Hacker News: OpenSSH Now Encrypts Secret Keys in Memory Against Side-Channel Attacks

June 22, 2019     

openssh side channel vulnerability


In recent years, several groups of cybersecurity researchers have disclosed dozens of memory side-channel vulnerabilities in modern processors and DRAMs, like RowhammerRAMBleedSpectre, and Meltdown.

Have you ever noticed they all had at least one thing in common?

That’s OpenSSH.

As a proof-of-concept, many researchers demonstrated their side-channel attacks against OpenSSH application installed on a targeted computer, where an unprivileged attacker-owned process exploits memory read vulnerabilities to steal secret SSH private keys from the restricted memory regions of the system.

That’s possible because OpenSSH has an agent that keeps a copy of your SSH key in the memory so that you don’t have to type your passphrase every time you want to connect to the same remote server.

However, modern operating systems by default store sensitive data, including encryption keys and passwords, in the kernel memory which can not be accessed by user-level privileged processes.

But since these SSH keys live on the RAM or CPU memory in plaintext format, the feature is susceptible to hacking attempts when the attacks involve memory read vulnerabilities.

OpenSSH Now Stores Only Encrypted Keys in the Memory

Here’s good news — it’s not the case anymore.

The latest update from the OpenSSH developers resolves this issue by introducing a new security feature that encrypts private keys before storing them into the system memory, protecting it against almost all types of side-channel attacks.

According to OpenSSH developer Damien Miller, a new patch to OpenSSH now “encrypts private keys when they are not in use with a symmetric key that is derived from a relatively large “prekey” consisting of random data (currently 16KB).”

“Attackers must recover the entire prekey with high accuracy before they can attempt to decrypt the shielded private key, but the current generation of attacks have bit error rates that, when applied cumulatively to the entire prekey, make this unlikely,” Miller explains.


“Implementation-wise, keys are encrypted ‘shielded’ when loaded and then automatically and transparently unshielded when used for signatures or when being saved/serialized.”

It should be noted that this patch just mitigates the threat and is not a permanent solution. Miller says OpenSSH will remove this protection against side-channel attacks in a few years when computer architecture becomes less unsafe.

The real freedom is freedom from any ideology. Can’t you simply live without any ideology? Is an ideology needed? Why is an ideology needed so much? It is needed because it helps you to remain stupid, it is needed because it helps you to remain unintelligent. It is needed because it supplies you readymade answers and you need not find them on your own.

The real man of intelligence will not cling to any ideology — for what? He will not carry a load of readymade answers. He knows that he has enough intelligence so that whatever situation arises, he will be able to respond to it. Why carry an unnecessary load from the past? What is the point of carrying it?

And in fact the more you carry from the past, the less you will be able to respond to the present, because the present is not a repetition of the past, it is always new, always always new.

— Rajneesh

♪Vivaldi Four Seasons: “Winter” (L’Inverno), complete; Cynthia Freivogel, Voices of Music 4K RV 297

Q. Where can I learn more about this music? A. You can visit our website, https://www.voicesofmusic.org/ Also, subscribe to our video channel! Just click on the logo on our videos. Q. Where can we hear you play in concert? A. We perform in the San Francisco Bay Area. For a concert schedule, visit our website or join our mailing list https://www.voicesofmusic.org/ Q. Where can I buy CDs? A. Our CDs are available on iTunes, Google, Amazon, CD Baby and just about everywhere; you can also buy a CD in a jewel case from Kunaki: https://www.voicesofmusic.org/cds.html Q. What is Early Music performance, or historical performance? A. We play on instruments from the time of the composers, and we use the original music and playing techniques: it’s a special sound. Q. Why are there no conductors? A. Conductors weren’t invented until the 19th century; since we seek to recreate a historical performance, the music is led from the keyboard or violin, or the music is played as chamber music~or both 🙂 Q. What are period instruments or original instruments; how are they different from modern instruments? A. As instruments became modernized in the 19th century, builders and players tended to focus on the volume of sound and the stability of tuning. Modern steel strings replaced the older materials, and instruments were often machine made. Historical instruments, built individually by hand and with overall lighter construction, have extremely complex overtones—which we find delightful. Modern instruments are of course perfectly suited to more modern music. Q. Why is the pitch lower, or higher? A. Early Music performance uses many different pitches, and these pitches create different tone colors on the instruments. See https://goo.gl/pVBNAC Vivaldi’s brilliant concerto is here presented complete in 4K, ultra high definition video, performed on original instruments. For this video, a new edition was prepared from the original sources, prints and manuscripts for Vivaldi’s music. In addition, a digital overlay has been created for Vivaldi’s sonnets which were inlaid into the original engraving: click the CC button to view the sonnet and the gear icon to choose your preferred language. Voices of Music is creating a worldwide digital library of music videos, recordings and editions, free for anyone in the world. To support this vital project, which will enable new generations of people all around the world to enjoy Classical music, please consider a tax-deductible donation or sponsor a recording project. With your help, anything is possible! https://voicesofmusic.org/donate.html Voices of Music continues our groundbreaking work as a pioneer in the new field of Ultra-High definition video. Although the Four Seasons is the most recorded work in Classical music, this is the first time that the work is made freely available in this format, and performed on period instruments. Your donations will keep the presses running!