Episode 6350 custom

Why Modern SSH Keys Cannot Fix Harvested Traffic

Upgrading your user key to Ed25519 authenticates you cleanly, but it leaves recorded traffic vulnerable to future key-exchange attacks.

Oct 29 23:44 Transcript

With

0:00

Episode Details

Episode ID: MWP-6552
Published: Oct 29
Duration: 23:44
Audio: Direct link
Pipeline: V5.25
TTS Engine: chatterbox-regular
Script Writing Agent: GPT-6.1 Sol
Topics: cryptography cyberattacks authentication quantum-computing

AI-Generated Content: This podcast is created using AI personas. Please verify any important information independently.

The prompt

The prompt that started this episode, as sent in (production notes for the hosts removed).

We all generate SSH keys almost on autopilot: ssh-keygen, accept the defaults, paste the public key into GitHub or a server. I'd like to understand what I'm actually choosing when I do that. What are the key types on offer today (RSA, ECDSA, Ed25519, the security-key -sk variants), how do they differ cryptographically in plain terms, and which ones are current versus legacy? And what is the key in the.pub file actually doing during a login, compared with the session encryption that happens alongside it? Then the quantum question: everyone is worried about quantum-resistant security. How does SSH stand right now? Is the key I generated the part that's at risk, or is it something else in the connection?

Accepting default SSH key settings raises vital questions about what those cryptographic choices actually protect. While pressing Enter on modern OpenSSH reliably generates a compact Ed25519 user key, user authentication must be distinguished from host verification and ephemeral session encryption. Ephemeral key exchanges generate the fresh secrets that encrypt active traffic, ensuring forward secrecy so that compromising a long-term login key does not expose past sessions. However, protecting recorded connections against future quantum attacks requires post-quantum key agreement, which OpenSSH defaulted to long before introducing post-quantum authentication. OpenSSH 10.6 introduces a hybrid post-quantum signature option combining Ed25519 with ML-DSA-44, but both endpoints must actively support the composite algorithm to negotiate it.

Sources

What the research for this episode read before the script was written. Primary sources first.

Context

Earlier episodes covered the maths of RSA factoring vs elliptic curves for SSH keys (#368, "The Geometry of Secrets"), SSH key compartmentalisation strategy (#4229), and post-quantum standards in general (#2226). Don't re-teach the trapdoor-function or elliptic-curve geometry at length. The new ground is the practical menu of key types and when to use each, the split between authentication keys and key exchange/session encryption in an SSH connection, and SSH's post-quantum status today: which parts quantum threatens (harvest-now-decrypt-later hits key exchange, not authentication) and what OpenSSH has already changed by default.

Mentions

ECDSA Elliptic-curve SSH signature algorithm
Ed25519 Digital signature scheme for signing records
FIDO WWII fog dispersal by burning fuel
GAO audit Report on agencies' crypto inventory gaps
ML-DSA-44 Lattice-based post-quantum signature, FIPS 204
ML-KEM-768 Post-quantum key encapsulation hybrid with X25519
OpenSSH Community-maintained SSH implementation
RSA Classic public-key cryptosystem
Streamlined NTRU Prime Earlier post-quantum key exchange in OpenSSH
X25519 Classical elliptic-curve key exchange

Downloads

Episode Audio

Download the full episode as an MP3 file

Download MP3

Transcript (TXT)

Plain text transcript file

Episode Book (PDF)

The episode's record — date, duration, models, sources — with the full transcript

#6350: Why Modern SSH Keys Cannot Fix Harvested Traffic

If somebody records your SSH connection today, is the key you pasted into GitHub the thing that could betray you later? Daniel wants to get underneath that familiar routine. Run ssh-keygen, accept the defaults, upload the public half, carry on. What have you actually chosen, and how much does that choice have to do with keeping the connection secret?

Less than people assume. The key you generate usually proves who you are. A separate exchange creates the secrets that encrypt your session. Those operations face different quantum threats, and replacing your login key doesn't automatically improve the other one.

