[arm-allstar] Terrapin vulnerability

[David McGough]

Nate,

Yes, I agree, from my initial analysis, simply disabling the
chacha20-poly1305 at openssh.com cipher should mitigate this vulnerability,
for now.

I'm working on a patch to release which will handle adjusting the config 
file for HamVoIP users.  Or, I may roll a fully updated version of 
OpenSSH. I'm still evaluating.  More about this soon.

....This is aggravating since chacha20-poly1305 at openssh.com happens to be 
one of the best performing ciphers available on the RPi hardware platform.  
Dang it.  Oh, well.


73, David K4FXC


On Wed, 20 Dec 2023, Nate Bargmann via ARM-allstar wrote:

> This morning on a few local machines running Debian 12.4 with OpenSSH
> 9.2p1, I have been adding the following line to /etc/ssh/sshd_config:
> 
> Ciphers -chacha20-poly1305 at openssh.com
> 
> Using the Terrapin test program, that is the only cipher shown as
> vulnerable.  After restarting the SSH daemon the test program reports
> that the vulnerability is closed.
> 
> Running the program against HamVOIP I see:
> 
> ================================================================================
> ==================================== Report ====================================
> ================================================================================
> 
> Remote Banner: SSH-2.0-OpenSSH_7.2
> 
> ChaCha20-Poly1305 support:   true
> CBC-EtM support:             false
> 
> Strict key exchange support: false
> 
> ==> The scanned peer is VULNERABLE to Terrapin.
> 
> Note: This tool is provided as is, with no warranty whatsoever. It determines
>       the vulnerability of a peer by checking the supported algorithms and
>       support for strict key exchange. It may falsely claim a peer to be
>       vulnerable if the vendor supports countermeasures other than strict key
>       exchange.
> 
> For more details visit our website available at https://terrapin-attack.com
> 
> So it appears to me that the same line should close the vulnerability
> for HamVOIP SSH.
> 
> 73, Nate, N0NB
> 
>