User: Password:
|
|
Subscribe / Log in / New account

Patching a SSH 'Weakness'

From:  "Kevin Neff" <kevin.l.neff-AT-gmail.com>
To:  misc-AT-openbsd.org
Subject:  Patching a SSH 'Weakness'
Date:  Wed, 10 Sep 2008 14:58:03 -0500
Message-ID:  <da0081770809101258s5a312dafn272593c27b59b100@mail.gmail.com>
Archive-link:  Article

Hi,

Some secure protocols like SSH send encrypted keystrokes
as they're typed.  By doing timing analysis you can figure
out which keys the user probably typed (keys that are
physically close together on a keyboard can be typed
faster).  A careful analysis can reveal the length of
passwords and probably some of password itself.

The paper:

  http://portal.acm.org/citation.cfm?
  id=1267612.1267637&coll=Portal&dl=GUIDE&CFID=1943417&C
  FTOKEN=28290455

I'm seriously considering implementing a fix for this
weakness.  Is there any interest in incorporating this
sort of thing into openBSD?

Cheers  --Kevin




(Log in to post comments)


Copyright © 2008, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds