client authentication to another server. Since SSH-1 has inherent design flaws which make it vulnerable, it is now generally considered obsolete and should be avoided by explicitly disabling fallback to SSH-1. Most modern servers and clients support SSH-2. CBC plaintext recovery In November 2008, a theoretical vulnerability was discovered for all versions of SSH which allowed recovery of up to 32 bits of plaintext from a block of ciphertext that was encrypted using what was then the standard default encryption mode, CBC. The most straightforward solution is to use CTR, counter mode, instead of CBC mode, since this renders SSH resistant to the attack. Suspected decryption by NSA On December 28, 2014 Der Spiegel published classified information leaked by whistleblower Edward Snowden which suggests that the National Security Agency may be able to decrypt some SSH traffic. The technical details associated with such a process were not disclosed. A 2017 analysis of the CIA hacking tools BothanSpy and Gyrfalcon suggested that the SSH protocol was not compromised. Standards documentation The following RFC publications by the IETF "secsh" working group document SSH-2 as a proposed Internet standard. – The Secure Shell (SSH) Protocol Assigned Numbers – The Secure Shell (SSH) Protocol Architecture – The Secure Shell (SSH) Authentication Protocol – The Secure Shell (SSH) Transport Layer Protocol – The Secure Shell (SSH) Connection Protocol – Using DNS to Securely Publish Secure Shell (SSH) Key Fingerprints – Generic Message Exchange Authentication for the Secure Shell Protocol (SSH) – The Secure Shell (SSH) Session Channel Break Extension – The Secure Shell (SSH) Transport Layer Encryption Modes – Improved Arcfour Modes for the Secure Shell (SSH) Transport Layer Protocol The protocol specifications were later updated by the following publications: – Diffie-Hellman Group Exchange for the Secure Shell (SSH) Transport Layer Protocol (March 2006) – RSA Key Exchange for the Secure Shell (SSH) Transport Layer Protocol (March 2006) – Generic Security Service Application Program Interface (GSS-API) Authentication and Key Exchange for the Secure Shell (SSH) Protocol (May 2006) – The Secure Shell (SSH) Public Key File Format (November 2006) – Secure Shell Public Key Subsystem (March 2007) – AES Galois Counter Mode for the Secure Shell Transport Layer Protocol (August 2009) – Elliptic Curve Algorithm Integration in the Secure Shell Transport Layer (December 2009) – X.509v3 Certificates for Secure Shell Authentication (March 2011) – Suite B Cryptographic Suites for Secure Shell (SSH) (May 2011) –