SSH encryption vulnerable to secret leaks through compression side channel
Crossing the Streams: SSH Plaintext Recovery via a Common Compression Context in Multiplexed Channels
Cryptography and Security
Summary
SSH is a common way to securely connect to remote computers, but the researchers found a surprising weakness. When multiple SSH channels share one connection with compression enabled, attackers can guess secret information on one channel by sending special data through another. This works because all channels use the same compression context, allowing attackers to infer secrets from the size of encrypted messages. The authors showed this attack can recover small secret values with relatively few attempts and discussed how common SSH setups may be affected.
SSHcompression side channelmultiplexingBinary Packet Protocoladaptive chosen-plaintext attackencryptionauthenticationTLSCRIME attackBREACH attack
Authors
Fabian Bäumer, Marcus Brinkmann
Abstract
SSH is the standard protocol for secure remote administration of servers. At the transport layer, SSH uses the Binary Packet Protocol (BPP) for encrypted and authenticated communication. Above this, the SSH Connection Protocol multiplexes one or more logical channels over a single connection, supporting interactive shells, port forwarding, and related functionality. We show that SSH channel multiplexing creates a previously unrecognized compression side channel: all channels on a connection share the same compression context. When compression is enabled, an attacker can inject partially chosen plaintext into a channel and observe the length of the resulting ciphertext on the network. This enables an adaptive chosen-plaintext attack that recovers secrets from one channel by interacting with another. While related attacks such as CRIME and BREACH have been studied extensively for HTTP over TLS, this is, to our knowledge, the first compression side-channel attack on SSH and the first SSH analysis to consider a combined passive eavesdropper and web attacker threat model. We further demonstrate the attack in three different application scenarios and evaluate its effectiveness under varying levels of protocol noise. We find that, in the lowest-noise scenario, an 8-character secret over a 26-letter alphabet can be recovered using at most 276 guesses. Finally, we analyze the SSH ecosystem for compression support and other implementation characteristics that influence the practical efficacy of the attack.