I like that the public key is the bit we all carefully inspect.

By which I mean we check that copying worked.

Usually the right level of attention for that particular operation. On current OpenSSH, running ssh-keygen without arguments generates Ed25519. Small, fast, well established. You haven't accidentally selected some antique because you pressed Enter.

There is comfort in discovering that my strongest cryptographic opinion was a carriage return.

The version matters, though. An older installed copy can have older defaults. We're talking about current OpenSSH, not every executable called ssh-keygen on every neglected laptop.

That immediately shifts what I'd check. I wouldn't begin by throwing away my key. I'd check what's actually installed at both ends. My laptop being current doesn't update the server, and a server being current doesn't upgrade whatever client an automation job has buried inside it.

You're already separating the endpoints, which is necessary. I'd separate the jobs too. Your user key authenticates you. The server has its own host key, which authenticates the server. Then ephemeral key exchange produces fresh session keys. The host signature binds that exchange to the server you're trying to reach.

Three things wearing the same word.

Yes, and they need different maintenance. You can have an excellent user key, an unverified host identity, and an old key exchange, all in one connection. Inspecting the public key file answers only one of those concerns.

Here's the development that changes the conversation. Post-quantum key exchange has been an OpenSSH default since version nine point zero, released in April twenty twenty-two. Version ten point six, released on October sixth, also enables a hybrid post-quantum signature option by default.

Enabled means available for negotiation, though. It doesn't mean every old server suddenly understands it, or that my existing Ed25519 key has acquired a new mathematical interior.

Your existing key stays exactly what it was. Support, selection, and possession are separate conditions. You need compatible implementations and the appropriate keys before the new signature algorithm can actually authenticate anything.

Herman, I can already see you preparing to replace every credential in the flat.

I'm preparing to explain the menu.

You explain menus with a shopping basket.

This time I'm keeping the old key too. You may consider that personal growth.

For Daniel's immediate choice, Ed25519 remains the straightforward new-key recommendation. Hardware-backed variants serve a different need. The new hybrid is useful where both endpoints support it. None of that replaces checking the negotiated connection, especially when the data needs to stay confidential for years.

Then the distinction worth keeping in view is what gets checked during login versus what gets used to encrypt the traffic. I can change one without changing the other, which is both useful and an excellent opportunity to fix the wrong thing.

The current key-generation menu contains RSA, ECDSA, Ed25519, the security-key versions of ECDSA and Ed25519, and the new ML-DSA forty-four combined with Ed25519. That's the complete current type list. DSA has disappeared from it.

Old tutorials remain remarkably committed to keeping DSA employed.

They're a reason to check the manual installed with your version. RSA remains supported and widely interoperable. Its security rests on the difficulty of factoring large integers. The current generation default is three thousand seventy-two bits, generally considered sufficient for classical security. The accepted minimum is one thousand twenty-four, which is a compatibility boundary, not my recommendation.

RSA being old doesn't make every RSA key broken. I'd be more interested in its size, where the private half has been copied, and whether I can revoke it without conducting an archaeological survey.

All relevant. ECDSA uses elliptic-curve discrete logarithms rather than integer factoring. It offers the NIST curves with sizes of two hundred fifty-six, three hundred eighty-four, or five hundred twenty-one bits. Those sizes don't compare directly with RSA bit lengths. Different mathematical problems need different key sizes.

Otherwise the RSA key wins by being longer on paper.

Ed25519 is elliptic-curve cryptography too, but with a fixed choice rather than a parameter menu. Compact keys, fast signatures, fewer decisions. It's current best practice for ordinary new OpenSSH user keys. ECDSA remains current, RSA remains useful for compatibility, and DSA belongs out of new deployments.

Corn, would you choose a hardware-backed key for your own login, knowing you'd have to keep the token nearby?

For a server I care about, probably. For an unattended job, no, unless somebody has solved the attendance part. My attraction is that stealing the laptop's files wouldn't also steal a reusable private key. My objection is that you would install it and then borrow the USB port for something musical.

I can use another port. The security-key variants, identified by the sk ending, use FIDO hardware. The signing secret stays on the token. Normally you touch it to authorize a signature. There's still a local key-handle file, but copying that file doesn't copy the token's private secret.

Physical presence becomes a dependency. That's valuable, provided the workflow actually has a person in it. A hardware key doesn't become unsuitable because it interrupts automation. It may be doing exactly the thing you bought it to do.

Touch requirements have configuration nuances, but yes, that's the intended distinction. Hardware backing protects against extracting the secret. It doesn't make the underlying signature mathematics quantum-resistant.

A locked drawer does not improve factoring.

The new hybrid addresses the mathematics. ML-DSA forty-four is a lattice-based signature standardized in FIPS two hundred four. OpenSSH combines it with Ed25519. Each signature contains both components, and both must verify.

I'd initially assumed the classical part was there so an older server could accept half.

It can't. That's an important correction. The peer must understand the composite algorithm. The classical component is insurance against a weakness being discovered in the new mathematics. Breaking ML-DSA alone wouldn't let somebody forge the composite while Ed25519 remained secure.

You're enthusiastic about a new algorithm because they haven't trusted it alone.

Very enthusiastic. Cryptographers can be pleased and suspicious simultaneously.

You've finally found a hobby that accommodates both.

Let me put that key into an actual login. A typical client first offers the public key without a signature. The server checks whether that key is acceptable for the account, often through authorized_keys. If it is, the client makes a signed authentication request using the private half.

The offer saves me unlocking a key the server won't accept. That makes the passphrase prompt a local event, not a password I'm sending to the server.

Right. Well... local unless you've arranged some external signing mechanism, but the passphrase still isn't an SSH account password sent for verification. An agent may already have the key unlocked, or a token may produce the signature. The signed request includes the session identifier, binding the proof to this connection.

Recording my successful login doesn't produce a reusable performance of me logging in.

The server checks authorization and verifies the signature over the session-bound data. Knowing your public key lets it verify that proof. It doesn't let the server, or an observer, sign as you.

Meanwhile, before it trusts my account claim, my client has to decide whether the server is actually the server. Otherwise I'm proving my identity very competently to the wrong machine.

The server sends its public host key and signs the exchange hash during key exchange. Your client checks that host identity against known_hosts. On first contact, the usual model is trust on first use, the familiar fingerprint prompt.

The prompt whose entire security department is me saying yes.

Unless you've obtained the expected fingerprint independently, yes. First contact establishes a remembered identity; later connections can detect a change. Corn, would you consider several new known_hosts entries after one acceptance suspicious?

I would have. If I agreed to one fingerprint and received several keys, I'd assume the interface had smuggled something past me.

OpenSSH can learn additional host keys after authentication through its host-key update extension. The server advertises them, and the client requests proof of possession of the corresponding private keys, bound to the established session. Subject to client settings, that can add several key types from one trusted host.

That gives rotation a way forward without asking me to approve an unexplained new identity every time. It also means counting lines in known_hosts isn't a reliable count of how many servers I've trusted.

Session encryption is separate again. Ephemeral key agreement establishes fresh shared secrets, from which the connection derives encryption and integrity keys. The temporary secrets are discarded. Later theft of the long-term authentication keys doesn't, by itself, decrypt captured past sessions. That's forward secrecy.

The default key choice is already modern, then. The unresolved part is what the connection actually negotiates.

Hilbert's Mid-Show Haiku.

For the intern in the corridor. A small key, chosen by no one. It opens the door anyway.

The corridor has permissive defaults.

Forward secrecy has a boundary, though. It protects against later theft of long-term secrets. It doesn't promise protection against a future mathematical attack on the recorded ephemeral exchange itself.

