RFC 4344
The Secure Shell (SSH) Transport Layer Encryption Modes
RFC 4344 🎀 The Secure Shell (SSH) Transport Layer Encryption Modes
okay bestie, let's get into RFC 4344 💅 here's the title block:
- Stream: Network Working Group 🌸
- RFC number: 4344
- Authors: M. Bellare, T. Kohno (both UC San Diego), and C. Namprempre (Thammasat University) ✨
- Category: Standards Track 🦋
- Date: January 2006 📅
- Obsoletes/Updates: the title block doesn't list any, so this doc doesn't say it obsoletes or updates anything 🫶
Status of This Memo ✨
okay so this one is an Internet standards track protocol for the whole Internet community 🌈 it's literally asking for discussion and suggestions for improvements, so speak up! 🗣️ if you want the current standardization state and status of this protocol, check the "Internet Official Protocol Standards" (STD 1) list. also, distribution of this memo is unlimited, so share it with your whole group chat 💜
Copyright Notice 🧚
Copyright (C) The Internet Society (2006).
Abstract 💖
the tea ☕ researchers found that the authenticated encryption part of the current SSH Transport Protocol is vulnerable to several attacks 💀
this doc describes new symmetric encryption methods for the Secure Shell (SSH) Transport Protocol, and it gives specific recommendations on how often SSH implementations should rekey 🔑
Table of Contents 🍓
1. Introduction ....................................................2
2. Conventions Used in This Document ...............................2
3. Rekeying ........................................................2
3.1. First Rekeying Recommendation ..............................3
3.2. Second Rekeying Recommendation .............................3
4. Encryption Modes ................................................3
5. IANA Considerations .............................................6
6. Security Considerations .........................................6
6.1. Rekeying Considerations ....................................7
6.2. Encryption Method Considerations ...........................8
Normative References ...............................................9
Informative References ............................................101. Introduction ✨
okay so the symmetric part of the SSH Transport Protocol was designed to give you both privacy and integrity for the data it wraps 🎀 but researchers ([DAI,BKN1,BKN2]) have found several security problems with it, as described in [RFC4253] 😭 for example, the encryption mode specified in [RFC4253] is vulnerable to a chosen-plaintext privacy attack. and if you don't rekey often enough, the SSH Transport Protocol may leak info about your payload data. this part is true no matter which encryption mode you're using 🙈
In [BKN1,BKN2], Bellare, Kohno, and Namprempre show how to modify the symmetric part of the SSH Transport Protocol so that it provably preserves privacy and integrity against chosen-plaintext, chosen-ciphertext, and reaction attacks 👑 this doc puts the recommendations from [BKN1,BKN2] into practice 🫶
2. Conventions Used in This Document 🦋
the key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] 📖
the used data types and terminology are specified in the architecture document [RFC4251] 🧠
the SSH Transport Protocol is specified in the transport document [RFC4253] 🚀
3. Rekeying 🔑
okay so Section 9 of [RFC4253] suggests that SSH implementations rekey after every gigabyte of transmitted data. but [RFC4253] doesn't go into all the problems that could pop up if an SSH implementation doesn't rekey often enough 👀 this section is here to strengthen that suggestion from [RFC4253] by giving firm upper bounds on how many encryptions are tolerable between rekeying operations ✨ we dig into the reasons behind these rekeying recommendations in Section 6, so stay tuned 🍓
this section makes two recommendations 💅 informally, the first one is meant to protect against possible information leakage through the MAC tag, and the second one is meant to protect against possible information leakage through the block cipher. heads up: depending on the block length of the underlying block cipher and the length of the encrypted packets, the first recommendation may supersede the second recommendation, or vice versa. 🫣
3.1. First Rekeying Recommendation 🌸
because of possible information leakage through the MAC tag, SSH implementations SHOULD rekey at least once every 2**32 outgoing packets. more explicitly, after a key exchange, an SSH implementation SHOULD NOT send more than 2**32 packets before rekeying again 🙅♀️
SSH implementations SHOULD also attempt to rekey before receiving more than 2**32 packets since the last rekey operation. the preferred way to do this is to rekey after receiving more than 2**31 packets since the last rekey operation 🎯
