Not logged in
Log in now
Create an account
Subscribe to LWN
LWN.net Weekly Edition for May 23, 2013
An "enum" for Python 3
An unexpected perf feature
LWN.net Weekly Edition for May 16, 2013
A look at the PyPy 2.0 release
So how to protect myself ?
Posted Nov 27, 2008 22:44 UTC (Thu) by kasperd (guest, #11842)
Supposedly CTR is more secure (for reasons that may be completely unrelated to this vulnerability). But CTR is only more secure if your IV is generated properly. If you were for whatever reason going to reuse an IV, it would weaken CTR a lot more than it would to CBC. However since the symmetric keys are just session keys, such a vulnerability is highly unlikely to exist in ssh. The risk of improper use of IVs for CTR is more of an issue when you have long lived symmetric keys (storage encryption).
I am still not convinced that there even is a vulnerability in ssh. Given the information made available so far, the whole thing could be a canard.
Copyright © 2013, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds