RE: ssh holes? Trojans? [long]

[sean.kelly () lanston com]

> From: Ben Nagy [mailto:bnagy () sa volante com au]
>
> In summary, though, it's quite hard to do what you want. What you're
> effectively trying to do is mount an active man-in-the-middle 
> (MitM) attack
> against the protocol. Sadly, the ephemeral keying in the SSH 
> transport layer
> is signed Diffie-Hellman, which is resistant to MitM.

This got me thinking.  PGP supports the use of ADKs in its Diffie-Hellman
keys (as the recent ADK bug hoopla would attest), could SSH do the same?
I'm personally not a fan of ADKs but it would enable monitoring of an SSH
session.


Sean

_______________________________________________
Firewall-wizards mailing list
Firewall-wizards () nfr net
http://www.nfr.net/mailman/listinfo/firewall-wizards