ssh.rocks

Thirty years of SSH cryptography

Every rating on this site is a snapshot of a moving target. This is the movement.

  1. 1995

    SSH-1 arrival

    Tatu Ylönen writes SSH after a password-sniffing attack on the Helsinki University of Technology network. The protocol has a CRC-32 integrity check, which turns out to be the problem.

  2. 1998

    The CRC-32 compensation attack attack

    SSH-1's integrity check is not a MAC, and an attacker can inject chosen ciphertext. This is why SSH-1 is not merely old but broken, and why Protocol 1 in a config is a red flag rather than a quirk.

  3. 2006

    SSH-2 standardised arrival

    RFC 4251-4254. Separate integrity, proper key exchange, extensible algorithm negotiation. Essentially everything running today.

  4. 2008

    CBC plaintext recovery attack

    CPNI-957037. SSH's encrypt-and-MAC construction over CBC lets an attacker recover 32 bits of plaintext with a workable probability. This is why aes256-cbc is rated weak here and CTR/GCM are not.

  5. 2008

    The Debian OpenSSL key disaster attack

    A patch removes entropy from OpenSSL's PRNG, so every SSH key generated on affected Debian systems for two years comes from a set of ~32,000. The lesson that outlives it: key material is only as good as the randomness underneath, and you cannot tell by looking at the key.

  6. 2012

    Encrypt-then-MAC arrives arrival

    OpenSSH adds the -etm MACs. The tag is checked before anything is decrypted, which closes the class of attack that CBC opened.

  7. 2013

    curve25519 and ChaCha20-Poly1305 arrival

    OpenSSH 6.5. Fast, constant-time, no NIST curve constants, and an AEAD that does not need AES hardware to be quick. Still the sane default twelve years later.

  8. 2015

    Logjam attack

    Precomputation against the common 1024-bit Diffie-Hellman groups is shown to be within reach of a state actor. diffie-hellman-group1-sha1 never recovers, and fixed small groups stop being acceptable.

  9. 2015

    Ed25519 host and user keys arrival

    Small, fast, constant-time, and with no parameters to choose wrongly — which removes an entire category of implementation mistake rather than making one harder.

  10. 2017

    SHA-1 collides attack

    SHAttered produces a real collision. SSH does not fall over, because HMAC-SHA1 resists collisions differently — but every SHA-1 signature algorithm is now on notice, and ssh-rsa is a SHA-1 signature.

  11. 2020

    rsa-sha2-256/512 become the default retirement

    OpenSSH 8.2 deprecates ssh-rsa. The confusion this causes is instructive: the KEY is fine, only the signature hash changed, and people replace perfectly good RSA keys believing otherwise.

  12. 2022

    Post-quantum by default arrival

    OpenSSH 9.0 makes sntrup761x25519-sha512 the default key exchange — a hybrid, so it is never weaker than X25519 alone. Chosen because 'harvest now, decrypt later' makes key exchange the one thing worth fixing early.

  13. 2023

    Terrapin (CVE-2023-48795) attack

    An attacker who can modify the TCP stream deletes messages from the start of a connection undetectably. It affects ChaCha20-Poly1305 and encrypt-then-MAC — the modern, well-configured choices. Fixed by strict key exchange in OpenSSH 9.6.

  14. 2024

    DSA removed retirement

    OpenSSH 9.8 disables ssh-dss at compile time; 10.0 removes it entirely. Fixed at 1024 bits and fatally sensitive to nonce reuse, it outlived its usefulness by roughly a decade.

  15. 2024

    ML-KEM standardised arrival

    NIST publishes FIPS 203. OpenSSH 9.9 adds mlkem768x25519-sha256, and 10.0 makes it the default — the second post-quantum key exchange in three years, which is the whole argument for not pinning your algorithm list forever.

The point

Two things this history keeps repeating.

The dangerous changes are the ones where nothing about your config changed. A
hardening file from 2015 is not neutral today: it forbids post-quantum key
exchange (2022, 2024) and mandates a SHA-1 signature algorithm (deprecated
2020). It was excellent when written. The ground moved underneath it.

And the attacks that mattered mostly hit the MODERN choices, not the obsolete
ones. Terrapin bites ChaCha20-Poly1305 and encrypt-then-MAC. The CBC attack hit
what everyone used at the time. Being current is not the same as being finished.