That's the gap I was missing. I hear that the temporary secrets were discarded and assume the evidence has gone. An observer still has the public exchange messages, and those could become enough if the underlying problem becomes solvable.

A sufficiently capable quantum computer could attack classical key agreement from those recorded messages. It could recover the session secrets and decrypt the stored traffic. That is harvest now, decrypt later. The attacker doesn't need to steal your login key along the way.

Which makes replacing my RSA login with Ed25519 a perfectly reasonable modernization that doesn't resolve this particular threat. Both are classical signatures anyway. Even replacing it with the new hybrid leaves the session exchange as something I need to inspect separately.

OpenSSH moved on that earlier. Its first default post-quantum exchange combined Streamlined NTRU Prime with X25519. Version ten point zero changed the default to the ML-KEM seven hundred sixty-eight hybrid with X25519, using SHA two hundred fifty-six.

The algorithm names sound like the password requirements escaped.

You'll see the full names in connection diagnostics. The useful thing to recognize is the hybrid construction. The new post-quantum mechanism and established classical agreement both contribute. A break in the new mechanism alone shouldn't leave you worse off than the classical baseline.

No need to bet every confidential session on the newest contestant.

Provided the implementation and combination are sound, yes. That's a narrower statement than saying hybrids cannot fail. They add implementation work and protocol complexity. They hedge uncertainty about the mathematical components.

Would you migrate login signatures at the same speed as key exchange, Corn?

I'd prioritize exchange for anything with a long secrecy lifetime. A database export copied today might still be sensitive when somebody can attack it. For signatures I'd want a planned retirement of classical credentials before forgery becomes practical, but a signature recorded today doesn't unlock today's encrypted export later.

That's the distinction OpenSSH makes explicitly. There's no analogous store-now-decrypt-later exposure from the signature itself. A future attacker able to forge your classical signature could impersonate you in a future login, or forge a host's identity for a new connection.

Still serious. Just a different clock. Authentication has to be ready before the attacker can forge. Confidentiality may need protection years before that, because the recording can happen now.

Exactly... no, more specifically, those timelines depend on how long your data matters and how long migration takes. Nobody has a dependable arrival date for a cryptographically relevant quantum computer. That means a machine able to break the deployed cryptography at useful scale, not merely one that demonstrates a quantum calculation.

A laboratory milestone doesn't automatically come with my server password.

OpenSSH describes estimates ranging from five to twenty years, with many expectations around the mid-twenty-thirties. That's a planning range, not a countdown. Waiting for certainty would give an attacker a larger archive of vulnerable traffic.

I'm comfortable adopting protection before we know whether it will become necessary. I'm less comfortable announcing that my whole estate is quantum-safe because one laptop got an update.

Negotiation makes that especially misleading. A capable client connecting to an old server can still fall back. Starting with OpenSSH ten point one, the client warns when the connection isn't using post-quantum key exchange and identifies the store-now-decrypt-later risk.

At least that warning names the operation. It gives me somewhere more useful to look than the age of my public key.

Ten point six also adds the weak-cryptography warning setting on the server side, allowing classical clients to be logged. If you deliberately keep a classical-only host, the client warning can be suppressed for that host. That changes notification, not protection.

The connection remains weak, but now quietly.

There's a more immediate way to lose access with ten point six. Its hybrid signature support drops the experimental vendor-suffixed algorithm name used in ten point four and ten point five. Those experimental keys need regeneration or removal.

This is where your shopping basket becomes relevant.

I said I'd keep the old key.

I heard you. I'm checking whether the server heard you.

Fair. The name appears in public-key entries, host-key records, and private-key files. Merely editing the visible public line isn't a complete migration. The new release doesn't recognize the old experimental name.

A failed login is inconvenient. A server configuration refusing to load is rather more committed.

An unknown name left in the accepted user-key or host-key algorithm settings can produce a fatal Bad key types error. The daemon may refuse to start. On a remote machine without console access, that's a lockout caused by the security upgrade.

Excellent. No quantum computer can log in now.

