Terrapin Attack (CVE-2023-48795)
What is Terrapin Attack (CVE-2023-48795)?
Terrapin Attack (CVE-2023-48795)A 2023 prefix-truncation flaw in the SSH transport protocol that allows an active network attacker to silently downgrade or strip extensions during the handshake, weakening features like keystroke timing protection.
The Terrapin attack (CVE-2023-48795), disclosed by Bäumer, Brinkmann, and Schwenk in December 2023, is a prefix-truncation flaw in the SSH binary packet protocol. By manipulating packet sequence numbers during the initial KEX handshake — specifically when ChaCha20-Poly1305 (`chacha20-poly1305@openssh.com`) or CBC-EtM ciphers are used — a man-in-the-middle attacker can truncate the secure channel's initial messages without the integrity check failing, causing both ends to disagree about which extensions were negotiated. The most cited practical impact is silently disabling extensions such as keystroke-timing obfuscation; the underlying primitive can also weaken implementation-specific authentication features (notably AsyncSSH's CVE-2023-46446). Terrapin spurred quick fixes: OpenSSH 9.6 introduced a strict KEX mode that resets sequence numbers, and most major SSH implementations (Dropbear, libssh, PuTTY, Bitvise, Cisco IOS) followed. Mitigation is to upgrade clients and servers so both negotiate `strict-kex`, and to prefer AES-GCM ciphers, which are unaffected.
● Examples
- 01
An attacker positioned between two SSH peers truncates the KEX handshake so a keystroke-timing extension never gets negotiated, then mounts a timing attack on the user's password.
- 02
An infrastructure team rolls out OpenSSH 9.6 across all jump hosts; the new `strict-kex` negotiation reports `kex_strict_s_v00@openssh.com` and blocks the truncation primitive.
● Frequently asked questions
What is Terrapin Attack (CVE-2023-48795)?
A 2023 prefix-truncation flaw in the SSH transport protocol that allows an active network attacker to silently downgrade or strip extensions during the handshake, weakening features like keystroke timing protection. It belongs to the Attacks & Threats category of cybersecurity.
What does Terrapin Attack (CVE-2023-48795) mean?
A 2023 prefix-truncation flaw in the SSH transport protocol that allows an active network attacker to silently downgrade or strip extensions during the handshake, weakening features like keystroke timing protection.
How does Terrapin Attack (CVE-2023-48795) work?
The Terrapin attack (CVE-2023-48795), disclosed by Bäumer, Brinkmann, and Schwenk in December 2023, is a prefix-truncation flaw in the SSH binary packet protocol. By manipulating packet sequence numbers during the initial KEX handshake — specifically when ChaCha20-Poly1305 (`chacha20-poly1305@openssh.com`) or CBC-EtM ciphers are used — a man-in-the-middle attacker can truncate the secure channel's initial messages without the integrity check failing, causing both ends to disagree about which extensions were negotiated. The most cited practical impact is silently disabling extensions such as keystroke-timing obfuscation; the underlying primitive can also weaken implementation-specific authentication features (notably AsyncSSH's CVE-2023-46446). Terrapin spurred quick fixes: OpenSSH 9.6 introduced a strict KEX mode that resets sequence numbers, and most major SSH implementations (Dropbear, libssh, PuTTY, Bitvise, Cisco IOS) followed. Mitigation is to upgrade clients and servers so both negotiate `strict-kex`, and to prefer AES-GCM ciphers, which are unaffected.
How do you defend against Terrapin Attack (CVE-2023-48795)?
Defences for Terrapin Attack (CVE-2023-48795) typically combine technical controls and operational practices, as detailed in the full definition above.
What are other names for Terrapin Attack (CVE-2023-48795)?
Common alternative names include: CVE-2023-48795, SSH prefix truncation.
● Related terms
- network-security№ 1205
SSH
A cryptographic network protocol (RFC 4251, port 22) that provides authenticated, encrypted, and integrity-protected remote login, command execution, and tunneling over an untrusted network.
- attacks№ 724
Man-in-the-Middle Attack
An attack in which an adversary secretly relays or alters communications between two parties who believe they are talking directly to each other.
- network-security№ 1280
TLS Handshake
The initial protocol exchange in Transport Layer Security that authenticates the server (and optionally the client) and derives the symmetric keys used to encrypt the rest of the session.
- cryptography№ 190
Cipher Suite
A named combination of cryptographic algorithms — key exchange, authentication, bulk encryption, and integrity — negotiated by protocols such as TLS for a given session.
- cryptography№ 179
ChaCha20-Poly1305
An AEAD construction pairing the ChaCha20 stream cipher with the Poly1305 one-time authenticator, standardised in RFC 8439 for TLS 1.3 and WireGuard.
- attacks№ 1211
SSL/TLS Downgrade Attack
An active man-in-the-middle attack that forces a client and server to negotiate a weaker protocol version, cipher, or key size to enable further compromise.