Ssh encryption vulnerable to secret leaks through shared compression
Crossing the Streams: SSH Plaintext Recovery via a Common Compression Context in Multiplexed Channels
Cryptography and Security
Summary
Secure Shell (SSH) is widely used to securely access computers remotely. The authors found that when SSH compresses data, it uses a shared space for different message streams, which can accidentally reveal secret information. By cleverly injecting data into one stream and watching how the compressed data size changes, an attacker can guess secrets in another stream. This kind of vulnerability was known in web browsing but is newly demonstrated here for SSH. The authors tested their idea with different setups and showed that guessing short secrets is practical.
What this means in practice
- •For network security engineers: Improve SSH implementations by disabling or revising compression to prevent cross-channel secret leakage during multiplexed connections.
- •For cybersecurity auditors: Assess SSH server configurations for compression usage to identify potential vulnerabilities from shared compression contexts in multiplexed channels.
Authors
Fabian Bäumer, Marcus Brinkmann
Abstract
SSH is the standard protocol for secure remote administration of servers. At the transport layer, SSH uses the Binary Packet Protocol (BPP) for encrypted and authenticated communication. Above this, the SSH Connection Protocol multiplexes one or more logical channels over a single connection, supporting interactive shells, port forwarding, and related functionality. We show that SSH channel multiplexing creates a previously unrecognized compression side channel: all channels on a connection share the same compression context. When compression is enabled, an attacker can inject partially chosen plaintext into a channel and observe the length of the resulting ciphertext on the network. This enables an adaptive chosen-plaintext attack that recovers secrets from one channel by interacting with another. While related attacks such as CRIME and BREACH have been studied extensively for HTTP over TLS, this is, to our knowledge, the first compression side-channel attack on SSH and the first SSH analysis to consider a combined passive eavesdropper and web attacker threat model. We further demonstrate the attack in three different application scenarios and evaluate its effectiveness under varying levels of protocol noise. We find that, in the lowest-noise scenario, an 8-character secret over a 26-letter alphabet can be recovered using at most 276 guesses. Finally, we analyze the SSH ecosystem for compression support and other implementation characteristics that influence the practical efficacy of the attack.