3/12 Call me paranoid. How likely is it for someone to decode traffic
sent to/from an ssh connection? The encryption is done end-to-end,
so if the govt is getting a copy of every packet between two boxes
is it possible for them to crack it? I'm not a technical guy BTW,
I just know the high level functionality of these things.
\_ If they really REALLY care and are willing to wait a couple of
weeks before the traffic is decoded and have some insane amount
of computer power... pretty unlikely. There is a reason this stuff
scares the shit out of the powers that be.
\_ It is much easier for them to attack at the unencrypted endpoints
\_ If the government wants to see your shit, they can get a tap for
your keyboard or put a van outside your home/office and read your
monitor. You're only fooling yourself thinking ssh will really
keep the United States' Federal Government from reading your shit.
I suggest you find a good defense lawyer and send good-bye notes to
your family and friends.
\_ any URLS with stories from people this has happened to?
\_ http://www.you.com.au/news/1009.htm
\_ If you are using SSHv1 there is a possibility that someone could
read your traffic. If you are using SSHv2 (AES128-HMAC SHA1) your
traffic will be unbreakable for the next several billion years
assuming that (1) the RSA factoring problem is impossibly hard,
(2) the Discrete Log problem is impossibly hard, (3) SHA1 is a
true 1 way hash and can't be inverted in less than 2^80 tries,
and (4) there are no weaknesses in the AES S-BOX.
There is a further concern among some about the way that HMAC
is performed in the SSH protocol, iirc SSH does E(K,P) HMAC(K,P)
rather than the more secure IPSEC method E(K1,P) HMAC(K2,E(P)).
I'll look this up in my notes and post later on.
\_ It might take decades, or even centuries, but the quantum
computers are coming.
\- we've broken ssh session keys when we were "really really
interested". ok tnx.
\_ what size session keys and did you break them using
brute force or via some other method?
\- "we measure computing power in acres"
\_ how much ct did you need?
\_ who's 'we'?
\_ "ok tnx" is the hallmark of PSB, and PSB works
at LLBL, so he could have "acres of computing power"
Was that you, PSB? |
http://csua.com/feed/