SSH says breaking secure shell passwords by timing is only ' theoretical '

Network security company SSH Communications said Friday that it is investigating claims that advanced pattern recognition can be used to weaken the security around an encryption standard used to protect connections between computers. The standard, known as secure shell, or SSH, encrypts the data traveling between an administrator's computer and a remote server, allowing for much more secure communications, even over the Internet.

That security, however, was called into question at a technical security conference last week, when three University of California-Berkeley researchers outlined a process by which guessing passwords sent using SSH can be made an estimated 50 times easier. While the company acknowledged the research, SSH Communications called the problems highlighted by the paper "theoretical."

Security firm discounts password threat

By Robert Lemos Special to CNET News.com

While the company acknowledged the research, SSH Communications called the problems highlighted by the paper "theoretical."

"As we have taken a look at this particular problem, we don't feel it is a practical threat to secure shell users," said Albert David, senior director of technical services and operations for the Helsinki, Finland-based company.

The problem with the program is not in a weakness in the encryption but the mere fact that the application is interactive. Once logged into the server from a remote computer, every keystroke on the remote machine is sent one by one to the server.

The three Berkeley researchers showed that by analyzing the times between each letter of a password typed in, pattern recognition can be used to narrow the possible number of candidates for the password.

For example, typing in "er"--two letters adjacent on the QWERTY keyboard--takes less time on average than "qz"--letters separated by a row of keys.

Click here to continue reading this article over at CNET.com