Which of the following user authentications are supported by the SSH-1 protocol but not by the SSH- 2 protocol? Each correct answer represents a complete solution. Choose all that apply.

The SSH-2 protocol was a complete redesign of SSH-1 to address security flaws and improve modularity. As part of this redesign, several authentication methods supported in SSH-1 were deprecated and removed or replaced with more secure and flexible alternatives in SSH-2. Specifically, Rhosts (rsh-style) authentication was removed due to its inherent insecurities related to IP and DNS spoofing. TIS authentication, an early challenge-response mechanism, was superseded by the more generic 'keyboard-interactive' method. The direct Kerberos authentication method in SSH-1 was replaced in SSH-2 by the more extensible Generic Security Service Application Program Interface (GSSAPI), which can support Kerberos 5 and other mechanisms. Password-based authentication remains a core method in both protocol versions.

D. Password-based authentication: This is a fundamental authentication method that is explicitly supported and defined in the protocol specifications for both SSH-1 and SSH-2.

1. University of Michigan

EECS 588 - Computer & Network Security Courseware. (Winter 2006). Lecture 10: SSH

Slides 14 & 18. The lecture notes explicitly list the authentication methods for each protocol version. Slide 14 lists "Rhosts

" "TIS

" and "Kerberos" for SSHv1. Slide 18 lists the SSHv2 methods

which do not include these

instead showing their replacements like "Hostbased" and "Challenge-response."

Source: https://www.eecs.umich.edu/courses/eecs588/static/lectures/10-SSH.pdf

2. OpenBSD. (2023). sshdconfig(5) Manual Page. As the official vendor documentation for OpenSSH

the most widely used SSH implementation

this manual explicitly states that certain authentication options are for SSH-1 only.

Regarding RhostsAuthentication: "This option is for ssh version 1 only."

Regarding KerberosAuthentication: "Specifies whether Kerberos authentication is allowed. This option is for ssh version 1 only."

Source: https://man.openbsd.org/sshdconfig.5

3. IETF RFC 4252: The Secure Shell (SSH) Authentication Protocol. (January 2006). This official standard for SSH-2 authentication specifies the valid methods. Section 7

"Authentication Method Names

" lists publickey

password

and hostbased as the primary methods. The absence of rhosts

tis

and a specific kerberos method from the core protocol specification confirms they are not part of the SSH-2 standard.

Source: https://doi.org/10.17487/RFC4252