3.2. Second Rekeying Recommendation 🌈
because of a birthday property of block ciphers and some modes of operation, implementations must be careful not to encrypt too many blocks with the same encryption key 🧁
let L be the block length (in bits) of an SSH encryption method's block cipher (e.g., 128 for AES) 📐 if L is at least 128, then, after rekeying, an SSH implementation SHOULD NOT encrypt more than 2**(L/4) blocks before rekeying again. if L is at least 128, then SSH implementations should also attempt to force a rekey before receiving more than 2**(L/4) blocks ⏳ if L is less than 128 (which is the case for older ciphers such as 3DES, Blowfish, CAST-128, and IDEA), then, although it may be too expensive to rekey every 2**(L/4) blocks, it is still advisable for SSH implementations to follow the original recommendation in [RFC4253]: rekey at least once for every gigabyte of transmitted data 💖
note that if L is less than or equal to 128, then the recommendation in this subsection supersedes the recommendation in Section 3.1. if an SSH implementation uses a block cipher with a larger block size (e.g., Rijndael with 256-bit blocks), then the recommendations in Section 3.1 may supersede the recommendations in this subsection (depending on the lengths of the packets) 🧚
4. Encryption Modes ✨
okay so this section adds brand new encryption methods for the SSH Transport Protocol 🔐 they're extra options on top of the ones in Section 6.3 of [RFC4253], not replacements 💅
quick refresher from [RFC4253]: the encryption in each direction of an SSH connection MUST run independently of the other direction 🫶 and once encryption is on, the packet length, padding length, payload, and padding fields of every packet MUST be encrypted with the chosen method. also, the total length of packet length + padding length + payload + padding MUST be a multiple of the cipher's block size whenever that block size is 8 bytes or more (which is the case for every method below) 🧚
here are the new methods, bestie 🍓
aes128-ctr RECOMMENDED AES (Rijndael) in SDCTR mode,
with 128-bit key
aes192-ctr RECOMMENDED AES with 192-bit key
aes256-ctr RECOMMENDED AES with 256-bit key
3des-ctr RECOMMENDED Three-key 3DES in SDCTR mode
blowfish-ctr OPTIONAL Blowfish in SDCTR mode
twofish128-ctr OPTIONAL Twofish in SDCTR mode,
with 128-bit key
twofish192-ctr OPTIONAL Twofish with 192-bit key
twofish256-ctr OPTIONAL Twofish with 256-bit key
serpent128-ctr OPTIONAL Serpent in SDCTR mode, with
128-bit key
serpent192-ctr OPTIONAL Serpent with 192-bit key
serpent256-ctr OPTIONAL Serpent with 256-bit key
idea-ctr OPTIONAL IDEA in SDCTR mode
cast128-ctr OPTIONAL CAST-128 in SDCTR mode,
with 128-bit keyso the <cipher>-ctr label just means "run this block cipher in "stateful-decryption counter" (SDCTR) mode" 🌈 let L be the block length of <cipher> in bits. both the sender and the receiver keep an internal L-bit counter called X. the starting value of X should be the initial IV (computed in Section 7.2 of [RFC4253]) read as an L-bit unsigned integer in network-byte-order. if X=(2**L)-1, then "increment X" means the normal thing, which is "set X to 0" 💀 the notation <X> means "turn X into an L-bit string in network-byte-order." implementations can store X differently though, for example as several unsigned 32-bit counters 🎀
encrypting is giving pure vibes ✨ take a packet P=P1||P2||...||Pn, where each Pi is a block of length L. the encryptor first encrypts <X> with <cipher> to get a block B1. then B1 gets XORed with P1 to make the ciphertext block C1. next the counter X gets incremented, and the same thing happens for every remaining block in order, until you have the whole ciphertext C=C1||C2||...||Cn for that packet. the counter X is NOT included in the ciphertext, btw 🙈 also, the keystream can be pre-computed, and encryption is parallelizable 🔥
decrypting is the mirror image 🪞 the decryptor (who keeps its own copy of X) encrypts its copy of <X> with <cipher> to get B1, XORs B1 with C1 to recover P1, then increments its copy of X and repeats for each block until it has the plaintext packet P=P1||P2||...||Pn. same as before, the keystream can be pre-computed, and decryption is parallelizable 👑
the "aes128-ctr" method uses AES (the Advanced Encryption Standard, formerly Rijndael) with 128-bit keys [AES]. the block size is 16 bytes 💖
At this time, it appears likely that a future specification will promote aes128-ctr to be REQUIRED; implementation of this algorithm is very strongly encouraged. 😭
the "aes192-ctr" method uses AES with 192-bit keys 🌸
the "aes256-ctr" method uses AES with 256-bit keys 🌸
the "3des-ctr" method uses three-key triple-DES (encrypt-decrypt-encrypt). the first 8 bytes of the key are used for the first encryption, the next 8 bytes for the decryption, and the following 8 bytes for the final encryption. that means it needs 24 bytes of key data, though only 168 bits of it actually get used 🧐 the block size is 8 bytes, and this algorithm is defined in [DES] ✨
the "blowfish-ctr" method uses Blowfish with 256-bit keys [SCHNEIER]. the block size is 8 bytes. (quick side note: "blowfish-cbc" from [RFC4253] uses 128-bit keys, so these are different ✋)
the "twofish128-ctr" method uses Twofish with 128-bit keys [TWOFISH]. the block size is 16 bytes 🦋
the "twofish192-ctr" method uses Twofish with 192-bit keys 🦋
the "twofish256-ctr" method uses Twofish with 256-bit keys 🦋
the "serpent128-ctr" method uses the Serpent block cipher [SERPENT] with 128-bit keys. the block size is 16 bytes 🧚
the "serpent192-ctr" method uses Serpent with 192-bit keys 🧚
the "serpent256-ctr" method uses Serpent with 256-bit keys 🧚
the "idea-ctr" method uses the IDEA cipher [SCHNEIER]. the block size is 8 bytes 🍓
the "cast128-ctr" method uses the CAST-128 cipher with 128-bit keys [RFC2144]. the block size is 8 bytes 🌈
5. IANA Considerations 📋
the thirteen encryption algorithm names defined in Section 4 got added to the Secure Shell Encryption Algorithm Name registry, which was set up by Section 4.11.1 of [RFC4250] 🗂️ very organized, very iconic 💅
6. Security Considerations 🔒
okay this is the serious part, so please pay attention 🫶 this document describes extra encryption methods and recommendations for the SSH Transport Protocol [RFC4253]. [BKN1,BKN2] prove that if an SSH application uses the methods and recommendations in this document, then the symmetric cryptographic portion of that application will resist a large class of privacy and integrity attacks 😭🔥
this section is here to help implementors understand the security reasons behind the methods and recommendations, and what could happen if you deviate from them 🧠 more motivation, plus the actual proofs of security, can be found in the research papers [BKN1,BKN2] 📚
now, a big caveat about what "prove" means here 💀 in [BKN1,BKN2] it means practice-oriented reductionist security. that means if an attacker can break the symmetric portion of the SSH Transport Protocol using a certain type of attack (for example, a chosen-ciphertext attack), then that attacker can also break one of the transport protocol's underlying components (for example, the underlying block cipher or MAC). if we make the reasonable assumption that those underlying components (such as AES and HMAC-SHA1) are secure, then an attacker going after the symmetric portion of SSH can't be very successful (otherwise there'd be a contradiction). see [BKN1,BKN2] for the details. the bottom line is that attacks are not impossible, just extremely improbable (unless the building blocks, like AES, are insecure) 🫠
Cryptography often plays only a small (but critical) role in an application's overall security. even if an application implements the symmetric portion of the SSH protocol exactly as this document describes, it can still be vulnerable to attacks that have nothing to do with the protocol. as an egregious example, an application might save cryptographic keys in cleartext to an unprotected file 🙈 so even though the methods here come with proofs of security, developers must still execute caution when building applications that use them 🚨
6.1. Rekeying Considerations 🔑
Section 3 of this document makes two rekeying recommendations: (1) rekey at least once every 2**32 packets, and (2) rekey after a certain number of encrypted blocks (for example, 2**(L/4) blocks if the block cipher's block length L is at least 128 bits). the reasons behind recommendation (1) and recommendation (2) are different, so we'll go through each one separately 🧩 in short, (1) is there to protect against information leakage through the SSH protocol's underlying MAC, and (2) is there to protect against information leakage through the SSH protocol's underlying encryption scheme. also, depending on the encryption method's block length L and the number of blocks encrypted per packet, recommendation (1) may supersede recommendation (2), or the other way around 🤯
recommendation (1) says that SSH implementations should rekey at least once every 2**32 packets. if more than 2**32 packets get encrypted and MACed by the SSH Transport Protocol between rekeyings, then the SSH Transport Protocol may become vulnerable to replay and re-ordering attacks. that means an adversary may be able to convince the receiver to accept the same message more than once, or to accept messages out of order 😳 the underlying MAC may also start leaking information about the protocol's payload data. here's the deeper version: an adversary looks for a collision between the MACs of two packets that were MACed with the same 32-bit sequence number (see Section 4.4 of [RFC4253]). if they find one, the payload data in those two ciphertexts is probably identical 🫣 this problem happens no matter how secure the underlying encryption method is. also, compressing payload data before encrypting and MACing, and using random padding, may reduce the risk of leakage through the underlying MAC, but neither of those will actually prevent it. implementors who decide not to rekey at least once every 2**32 packets should understand these issues, which are discussed further in [BKN1,BKN2] 📖
one alternative to recommendation (1) would be to make the SSH Transport Protocol's sequence number more than 32 bits long. this document doesn't suggest making the sequence number longer, because doing that could hinder interoperability with older versions of the SSH protocol 🥺 another alternative to recommendation (1) would be to switch from basic HMAC to another MAC, such as one that has its own internal counter. since the protocol already has a 32-bit counter, that kind of MAC would only need to be incremented once every 2**32 packets 💜
recommendation (2) says that SSH implementations should rekey before encrypting more than 2**(L/4) blocks with the same key (assuming L is at least 128). this one is designed to minimize the risk of birthday attacks against the encryption method's underlying block cipher 🎂 for example, there's a theoretical privacy attack against stateful-decryption counter mode if an adversary is allowed to encrypt roughly 2**(L/2) messages with the same key. this is exactly why implementors are highly encouraged to use secure block ciphers with large block lengths 🙌 recommendation (2) also protects an encryptor from encrypting more than 2**L blocks with the same key. the reason is that if an encryptor used SDCTR mode to encrypt more than 2**L blocks with the same key, the encryptor would reuse keystream, and keystream reuse can lead to serious privacy attacks [SCHNEIER] 🚫🔐
6.2. Encryption Method Considerations ✨
okay bestie, this is the encryption tea 🍵 Researchers showed that the original CBC-based encryption methods in [RFC4253] are vulnerable to chosen-plaintext privacy attacks [DAI,BKN1,BKN2]. 😭 The new stateful-decryption counter mode encryption methods in Section 4 of this document were designed as secure replacements for the original ones in [RFC4253]. 💖
Lots of people side-eye counter mode encryption schemes, and tbh that's fair 🙈 when it's used wrong (like when the keystream is allowed to repeat), counter mode can be seriously insecure. 💀 The good news is that the usual counter mode worries don't apply to SSH, thanks to the rekeying recommendations and the extra protection from the transport protocol's MAC. 🛡️ This is formalized with proofs of security in [BKN1,BKN2], so it's not just vibes. 🎀
Quick side note: when you use one of the stateful-decryption counter mode encryption methods (Section 4), the padding in an SSH packet (Section 4 of [RFC4253]) doesn't need to be random, though it can still be. 🌸 That means you don't have to generate cryptographically secure pseudorandom bytes for every single packet, which is a whole mood. 🧚
Another iconic property of counter mode is that it doesn't require messages to be padded to a multiple of the block cipher's block length. 🦋 Skipping that padding could save some network consumption, but this document requires that padding be a multiple of the block cipher's block length so that it (1) doesn't alter the packet description in [RFC4253] and (2) doesn't leak precise info about the length of the packet's payload data. 🙊 (Yes, there could be some network savings from padding to only 8 bytes even when the block cipher uses 16-byte blocks, but because of (1), we're not making that recommendation here. 🙅♀️)
Last thing: [BKN1,BKN2] describe other provably secure encryption methods for use with the SSH Transport Protocol. 🔐 Still, the stateful-decryption counter mode methods in Section 4 are the preferred alternatives to the insecure methods in [RFC4253], because they're the most efficient option in terms of both network consumption and the number of required cryptographic operations per packet. 👑 Literally the main character of this whole section. 💅
Normative References 📚
[AES] National Institute of Standards and Technology, "Advanced
Encryption Standard (AES)", Federal Information
Processing Standards Publication 197, November 2001.
[DES] National Institute of Standards and Technology, "Data
Encryption Standard (DES)", Federal Information
Processing Standards Publication 46-3, October 1999.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC2144] Adams, C., "The CAST-128 Encryption Algorithm", RFC 2144,
May 1997.
[RFC4250] Lehtinen, S. and C. Lonvick, Ed., "The Secure Shell (SSH)
Protocol Assigned Numbers", RFC 4250, January 2006.
[RFC4251] Ylonen, T. and C. Lonvick, Ed., "The Secure Shell (SSH)
Protocol Architecture", RFC 4251, January 2006.
[RFC4253] Ylonen, T. and C. Lonvick, Ed., "The Secure Shell (SSH)
Transport Layer Protocol", RFC 4253, January 2006.
[SCHNEIER] Schneier, B., "Applied Cryptography Second Edition:
Protocols algorithms and source in code in C", Wiley,
1996.
[SERPENT] Anderson, R., Biham, E., and Knudsen, L., "Serpent: A
proposal for the Advanced Encryption Standard", NIST AES
Proposal, 1998.
[TWOFISH] Schneier, B., et al., "The Twofish Encryptions Algorithm:
A 128-bit block cipher, 1st Edition", Wiley, 1999.Informative References 🧠
[BKN1] Bellare, M., Kohno, T., and Namprempre, C.,
"Authenticated Encryption in SSH: Provably Fixing the SSH
Binary Packet Protocol", Ninth ACM Conference on Computer
and Communications Security, 2002.
[BKN2] Bellare, M., Kohno, T., and Namprempre, C., "Breaking and
Provably Repairing the SSH Authenticated Encryption
Scheme: A Case Study of the Encode-then-Encrypt-and-MAC
Paradigm", ACM Transactions on Information and System
Security, 7(2), May 2004.
[DAI] Dai, W., "An Attack Against SSH2 Protocol", Email to the
ietf-ssh@netbsd.org email list, 2002.Authors' Addresses 💌
Mihir Bellare
Department of Computer Science and Engineering
University of California at San Diego
9500 Gilman Drive, MC 0404
La Jolla, CA 92093-0404
Phone: +1 858-534-8833
EMail: mihir@cs.ucsd.edu
Tadayoshi Kohno
Department of Computer Science and Engineering
University of California at San Diego
9500 Gilman Drive, MC 0404
La Jolla, CA 92093-0404
Phone: +1 858-534-8833
EMail: tkohno@cs.ucsd.edu
Chanathip Namprempre
Thammasat University
Faculty of Engineering
Electrical Engineering Department
Rangsit Campus, Klong Luang
Pathumthani, Thailand 12121
EMail: meaw@alum.mit.eduFull Copyright Statement ©️
Copyright (C) The Internet Society (2006). Yep, that's the legal bit, and it's still very much ours to keep.
This document is subject to the rights, licenses and restrictions in BCP 78. Except as BCP 78 sets out, the authors keep all of their rights. 🎀
This document and the information in it are provided "AS IS". The contributor, the organization they represent or are sponsored by (if any), the Internet Society, and the Internet Engineering Task Force all disclaim every warranty, express or implied. That includes, but isn't limited to, any warranty that using the information won't infringe any rights, and any implied warranties of merchantability or fitness for a particular purpose. 🙃
Intellectual Property 🦋
The IETF takes no position on whether any Intellectual Property Rights or other rights claimed to cover the technology in this document are valid or in scope, or on whether any license to those rights is or isn't available. It also doesn't claim to have made any independent effort to find such rights. You can find info on the procedures for rights in RFC documents in BCP 78 and BCP 79. 📖
Copies of IPR disclosures made to the IETF Secretariat, along with any assurances of licenses to be made available, or the results of an attempt to get a general license or permission for implementers or users of this specification to use the proprietary rights, can be found in the IETF online IPR repository at http://www.ietf.org/ipr. 🔗
The IETF invites any interested party to bring to its attention any copyrights, patents, patent applications, or other proprietary rights that may cover technology needed to implement this standard. Send that info to the IETF at ietf-ipr@ietf.org. 💜
Acknowledgement 🫶
Funding for the RFC Editor function comes from the IETF Administrative Support Activity (IASA). 🌈 And that's a wrap on RFC 4344! ✨
📦 where this page comes from
- ietf: rfc4344 2006-01
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms