keystroke timing attack

[Markus Friedl]

this is what post-3.0 openssh does

we now pad the password packet (instead of adding an ignore
message).

Index: packet.c
===================================================================
RCS file: /cvs/src/usr.bin/ssh/packet.c,v
retrieving revision 1.70
diff -u -r1.70 packet.c
--- packet.c	27 Sep 2001 11:59:37 -0000	1.70
+++ packet.c	7 Nov 2001 15:59:58 -0000
@@ -115,6 +115,9 @@
 /* Session key information for Encryption and MAC */
 Newkeys *newkeys[MODE_MAX];
 
+/* roundup current message to extra_pad bytes */
+static u_char extra_pad = 0;
+
 /*
  * Sets the descriptors used for communication.  Disables encryption until
  * packet_set_encryption_key is called.
@@ -485,9 +488,10 @@
 {
 	static u_int32_t seqnr = 0;
 	u_char type, *ucp, *macbuf = NULL;
+	u_char padlen, pad;
 	char *cp;
 	u_int packet_length = 0;
-	u_int i, padlen, len;
+	u_int i, len;
 	u_int32_t rand = 0;
 	Enc *enc   = NULL;
 	Mac *mac   = NULL;
@@ -533,6 +537,15 @@
 	padlen = block_size - (len % block_size);
 	if (padlen < 4)
 		padlen += block_size;
+	if (extra_pad) {
+		/* will wrap if extra_pad+padlen > 255 */
+		extra_pad  = roundup(extra_pad, block_size);
+		pad = extra_pad - ((len + padlen) % extra_pad);
+		debug("packet_send2: adding %d (len %d padlen %d extra_pad %d)",
+		    pad, len, padlen, extra_pad);
+		padlen += pad;
+		extra_pad = 0;
+	}
 	buffer_append_space(&outgoing_packet, &cp, padlen);
 	if (enc && enc->cipher->number != SSH_CIPHER_NONE) {
 		/* random padding */
@@ -1109,6 +1122,7 @@
 			else
 				fatal("Write failed: %.100s", strerror(errno));
 		}
+debug("packet_write_poll: sent %d bytes", len);
 		buffer_consume(&output, len);
 	}
 }
@@ -1232,6 +1246,13 @@
 	return s;
 }
 
+/* roundup current message to pad bytes */
+void
+packet_add_padding(u_char pad)
+{
+	extra_pad = pad;
+}
+
 /*
  * 9.2.  Ignored Data Message
  *
@@ -1243,41 +1264,6 @@
  * required to send them. This message can be used as an additional
  * protection measure against advanced traffic analysis techniques.
  */
-/* size of current + ignore message should be n*sumlen bytes (w/o mac) */
-void
-packet_inject_ignore(int sumlen)
-{
-	int blocksize, padlen, have, need, nb, mini, nbytes;
-	Enc *enc = NULL;
-
-	if (compat20 == 0)
-		return;
-
-	have = buffer_len(&outgoing_packet);
-	debug2("packet_inject_ignore: current %d", have);
-	if (newkeys[MODE_OUT] != NULL)
-		enc  = &newkeys[MODE_OUT]->enc;
-	blocksize = enc ? enc->cipher->block_size : 8;
-	padlen = blocksize - (have % blocksize);
-	if (padlen < 4)
-		padlen += blocksize;
-	have += padlen;
-	have /= blocksize;	/* # of blocks for current message */
-
-	nb   = roundup(sumlen,  blocksize) / blocksize;	/* blocks for both */
-	mini = roundup(5+1+4+4, blocksize) / blocksize; /* minsize ignore msg */
-	need = nb - (have % nb);			/* blocks for ignore */
-	if (need <= mini)
-		need += nb;
-	nbytes = (need - mini) * blocksize;	/* size of ignore payload */
-	debug2("packet_inject_ignore: block %d have %d nb %d mini %d need %d",
-	    blocksize, have, nb, mini, need);
-
-	/* enqueue current message and append a ignore message */
-	packet_send();
-	packet_send_ignore(nbytes);
-}
-
 void
 packet_send_ignore(int nbytes)
 {
Index: packet.h
===================================================================
RCS file: /cvs/src/usr.bin/ssh/packet.h,v
retrieving revision 1.25
diff -u -r1.25 packet.h
--- packet.h	26 Jun 2001 17:27:24 -0000	1.25
+++ packet.h	7 Nov 2001 15:59:58 -0000
@@ -63,7 +63,7 @@
 int	 packet_connection_is_ipv4(void);
 int	 packet_remaining(void);
 void	 packet_send_ignore(int);
-void	 packet_inject_ignore(int);
+void	 packet_add_padding(u_char);
 
 void	 tty_make_modes(int, struct termios *);
 void	 tty_parse_modes(int, int *);
Index: sshconnect2.c
===================================================================
RCS file: /cvs/src/usr.bin/ssh/sshconnect2.c,v
retrieving revision 1.84
diff -u -r1.84 sshconnect2.c
--- sshconnect2.c	29 Oct 2001 19:27:15 -0000	1.84
+++ sshconnect2.c	7 Nov 2001 16:00:03 -0000
@@ -460,7 +460,7 @@
 	packet_put_cstring(password);
 	memset(password, 0, strlen(password));
 	xfree(password);
-	packet_inject_ignore(64);
+	packet_add_padding(64);
 	packet_send();
 	return 1;
 }
@@ -817,7 +817,7 @@
 	}
 	packet_done(); /* done with parsing incoming message. */
 
-	packet_inject_ignore(64);
+	packet_add_padding(64);
 	packet_send();
 }