Re: Decrypting SSH traffic

Simon Tatham wrote:
Steven Mocking <mocking@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
One should be able to decrypt SSH sessions from the captured traffic
using the host's private key of the honeypot, because AFAIK that key is
used to encrypt the symmetric random session key (blowfish).

That information is both out of date and incomplete.

You're right. Should have figured that out earlier.

I can't think of any method of doing what you want which doesn't
leave _some_ means by which a sufficiently paranoid attacker might
able to detect it. The emulation option is probably the best in
theory, since an emulated system can _in principle_ be made
arbitrarily faithful to the real hardware it's emulating, but in
practice it's not clear to me that it would be noticeably better
than any of the other options.

What about physically reading a hardware RNG? Not going to do it, but in
theory it should work, while the attacker is unable to circumvent and/or
notice it.

For practical purposes, patching is probably easier.
.