On 08.08.23 00:30, Damien Miller wrote:
For ssh, IMO sending interactive traffic on a fixed clock (e.g. every 2-4ms) instead of as soon as possible, and adding fake keystroke packets for some interval after the user stops generating traffic is the way to fix it.
Top touch typing speeds get to about 100 wpm; with an average of 4.7 letters per word in English, that's a bit short of 10 keystrokes per second, or 100 ms between. So, I'd guess that you could make that quantization a *lot* coarser (*if* you can keep it reliably applying only to manual input, and, e.g., side-step the algo when the user is copy-pasting into the terminal window instead).
Of course, this will telegraph to any snoop that this mechanism *is* in effect - and that minute changes in inter-packet delay might instead be leaking information from the cryptalgorithm. If we want to keep them guessing (and desparately doing more and more complex statistics), sending characters in groups of two or three (as soon as either that many have been entered, or we reach a dynamic-and-randomized timeout waiting for that) might be a better approach.
Kind regards, -- Jochen Bern Systemingenieur Binect GmbH
Attachment:
smime.p7s
Description: S/MIME Cryptographic Signature
_______________________________________________ openssh-unix-dev mailing list openssh-unix-dev@xxxxxxxxxxx https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev
