Editing Secure Shell (section)

===CBC plaintext recovery===
In November 2008, a theoretical vulnerability was discovered for all versions of SSH which allowed recovery of up to 32 bits of plaintext from a block of ciphertext that was encrypted using what was then the standard default encryption mode, [[Block cipher modes of operation#Cipher-block chaining (CBC)|CBC]].<ref name="SSH CBC vulnerability">{{cite web|url=http://www.kb.cert.org/vuls/id/958563|title=Vulnerability Note VU#958563 - SSH CBC vulnerability|website=US CERT|url-status=live|archive-url=https://web.archive.org/web/20110622005639/http://www.kb.cert.org/vuls/id/958563|archive-date=2011-06-22}}</ref> The most straightforward solution is to use [[Block cipher modes of operation#Counter (CTR)|CTR]], counter mode, instead of CBC mode, since this renders SSH resistant to the attack.<ref name="SSH CBC vulnerability"/>