Before restarting, validate the server configuration with sshd's test mode. Inspect its effective host-key, accepted-user-key, and key-exchange settings. Keep a working session open, and have another route in. Retain an Ed25519 credential alongside the new hybrid for older servers and implementations that don't understand it.

Keeping a fallback sounds contradictory until you name what it protects against. It's protecting availability during migration. It also means I haven't retired classical authentication yet, so I shouldn't claim that I have.

Enabling support isn't retirement. You need an inventory of which credentials and clients remain, then a policy for removing them. That's difficult even in organizations with substantial budgets.

I'd expect the hidden clients to be worse than the visible servers. People remember the machine they log into. They forget the scheduled transfer that logs into it every night.

The federal picture suggests that inventory is a real bottleneck. An October GAO audit found only one of twenty-four agencies had completed its quantum-vulnerable cryptography inventory. Most also reported lacking cryptographic expertise.

Twenty-three agencies still looking for the keys.

New national security systems face quantum-resistant support requirements from twenty twenty-seven under CNSS Policy fifteen, with legacy phase-out by twenty thirty. Those deadlines make discovery operational work now. Before changing an algorithm, somebody has to find the client using it.

Especially when the client is an unattended laptop doing encryption with a key nobody remembers installing.

Authentication, Corn. That laptop key is doing authentication. You've spent most of this explaining the distinction, and then you gave it encryption at the end. I did the same thing this month. My old RSA key worked on a new ten point six server, and the server logged a warning about classical key exchange. I spent the afternoon blaming the key.

The RSA signature can succeed while an older client negotiates classical exchange. Those events fit together.

It was two thousand forty-eight bits. Passphrase on it. I'd copied it between laptops for more than a decade because it was already in all the authorized_keys files. I kept the copy on a USB stick marked Do not lose. The fire-safe copy said Do not lose, backup. This month I stopped carrying the stick. I erased it and gave it away.

The label made a fairly broad promise to its next owner.

A man I met travelling had shown me his security token. I still think about him because he carried it separately from his laptop. Mine had always been in the laptop bag. At home I use the separate key now. I don't like carrying the copy with the thing it's copied for. The warning was about exchange, as Herman said. I understood it after lunch.

Keeping the signing device separate also changes what happens if the entire bag disappears.

Unless you've put both in your coat.

Your stubborn old key had another advantage. You knew where it was authorized. A new credential makes you discover where the old one wasn't replaced.

I missed a Raspberry Pi when I added Ed25519 everywhere. Six months later I needed it. Password login was disabled. I took it out of the cupboard and mounted the card on another machine. That took longer than lunch.

That distinction between possessing a new key and deploying it everywhere matters for the hybrid migration too. The cryptography can be ready while a single forgotten endpoint still decides whether access works.

The missed machine also explains why removing the old credential should be its own deliberate step. Creating the replacement is easy to observe. Proving you've finished distributing it takes actual checking.

One adjacent detail we haven't used is private-key storage. The default OpenSSH format protects a passphrase-encrypted private key with bcrypt-based derivation, currently using thirty-two rounds. That's protection for the file at rest, separate again from signatures and session exchange.

The passphrase matters if somebody steals the file. It doesn't upgrade the network negotiation, and the network negotiation doesn't rescue an exposed signing key. Both can deserve attention without becoming the same job.

The migration I'd watch is the removal stage. Adding hybrid support is measurable; finding the last forgotten classical client before disabling it is harder. That cupboard machine is the sort of endpoint an inventory has to include.

Thanks to Hilbert Flumingtop for producing.

If you want more of this, try episode three sixty-eight, The Geometry of Secrets; episode thirty-five, The Privacy Gap; and episode three, Safetensors or something else. This has been My Weird Prompts. If you enjoyed this episode, leave us a review. It helps other listeners find the show.

See you tomorrow.

This episode was generated with AI assistance. Hosts Herman and Corn are AI personalities. It may contain errors: disclaimer · report an error