Altumptic
Contact

ALT-28 · Paper · 23 Oct 2026

Terrapin: cutting messages out of an SSH handshake

An attacker in the middle could silently delete the first messages of an encrypted SSH session, downgrading its protections. How sequence numbers failed, and the “strict key exchange” that fixed it.

Timeline
  1. Oct 2023Researchers notify SSH implementers.
  2. 18 Dec 2023Terrapin published as CVE-2023-48795; OpenSSH 9.6 adds strict key exchange.
  3. 2024Presented at USENIX Security; patched across major SSH implementations.

How it worked

SSH counts messages implicitly and authenticates the encrypted channel from that count. Messages sent during the unencrypted part of the handshake still advanced the counters, and nothing checked them. Injecting one message early and deleting one later kept the counters in step — and the client never saw the server's extension negotiation.

Our reading

Analysis — Altumptic's interpretation of the sources below.

  • Protocol transcripts must be authenticated in full, including the parts before encryption starts.
  • Fixes that need both sides to upgrade take years to reach full effect.
  • Even mature, heavily reviewed protocols have edges nobody tested.

What it means for you

  1. Upgrade SSH clients and servers so both sides support strict key exchange.
  2. Prefer AES-GCM ciphers until every peer is patched.
  3. Scan your own SSH endpoints; old appliances lag behind.

Sources

  1. Terrapin attack — terrapin-attack.com (Ruhr University Bochum)
  2. NVD — CVE-2023-48795

Altumptic was not involved in this research. Figures are as published by the sources above.

Cite this entry

Altumptic Lab (2026). ALT-28 — Terrapin: cutting messages out of an SSH handshake. 23 Oct 2026. altumptic.com/research/terrapin-2023