This paper:


Explains how SSH can be compromised by analyzing the timing of the keystrokes to guess what the user is typing. It's about 12 years old.

I heard that this attack vector was solved in SSH long ago by sending keystrokes at random intervals.

However, out of curiosity, I fired up Wireshark and started an SSH connection to a Debian host. I typed in characters slowly and saw that a packet is being sent for each character, but there are no other packets sent besides. Then where is the defense against the timing attack?

  • What about pasting your password from a password management tool? Commented Dec 17, 2013 at 19:51
  • 1
    Since this question was asked in 2013, and a commit addressing at least some of this problem was pushed a decade later in 2023, it's safe to say that SSH was not sufficiently defending against keystroke-timing attacks.
    – Zamicol
    Commented Aug 29, 2023 at 18:41

3 Answers 3


Damien Miller added support for keystroke timing obfuscation in this patch on 2023-06-28. The new ObscureKeystrokeTiming configuration option sends fake keystrokes at regular intervals and introduces additional fake keystrokes after every user input.


SSH does not actually defend against keystroke timing attacks. To my knowledge, no actual case of password recovery through timing analysis of a SSH connection has been spotted in the wild; however, since nobody in particular would have kept me informed if that had been the case, what does it prove ?

This report claims that the Song-Wagner-Tian attack is too difficult to pull off on a practical network, because the latency implied by the network masks the delays between key strokes. One may notice that the purported attack relies on a learning phase in which delays between two specific letters are first gathered (for a specific victim); that phase looks hard to do in practice. Another vexing issue is that an oft-typed password usually has its own delay patterns; that is, when you type the same password again and again, the delay between, say, a 'v' and a subsequent 'o' occurring in the password will be quite distinct from the delay measured when the "vo" letters appear in a non-password text that you also type.

Note: SSH includes some random padding, at least four random bytes (see the standard), but this is meant to avoid some potential weaknesses of the used block cipher. It does nothing about timing.

  • 1
    I hate to say it, but your note isn't entirely correct. The SSH standard supports random padding, but it is not actually used by any implementations. The CBC padding is something completely different.
    – forest
    Commented Apr 9, 2022 at 18:06

I suppose your question is about:

WASHINGTON--A team of researchers from the University of California at Berkeley revealed two weaknesses in Secure Shell (SSH) implementations Friday that allow an eavesdropper to learn the exact length of a user's password by observing the rhythm of their keystrokes. By using advanced statistical techniques on timing information collected over the network, researchers also found that the eavesdropper can learn significant information about what users type in SSH sessions.

Note that this attack is using heuristics to detect when you type your password and then counts the characters, thus revealing the length. Mainly this can be done because passwords are part of your motoric memory meaning you can type it really fast because you have typed it a lot of times before. So if an attacker sees a rapid succession of characters (faster than your other keystrokes) then he knows that it probably is your password.

As you understand if you type your characters slowly, there is no way of analyzing this using standard heuristics. The heuristics will fail because you are not doing the normal expected behavior when typing your password.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .