I am currently trying to decrypt an SSH session using memory derived keys and IVs. My current problem is that the counter value seems to be the IV plus some value < 256. My question is now why the value is not always the IV? It seems to be totally random which value is added to the IV. Maybe someone of you can tell me why this IV is not used as the counter but some value is added to it. When I know the value added to the IV the decryption works without problems (but I would like to do this without testing for the value).

I am tracing the OpenSSH/OpenSSH-portable implementation. And for decrypting I use pycryptodome.

  • $\begingroup$ What references did you consult, what specific source code are you referring to, and what information did you find there? $\endgroup$ – Squeamish Ossifrage Jun 2 '19 at 14:16
  • $\begingroup$ After ietf.org/rfc/rfc4344.txt, SSH uses SDCTR mode which means in my opinion that the counter is a fixed value (the IV) and is incremented with every encryption. The code I mean is the encrypt_bytes function in github.com/openssh/openssh-portable/blob/master/cipher-aesctr.c, there the counter is always incremented. To decrypt I use the code from pycryptodome for AES-CTR which works fine if I know the Iv + value (which I achieved by try and error). I hope this makes it clearer :) $\endgroup$ – JustPlayin Jun 2 '19 at 15:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.