clients support SSH-2.

    CBC plaintext recovery

    edit

    In November 2008, a theoretical vulnerability was discovered for all versions of SSH which allowed recovery of up to 32 bits of plaintext from a block of ciphertext that was encrypted using what was then the standard default encryption mode, CBC. The most straightforward solution is to use CTR, counter mode, instead of CBC mode, since this renders SSH resistant to the attack.

    Suspected decryption by NSA

    edit

    On December 28, 2014 Der Spiegel published classified information leaked by whistleblower Edward Snowden which suggests that the National Security Agency may be able to decrypt some SSH traffic. The technical details associated with such a process were not disclosed. A 2017 analysis of the CIA hacking tools BothanSpy and Gyrfalcon suggested that the SSH protocol was not compromised.

    Terrapin attack

    edit
    RFC 4250 – The Secure Shell (SSH) Protocol Assigned Numbers
  • RFC 4253 – The Secure Shell (SSH) Transport Layer Protocol
  • RFC 4256 – Generic Message Exchange Authentication for the Secure Shell Protocol (SSH)
  • RFC 4345 – Improved Arcfour Modes for the Secure Shell (SSH) Transport Layer Protocol

    • The protocol specifications were later updated by the following publications: