What are the benefits to not including MAC in a SSH packet encryption? I understand what the MAC is there for, but if it was not included would there be an advantage? Is the MAC somewhat redundant considering the server host key is used during key exchange to authenticate?
$\begingroup$
$\endgroup$
1
-
1$\begingroup$ It allows an attacker to modify your data. If you are an attacker, this would be an advantage ;-) (The MAC is not there for authentication of the other end, but to make sure that an attacker doesn't modify your data.) $\endgroup$– Paŭlo EbermannCommented Mar 18, 2015 at 22:22
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
The MAC is NOT redundant.
As alluded to by Paŭlo Ebermann's comment, the word authentication has a different meaning in the two scenarios you mentioned.
In the key exchange phase of SSH, the purpose of authentication is to ensure to both parties that they are indeed talking to the right peer (if using mutual authentication). Typically, the server authenticates itself using its public key and the client uses a username and password.
In the SSH record layer phase (i.e., the sending of the actual application data), the purpose of authentication is to protect each individual data packet from tampering. This is achieved using the MAC. To encrypt application data SSH typically uses either AES in counter mode or in CBC mode. Neither of these modes of operation provides protection against tampering of the ciphertext. Thus they need to be accompanied with a MAC in order to detect this.
Consider e.g., the silly example where Alice sends the following message encrypted using AES in counter mode, but without any MAC:
Transfer 100 USD from Alice to Bob. Then someone (Bob?) could flip a few strategically placed bits in the ciphertext, so that it would actually decrypt to Transfer 10 000 USD from Alice to Bob. instead. Note that without any MAC, it would be impossible for the recipient to notice that this ciphertext had been tampered with. Also, observe that this fact is completely independent of any key exchange that has been done prior to the tampering.
There is of course one obvious "advantage" to skipping the MAC: you save the 80-128 bits of overhead needed to transfer it for each data packet you send. But this is not safe and should not be done!
