OpenSSH 9.5 Adds Keystroke Timing Obfuscation

OpenSSH 9.5 arrives

OpenSSH 9.5 was released on October 4, 2023. The OpenSSH project described it as fixing a number of bugs and adding some small features, continuing its steady cadence for the widely deployed SSH implementation that ships with most Unix-like systems.

Keystroke timing obfuscation

The headline feature added keystroke timing obfuscation to the ssh client, which attempts to hide inter-keystroke timings by sending interactive traffic at fixed intervals (by default every 20ms) when only a small amount of data is being sent. It also sends fake 'chaff' keystrokes for a random interval after the last real keystroke, controlled by a new ObscureKeystrokeTiming keyword in ssh_config.

A transport-level ping

OpenSSH 9.5 introduced a transport-level ping facility, adding a pair of SSH transport protocol messages, SSH2_MSG_PING and PONG, advertised via a ping@openssh.com ext-info message. These use the local-extensions number space and give endpoints a way to probe liveness at the transport layer.

Ed25519 by default

ssh-keygen now generates Ed25519 keys by default, which OpenSSH noted are convenient due to their small size; Ed25519 is specified in RFC 8709 and has been supported since OpenSSH 6.5 in January 2014. Other changes included more accurate quoting of Subsystem directives and the ability to override them in sshd Match blocks, plus fixes to scp's SFTP-mode symlink handling.

Related on Skillo

See also: OpenSSH 9.6 and the Terrapin attack fix.

Sources

• OpenSSH 9.5 release notes (openssh.com)

Published date reflects the original event date (2023-10-04). This article is original Skillo editorial written from the sources above; facts were verified in September 2026.