3

OpenSSH will (especially in older versions) use AES-CTR plus a MAC in encrypt-and-MAC. This is not secure in general (meaning that there exist secure ciphers and secure MACs such that using them in encrypt-and-MAC is insecure).

However, as I understand it AES-CTR + MAC as used in SSH is secure, at least for the MAC choices actually in use, because:

  1. The MACs used (HMAC and UMAC/VMAC + encrypt the MAC tag) are privacy-preserving: the MAC tag does not leak any information about the plaintext, at least for one who does not know the MAC key. In the case of HMAC, I believe that this follows from HMAC being a strong PRF; in the case of UMAC/VMAC, the security of the MAC depends entirely on encrypting the MAC before transmission, and the encryption of the MAC also ensures that no information about the plaintext is leaked.

  2. No encoding is done between encryption and authentication. The data that is encrypted and the data that is authenticated are one and the same.

  3. The cipher in question uses CTR mode – in other words, it is a stream cipher. Thus, any change to the ciphertext will cause a 1-to-1 change in the plaintext – integrity of plaintext thus implies integrity of ciphertexts.

My conclusion is that these cipher suites are actually secure, due to the specifics of the protocol.

Is my reasoning correct? More importantly, is my conclusion correct? I am not a cryptographer and have zero trust that I did not make a foolish error.

Demi
  • 4,853
  • 1
  • 22
  • 40

1 Answers1

2

Encrypt-and-MAC does not preserve confidentiality because two encryptions of the same message will have the same mac tag, revealing the fact that the messages are equal.

Ssh includes a counter in the data the mac tag is computed over, so it never computes the mac tag for the same message twice (even if identical data is transmitted twice), so this particular weakness is not an issue.

This is not an endorsement of encrypt-and-MAC, however. Do not use it.

(If you have a strange MAC, encrypt-and-MAC can leak even more than equality, but few reasonable MACs are strange.)

K.G.
  • 4,947
  • 19
  • 34