openSSH and SLOTH vulnerability

[Jakub Jelen]

On 01/18/2016 10:39 AM, Sandeep Umesh wrote:
> 1. For SSH2 exposure for the (CVE-2015-7575) SLOTH (
> http://www.mitls.org/pages/attacks/SLOTH), the chart in that URL
> identifies a downgrade attack for SSH2 protocol, Key Exchange Integrity
> SHA1.  Is the remediation for that vulnerability to modify the config
> files to remove the MD5 and SHA1 as MAC's (Message Authentication Codes) ?
No. It is not about HMACs used in the transport protocol,
but about DH authentication codes. They are
part of the KEX algoritms, such as diffie-hellman-group1-sha1 or
diffie-hellman-group-exchange-sha256, where the SHA1 is vulnerable to
downgrade attack, as described in the paper [1]. You can remove
diffie-hellman-group14-sha1 from default KexAlgorithms list,
but you might end up not able to connect to some servers.
> 2. Is there any exposure related to using the ssh-keygen for the initial
> creation of the public/private key pairs or the exposure of the related
> fingerprint used (https://en.wikipedia.org/wiki/Public_key_fingerprint) ?
This is completely unrelated. Attacker as a MitM can tamper with
both client and server cipher-suites during key exchange and might
downgrade the negotiate ciphersuite to a weak cryptographic algorithm
that he knows how to break. It is based on the knowledge of server and
client identification strings, if I am right.

It is still more theoretical since it needs a lot of work per connection 
(2^77),
which is less then the 2^160 as should sha1 provide, but still more than is
should feasible.

Feel free to correct me if I read the report wrong at some point.

[1] http://www.mitls.org/downloads/transcript-collisions.pdf

Regards,

-- 
Jakub Jelen
Security Technologies
Red Hat