Subject: text about CBC Oracle attack

From: Sam Hartman <[email-masked]>
Date: Tue, 19 Nov 2002 17:41:31 -0500 (EST)

At the meeting today we noted that we need to include some text in the
digest-md5 spec regarding CBC Oracle attacks.

Here's the text from section 11 (security considerations) of draft-ietf-secsh-transport-14:

   Nearly all ciphers specified in this document are used in cipher
   block chaining (CBC) mode.  It's been known for some time that CBC
   modes will reveal information about the plaintext if two ciphertext
   blocks encrypted under the same key are equal; this is one of the
   reasons this document strongly recommends rekeying at least once per
   gigabyte of data, to reduce the chance that a "birthday paradox"
   collision will appear.

   Recent research has uncovered a new attack on CBC mode which, under
   certain conditions, allows a chosen plaintext attacker aware of the
   IV for a forthcoming message to have some chance to artificially
   induce a system into generating ciphertext collisions, allowing the
   attacker's guesses at likely prior plaintexts to be confirmed.

   Any protocol which uses CBC in a way which allows advance knowledge
   of a message's IV (e.g., by using the last block of the preceding
   message as the IV) might be vulnerable to this attack.

   Preliminary analysis of this attack as applied to the SSH protocol
   suggests that the protocol as implemented today is actually fairly
   resistant to this attack.  While estimates vary, on average, an
   attacker would need tens or hundreds of millions of opportunities to
   inject chosen plaintexts to be encrypted with a known IV to confirm
   guesses on the value of a few unknown plaintexts.

   While this attack involves less work than a brute-force attack on the
   underlying cipher (and is thus a matter of some concern), it is also
   likely to be significantly more difficult than attacks on other parts
   of a system using the SSH protocol, and so is unlikely to be an
   immediate risk to real-world systems.  Due to this document's
   recommendation that rekeying occur once an hour, an attacker also has
   a limited amount of time to complete any particular attack.

   Nevertheless, work is underway to specify, in a separate document or

Ylonen, et. al.        Expires September 18, 2002              [Page 24]

Internet-Draft        SSH Transport Layer Protocol            March 2002

   documents, additional cipher modes for the SSH protocol to address
   this vulnerability.  Implementors should be prepared to add new
   algorithms to their implementations as this work progresses.

---

From: "Paul Leach" <[email-masked]>
Date: Tue, 19 Nov 2002 16:38:23 -0800

Question: if it's a birthday paradox issue, does that mean that ciphers
with a block size of 128 bits such as AES are immune from a practical
standpoint (say, 2**32 times harder to get a birthday coincidence)?

-----Original Message-----
From: Sam Hartman [mailto:[email-masked]] 
Sent: Tuesday, November 19, 2002 2:42 PM
To: [email-masked]
Subject: text about CBC Oracle attack

Here's the text from section 11 (security considerations) of
draft-ietf-secsh-transport-14: