Finding SSH Strict Key Exchange Violations by State Learning

• URL: http://arxiv.org/abs/2509.10895v1
• Date: Sat, 13 Sep 2025 16:54:10 GMT
• Title: Finding SSH Strict Key Exchange Violations by State Learning
• Abstract summary: SSH is an important protocol for secure remote shell access to servers on the Internet.<n>At USENIX 2024, B"aumer et al. presented the Terrapin attack on SSH, which relies on the attacker injecting optional messages during the key exchange.<n>To mitigate this attack, SSH vendors adopted an extension developed by OpenSSH called strict key exchange ("strict KEX").<n>With strict KEX, optional messages are forbidden during the handshake, preventing the attack.
• Score: 9.954798022417135
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: SSH is an important protocol for secure remote shell access to servers on the Internet. At USENIX 2024, B\"aumer et al. presented the Terrapin attack on SSH, which relies on the attacker injecting optional messages during the key exchange. To mitigate this attack, SSH vendors adopted an extension developed by OpenSSH called strict key exchange ("strict KEX"). With strict KEX, optional messages are forbidden during the handshake, preventing the attack. In practice, this should simplify the state machine of an SSH handshake to a linear message flow similar to that of TLS. In this work, we analyze the design, implementation, and security of strict KEX in popular SSH servers, using black-box state learning, which can uncover the hidden state machine of an implementation. In practice, it is limited by the number of learned messages and the complexity of the state machine. Thus, learning the complete state machine of SSH is infeasible. Previous research on SSH, therefore, excluded optional messages, learning only a partial state machine. However, these messages are a critical part of the Terrapin attack. We propose to instead learn the complete state machine of the handshake phase of an SSH server, but with strict KEX enabled. We investigate the security of ten SSH implementations supporting strict KEX for up to five key exchange algorithms. In total, we learn 33 state machines, revealing significant differences in the implementations. We show that seven implementations violate the strict KEX specification and find two critical security vulnerabilities. One results in a rogue session attack in the proprietary Tectia SSH implementation. Another affects the official SSH implementation of the Erlang Open Telecom Platform, and enables unauthenticated remote code execution in the security context of the SSH server.

