Subject: Steve Bellovin: ssh2 mitm attack?

From: Bill Sommerfeld <[email-masked]>
Date: Fri, 26 Jul 2002 15:55:23 -0400

[before anyone panics, this is a variant on the "hijack the connection
and substitute a different host key".

The problem described here is that at least some implementations
effectively maintain separate host key databases per (host key
algorithm, major protocol revision) pair, so that you get the
non-scary "no host key known" user prompt rather than the scary "host
key has changed" when a man-in-the-middle attacker does an
upgrade/downgrade/host key algorithm change.

					- Bill]
				
------- Forwarded Message

X-Mailer: exmh version 2.5 07/13/2001 with nmh-1.0.4
From: Steve Bellovin <[email-masked]>
To: [email-masked]
Subject: ssh2 mitm attack?
Cc: [email-masked]
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Date: Thu, 25 Jul 2002 07:48:54 -0400
Message-Id: <[email-masked]>
Content-Length: 363

Bill, have a look at http://www.phrack.org/show.php?p=59&a=11http://www.phrack.org/show.php?p=59&a=11
and in particular at the ssh2-only attack.  Are any changes to the 
drafts necessary?  (I haven't had a chance to read them in light of 
this advisory.)

		--Steve Bellovin, http://www.research.att.com/~smb (me)
		http://www.wilyhacker.com ("Firewalls" book)

------- End of Forwarded Message

---

From: Dave Dykstra <[email-masked]>
Date: Wed, 31 Jul 2002 12:37:06 -0500

I pointed this out on the openssh-unix-dev mailing list in January
    http://marc.theaimsgroup.com/?l=openssh-unix-dev&m=101069187914700&w=2
and there was some discussion but Marcus didn't seem to think it was
worth worrying about.

- Dave Dykstra

---

From: Markus Friedl <[email-masked]>
Date: Wed, 31 Jul 2002 19:43:25 +0200

> and there was some discussion but Marcus didn't seem to think it was

Well, Markus, and I said that the client should print out the other
keys.  I never finished my initial patch (until recently) because it
was not considered critical (every new hostkey allows MITM) and you
can't do anything in the protocol.