Subject: Re: New version of rsa-sha2-256 draft: Back to PKCS#1 v1.5

From: denis bider <[email-masked]>
Date: Thu, 12 Nov 2015 18:14:12 +0000

Alright - I have enabled CBC mode algorithms to make testing easier.

We default to CTR mode only now, given that OpenSSH disabled CBC last year, and our customers want to follow external recommendations, which are to disable CBC.

Our implementation actually implements a defense for the CBC problem - but that only works for incoming data, not outgoing. And folks who still only have CBC probably do not implement a defense...

----- Original Message -----
From: Peter Gutmann 
Sent: Thursday, November 12, 2015 09:51
To: denis bider ; [email-masked] 
Cc: [email-masked] ; [email-masked] ; [email-masked] 
Subject: RE: New version of rsa-sha2-256 draft: Back to PKCS#1 v1.5

denis bider <[email-masked]> writes:

>I have posted a new version of the draft, which switches back to PKCS#1 v1.5:

Phew, thanks, that makes things much easier to deal with.

>I have also updated the experimental server so it implements the latest draft
>version (with PKCS#1 v1.5):
>
>experiment.bitvise.com:10712
>
>To test host authentication, set the list of host key algorithms in your
>KEXINIT to "rsa-sha2-256" or "rsa-sha2-512". You will need at least one of
>these for successful key exchange - the server doesn't offer anything else

---

From: Peter Gutmann <[email-masked]>
Date: Fri, 13 Nov 2015 02:49:33 +0000

denis bider <[email-masked]> writes:

>We default to CTR mode only now, given that OpenSSH disabled CBC last year,
>and our customers want to follow external recommendations, which are to
>disable CBC.

I've never used CTR for the reason I mentioned earlier, it may be worse than
the problem it's meant to be fixing.  If you look at Wei Dai's attack, it's
pretty difficult to actually carry out, it's a chosen-plaintext attack that
assumes an attacker controls the plaintext, and requires that they wait around
observing a huge number of packets to get a collision on the bits they don't
control.  Yeah, it's a theoretical weakness, but not one I'm losing much sleep
over.

OTOH CTR mode, which is a keystream generator (KSG), gives the attacker
complete control over the decrypted plaintext.  Because of SSH's unfortunate
choice of MAC-then-encrypt, the victim has to act on attacker-controlled
metadata in order to verify the MAC and discover that the data was in fact
manipulated.  Try the same thing in CBC mode and you'll just end up garbling
the block.

So my staying with CBC isn't laziness, it's because I consider the practical
(not theoretical, I mean CTR even has a security proof) risks of CBC to be
lower than CTR.

Peter.

---

From: Peter Gutmann <[email-masked]>
Date: Fri, 13 Nov 2015 03:18:21 +0000

>Alright - I have enabled CBC mode algorithms to make testing easier.

OK, that worked:

  Testing SSH session...
  Remote host: experiment.bitvise.com:10712.
  Attempt to activate SSH client session failed with error code -22, line 1129.
  Error message = 'Server reported: Invalid password'.
  (Incorrect username/password, continuing...)

This is some generic test code, so it tries to feed in a default password,
thus the "invalid password".  What format is the private key the banner in?
It looks OpenSSL-ey...

Peter.