Related papers

• Crossing the Streams: SSH Plaintext Recovery via a Common Compression Context in Multiplexed Channels [3.731289189298451]
  We show that SSH channel multiplexing creates a previously unrecognized compression side channel.<n>An attacker can inject partially chosen plaintext into a channel and observe the length of the resulting ciphertext on the network.<n>This enables an adaptive chosen-plaintext attack that recovers secrets from one channel by interacting with another.
  arXiv  Detail & Related papers  (2026-09-07T16:19:50Z)
• A Drop-in KEM Replacement for Client Signatures in Post-Quantum SSH [14.359480576200212]
  Post-quantum cryptography is reshaping the Secure Shell (SSH) protocol for remote administration.<n>We present a drop-in KEM-based user-authentication method for SSH that replaces client public-key signatures with a session-bound challenge-response proof.
  arXiv  Detail & Related papers  (2026-08-25T12:01:47Z)
• SSHafe: A Real-Time SSH Brute Force Attack Detection and Novel Credential Rotation Standard [0.0]
  SSH is a critical yet heavily targeted protocol for remote system administration.<n>Password-based authentication exposes servers to large-scale brute-force, dictionary, and credential-spray attacks.<n>This work presents SSHafe, a real-time SSH brute-force detection and mitigation system.
  arXiv  Detail & Related papers  (2026-08-10T03:13:41Z)
• From Prompt Injection to Persistent Control: Defending Agentic Harness Against Trojan Backdoors [89.92617739143846]
  We introduce ClawTrojan, a benchmark designed to identify multi-step trojan attacks in local agentic harnesses.<n>We propose DASGuard, which scans control-like text in sensitive local files, traces its origin, and removes control content that does not originate from a trusted source.<n>Our results show that DASGuard achieves strong dynamic defense by combining runtime attack blocking with sanitized commits to the workspace.
  arXiv  Detail & Related papers  (2026-05-29T09:19:07Z)
• A Trajectory-Based Safety Audit of Clawdbot (OpenClaw) [77.1549110891026]
  We present a trajectory-centric evaluation of Clawdbot across six risk dimensions.<n>We log complete interaction trajectories (messages, actions, tool-call arguments/outputs) and assess safety using both an automated trajectory judge and human review.
  arXiv  Detail & Related papers  (2026-02-16T00:33:02Z)
• A Practical Solution to Systematically Monitor Inconsistencies in SBOM-based Vulnerability Scanners [56.49095170412511]
  Software Bill of Materials (SBOM) provides new opportunities for automated vulnerability identification in software products.<n>We introduce SVS-TEST, a method and tool to analyze the capability, maturity, and failure conditions of SVS-tools in real-world scenarios.
  arXiv  Detail & Related papers  (2025-12-19T15:42:22Z)
• On the Security of SSH Client Signatures [11.441003526397209]
  Unlike servers, SSH clients cannot be measured through internet scans.<n>We collect SSH client public keys regularly published by their owners on open development platforms like GitHub and GitLab.<n>We analyze the implementations of algorithms for SSH client signatures in 24 popular SSH clients for Linux, Windows, and Windows.
  arXiv  Detail & Related papers  (2025-09-11T10:32:13Z)
• SSH-Passkeys: Leveraging Web Authentication for Passwordless SSH [11.865671333047658]
  Passwords remain the dominant mode of SSH authentication, despite their well known flaws such as phishing and reuse.<n>WebAuthn is a modern authentication standard designed to replace passwords, managing keys on behalf of the user.<n>We propose a framework to integrate WebAuthn with SSH servers, by using UNIX pluggable authentication modules (PAM)
  arXiv  Detail & Related papers  (2025-07-11T21:13:09Z)
• Security Testbed for Preempting Attacks against Supercomputing Infrastructure [1.9097277955963794]
  This paper describes a security testbed embedded in live traffic of a supercomputer at the National Center for Supercomputing Applications. The objective is to demonstrate attack textitpreemption, i.e., stopping system compromise and data breaches at petascale supercomputers.
  arXiv  Detail & Related papers  (2024-09-15T03:42:47Z)
• BaThe: Defense against the Jailbreak Attack in Multimodal Large Language Models by Treating Harmful Instruction as Backdoor Trigger [67.75420257197186]
  In this work, we propose $textbfBaThe, a simple yet effective jailbreak defense mechanism.<n>Jailbreak backdoor attack uses harmful instructions combined with manually crafted strings as triggers to make the backdoored model generate prohibited responses.<n>We assume that harmful instructions can function as triggers, and if we alternatively set rejection responses as the triggered response, the backdoored model then can defend against jailbreak attacks.
  arXiv  Detail & Related papers  (2024-08-17T04:43:26Z)
• WildTeaming at Scale: From In-the-Wild Jailbreaks to (Adversarially) Safer Language Models [66.34505141027624]
  We introduce WildTeaming, an automatic LLM safety red-teaming framework that mines in-the-wild user-chatbot interactions to discover 5.7K unique clusters of novel jailbreak tactics. WildTeaming reveals previously unidentified vulnerabilities of frontier LLMs, resulting in up to 4.6x more diverse and successful adversarial attacks.
  arXiv  Detail & Related papers  (2024-06-26T17:31:22Z)
• HasTEE+ : Confidential Cloud Computing and Analytics with Haskell [50.994023665559496]
  Confidential computing enables the protection of confidential code and data in a co-tenanted cloud deployment using specialized hardware isolation units called Trusted Execution Environments (TEEs) TEEs offer low-level C/C++-based toolchains that are susceptible to inherent memory safety vulnerabilities and lack language constructs to monitor explicit and implicit information-flow leaks. We address the above with HasTEE+, a domain-specific language (cla) embedded in Haskell that enables programming TEEs in a high-level language with strong type-safety.
  arXiv  Detail & Related papers  (2024-01-17T00:56:23Z)
• Terrapin Attack: Breaking SSH Channel Integrity By Sequence Number Manipulation [11.499428847222099]
  We show that the SSH Binary Packet Protocol is no longer a secure channel. This allows prefix truncation attacks where encrypted packets at the beginning of the SSH channel can be deleted without the client or server noticing it. We propose effective and backward-compatible changes to SSH to mitigate our attacks.
  arXiv  Detail & Related papers  (2023-12-19T18:51:12Z)
• QuanShield: Protecting against Side-Channels Attacks using Self-Destructing Enclaves [4.852855468869516]
  We propose QuanShield, a system that protects enclaves from side-channel attacks that interrupt enclave execution. QuanShield creates an interrupt-free environment on a dedicated CPU core for running enclaves in which enclaves terminate when interrupts occur. Our evaluation shows that QuanShield significantly raises the bar for interrupt-based attacks with practical overhead.
  arXiv  Detail & Related papers  (2023-12-19T02:11:42Z)
• AutoDAN: Interpretable Gradient-Based Adversarial Attacks on Large Language Models [55.748851471119906]
  Safety alignment of Large Language Models (LLMs) can be compromised with manual jailbreak attacks and (automatic) adversarial attacks. Recent studies suggest that defending against these attacks is possible: adversarial attacks generate unlimited but unreadable gibberish prompts, detectable by perplexity-based filters. We introduce AutoDAN, an interpretable, gradient-based adversarial attack that merges the strengths of both attack types.
  arXiv  Detail & Related papers  (2023-10-23T17:46:07Z)
• SyzTrust: State-aware Fuzzing on Trusted OS Designed for IoT Devices [67.65883495888258]
  We present SyzTrust, the first state-aware fuzzing framework for vetting the security of resource-limited Trusted OSes. SyzTrust adopts a hardware-assisted framework to enable fuzzing Trusted OSes directly on IoT devices. We evaluate SyzTrust on Trusted OSes from three major vendors: Samsung, Tsinglink Cloud, and Ali Cloud.
  arXiv  Detail & Related papers  (2023-09-26T08:11:38Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.