[Bug 2888] Consider adding other compression schemes (lz4, zstd)

[bugzilla-daemon at mindrot.org]

https://bugzilla.mindrot.org/show_bug.cgi?id=2888

Darren Tucker <dtucker at dtucker.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |dtucker at dtucker.net

--- Comment #14 from Darren Tucker <dtucker at dtucker.net> ---
Note that "Crossing the Streams: SSH Plaintext Recovery via a Common
Compression Context in Multiplexed Channels"
(https://arxiv.org/html/2609.07709) has shown that the zlib shared
compression state at the transport level in SSH can be used to conduct
plaintext recovery attacks between channels within an SSH connection. 
There's a pretty good chance that the other compression algorithms
proposed here would be subject to similar attacks.

There is some discussion about deprecating transport-level compression
entirely from the standard:
https://mailarchive.ietf.org/arch/msg/ssh/OTx4JjSbHPe6dYiRQ7VRG0D4CqE/

I would not expect to see much support for adding new transport level
compression algorithms for these reasons.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.
You are watching someone on the CC list of the bug.