News for hackers. Stuff that matters.

A comment on Terrapin Attack for prefix truncation in SSH. Parent comment

Re:Terrapin Attack for prefix truncation in SSH by Macha on Tuesday December 19, 2023 @04:31AM (#38693581)
> The SSH handshake had been formally verified ... and the proofs are still "true".

This seems unsurprising for me. Formal verification advocates believe it will prevent all issues, but it seemed obvious to me that the verification is still vulnerable to human fallibility in deciding _what_ to verify.

[ Parent | on HN ]
Re:Terrapin Attack for prefix truncation in SSH by lisper on Tuesday December 19, 2023 @05:50PM (#38703040)
See also the Remote Agent Executive bug:

https://ntrs.nasa.gov/api/citations/20000055731/downloads/20...

[ Parent | on HN ]