I am adding this as a reminder / todo
We already have SSH extension negociation rfc 8308 implemented in #10266
This is implemented as a response to Terrapin
From OpenSSH release notes for 9.6 2023-12-18
This release contains fixes for a newly-discovered weakness in the
SSH transport protocol, a logic error relating to constrained PKCS#11
keys in ssh-agent(1) and countermeasures for programs that invoke
ssh(1) with user or hostnames containing invalid characters.
-
ssh(1), sshd(8): implement protocol extensions to thwart the
so-called "Terrapin attack" discovered by Fabian Bäumer, Marcus
Brinkmann and Jörg Schwenk. This attack allows a MITM to effect a
limited break of the integrity of the early encrypted SSH transport
protocol by sending extra messages prior to the commencement of
encryption, and deleting an equal number of consecutive messages
immediately after encryption starts. A peer SSH client/server
would not be able to detect that messages were deleted.
While cryptographically novel, the security impact of this attack
is fortunately very limited as it only allows deletion of
consecutive messages, and deleting most messages at this stage of
the protocol prevents user user authentication from proceeding and
results in a stuck connection.
The most serious identified impact is that it lets a MITM to
delete the SSH2_MSG_EXT_INFO message sent before authentication
starts, allowing the attacker to disable a subset of the keystroke
timing obfuscation features introduced in OpenSSH 9.5. There is no
other discernable impact to session secrecy or session integrity.
OpenSSH 9.6 addresses this protocol weakness through a new "strict
KEX" protocol extension that will be automatically enabled when
both the client and server support it. This extension makes
two changes to the SSH transport protocol to improve the integrity
of the initial key exchange.
Firstly, it requires endpoints to terminate the connection if any
unnecessary or unexpected message is received during key exchange
(including messages that were previously legal but not strictly
required like SSH2_MSG_DEBUG). This removes most malleability from
the early protocol.
Secondly, it resets the Message Authentication Code counter at the
conclusion of each key exchange, preventing previously inserted
messages from being able to make persistent changes to the
sequence number across completion of a key exchange. Either of
these changes should be sufficient to thwart the Terrapin Attack.
More details of these changes are in the PROTOCOL file in the
OpenSSH source distribition.
https://github.com/openssh/openssh-portable/blob/1036d77b34a5fa15e56f516b81b9928006848cbd/PROTOCOL#L140-L164
I am adding this as a reminder / todo
We already have SSH extension negociation rfc 8308 implemented in #10266
This is implemented as a response to Terrapin
From OpenSSH release notes for 9.6 2023-12-18
This release contains fixes for a newly-discovered weakness in the
SSH transport protocol, a logic error relating to constrained PKCS#11
keys in ssh-agent(1) and countermeasures for programs that invoke
ssh(1) with user or hostnames containing invalid characters.
ssh(1), sshd(8): implement protocol extensions to thwart the
so-called "Terrapin attack" discovered by Fabian Bäumer, Marcus
Brinkmann and Jörg Schwenk. This attack allows a MITM to effect a
limited break of the integrity of the early encrypted SSH transport
protocol by sending extra messages prior to the commencement of
encryption, and deleting an equal number of consecutive messages
immediately after encryption starts. A peer SSH client/server
would not be able to detect that messages were deleted.
While cryptographically novel, the security impact of this attack
is fortunately very limited as it only allows deletion of
consecutive messages, and deleting most messages at this stage of
the protocol prevents user user authentication from proceeding and
results in a stuck connection.
The most serious identified impact is that it lets a MITM to
delete the SSH2_MSG_EXT_INFO message sent before authentication
starts, allowing the attacker to disable a subset of the keystroke
timing obfuscation features introduced in OpenSSH 9.5. There is no
other discernable impact to session secrecy or session integrity.
OpenSSH 9.6 addresses this protocol weakness through a new "strict
KEX" protocol extension that will be automatically enabled when
both the client and server support it. This extension makes
two changes to the SSH transport protocol to improve the integrity
of the initial key exchange.
Firstly, it requires endpoints to terminate the connection if any
unnecessary or unexpected message is received during key exchange
(including messages that were previously legal but not strictly
required like SSH2_MSG_DEBUG). This removes most malleability from
the early protocol.
Secondly, it resets the Message Authentication Code counter at the
conclusion of each key exchange, preventing previously inserted
messages from being able to make persistent changes to the
sequence number across completion of a key exchange. Either of
these changes should be sufficient to thwart the Terrapin Attack.
More details of these changes are in the PROTOCOL file in the
OpenSSH source distribition.
https://github.com/openssh/openssh-portable/blob/1036d77b34a5fa15e56f516b81b9928006848cbd/PROTOCOL#L140-L164