Skrillor

4 ms·

1. 1.▲
   Crossing the Streams: SSH Plaintext Recovery via a Common Compression Context(arxiv.org)

   1 points by Skrillor 26d ago|0 comments
2. 2.▲
   by Skrillor 2y ago

   No, only NIST P-521 client keys used with PuTTY are affected. The server host key signature is computed by the server (most likely OpenSSH) which is unaffected.
3. 3.▲
   by Skrillor 3y ago

   The approach by ssh-mitm differs quite significantly as already mentioned by Manfred Kaiser in the issue linked above. Most significantly, ssh-mitm basically establishes two connections (one as a server, one as a client) and forwards messag
4. 4.▲
   by Skrillor 3y ago

   Yes, I commented this over at netgate as well. If you'd like to work around the vulnerability, you will need to disable both, chacha20-poly1305@openssh.com encryption and -etm@openssh.com MACs. Keeping either of them enabled still allo
5. 5.▲
   by Skrillor 3y ago

   Actually, you cannot perform keystroke timing attacks on the password sent during SSH user authentication. This is because SSH transmits the password in its entirety, not the individual keystrokes as it does during a shell session. The poss
6. 6.▲
   by Skrillor 3y ago

   We updated the FAQ question to cover this. For most users, fixing can be done by installing patched versions of their SSH implementations as they come available. If you feel uncomfortable waiting for an update, you may disable the affected