Encryption Method Considerations

Researchers have shown that the original CBC-based encryption methods in [RFC4253] are vulnerable to chosen-plaintext privacy attacks

[DAI,BKN1,BKN2]. The new stateful-decryption counter mode encryption methods described in Section 4 of this document were designed to be secure replacements to the original encryption methods described in [RFC4253].

Many people shy away from counter mode-based encryption schemes

because, when used incorrectly (such as when the keystream is allowed to repeat), counter mode can be very insecure. Fortunately, the common concerns with counter mode do not apply to SSH because of the rekeying recommendations and because of the additional protection provided by the transport protocol’s MAC. This discussion is formalized with proofs of security in [BKN1,BKN2].

As an additional note, when one of the stateful-decryption counter mode encryption methods (Section 4) is used, then the padding

included in an SSH packet (Section 4 of [RFC4253]) need not be (but can still be) random. This eliminates the need to generate

cryptographically secure pseudorandom bytes for each packet.

One property of counter mode encryption is that it does not require that messages be padded to a multiple of the block cipher’s block length. Although not padding messages can reduce the protocol’s network consumption, this document requires that padding be a

multiple of the block cipher’s block length in order to (1) not alter

the packet description in [RFC4253] and (2) not leak precise

information about the length of the packet’s payload data. (Although there may be some network savings from padding to only 8-bytes even if the block cipher uses 16-byte blocks, because of (1) we do not make that recommendation here.)

In addition to stateful-decryption counter mode, [BKN1,BKN2] describe other provably secure encryption methods for use with the SSH

Transport Protocol. The stateful-decryption counter mode methods in Section 4 are, however, the preferred alternatives to the insecure methods in [RFC4253] because stateful-decryption counter mode is the most efficient (in terms of both network consumption and the number of required cryptographic operations per packet).

Normative References

[AES] National Institute of Standards and Technology, "Advanced Encryption Standard (AES)", Federal Information

Processing Standards Publication 197, November 2001.

[DES] National Institute of Standards and Technology, "Data Encryption Standard (DES)", Federal Information

Processing Standards Publication 46-3, October 1999.

[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.

[RFC2144] Adams, C., "The CAST-128 Encryption Algorithm", RFC 2144, May 1997.

[RFC4250] Lehtinen, S. and C. Lonvick, Ed., "The Secure Shell (SSH) Protocol Assigned Numbers", RFC 4250, January 2006.

[RFC4251] Ylonen, T. and C. Lonvick, Ed., "The Secure Shell (SSH) Protocol Architecture", RFC 4251, January 2006.

[RFC4253] Ylonen, T. and C. Lonvick, Ed., "The Secure Shell (SSH) Transport Layer Protocol", RFC 4253, January 2006.

[SCHNEIER] Schneier, B., "Applied Cryptography Second Edition:

Protocols algorithms and source in code in C", Wiley, 1996.

[SERPENT] Anderson, R., Biham, E., and Knudsen, L., "Serpent: A proposal for the Advanced Encryption Standard", NIST AES Proposal, 1998.

[TWOFISH] Schneier, B., et al., "The Twofish Encryptions Algorithm:

A 128-bit block cipher, 1st Edition", Wiley, 1999.

Informative References

[BKN1] Bellare, M., Kohno, T., and Namprempre, C.,

"Authenticated Encryption in SSH: Provably Fixing the SSH Binary Packet Protocol", Ninth ACM Conference on Computer and Communications Security, 2002.

[BKN2] Bellare, M., Kohno, T., and Namprempre, C., "Breaking and Provably Repairing the SSH Authenticated Encryption

Scheme: A Case Study of the Encode-then-Encrypt-and-MAC Paradigm", ACM Transactions on Information and System Security, 7(2), May 2004.

[DAI] Dai, W., "An Attack Against SSH2 Protocol", Email to the ietf-ssh@netbsd.org email list, 2002.

Authors’ Addresses Mihir Bellare

Department of Computer Science and Engineering University of California at San Diego

9500 Gilman Drive, MC 0404 La Jolla, CA 92093-0404 Phone: +1 858-534-8833 EMail: mihir@cs.ucsd.edu

Tadayoshi Kohno

Department of Computer Science and Engineering University of California at San Diego

9500 Gilman Drive, MC 0404 La Jolla, CA 92093-0404 Phone: +1 858-534-8833 EMail: tkohno@cs.ucsd.edu

Chanathip Namprempre Thammasat University Faculty of Engineering

Electrical Engineering Department Rangsit Campus, Klong Luang

Pathumthani, Thailand 12121 EMail: meaw@alum.mit.edu

Full Copyright Statement

Copyright (C) The Internet Society (2006).

This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.

This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE

INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Intellectual Property

The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; nor does it represent that it has made any independent effort to identify any such rights. Information on the procedures with respect to rights in RFC documents can be found in BCP 78 and BCP 79.

Copies of IPR disclosures made to the IETF Secretariat and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this

specification can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr.

The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at ietf-ipr@ietf.org.

Acknowledgement

Funding for the RFC Editor function is provided by the IETF Administrative Support Activity (IASA).