如何解密使用 Diffie Hellman 加密的 SSH .pcap 文件。带有公钥和私钥
如何解密使用 Diffie Hellman 加密的 SSH .pcap 文件。有公钥和私钥。
我们正在尝试通过 Wireshark 但没有成功。
How do you decrypt SSH .pcap file that uses Diffie Hellman encryption. With public and private keys.
We are trying through Wireshark with no luck.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
临时 Diffie-Hellman（TLS 的 DHE 密码套件）的好处之一是它提供完美的前向保密性。这意味着，即使攻击者有一天获得了用于验证服务器（也可能是客户端）的 DSA 私钥，她也无法返回并解密过去捕获的任何会话。
换句话说，除非您记录了秘密会话密钥，否则您无法解密这些捕获；之后就没有办法恢复了。
这与 RSA 密码套件不同，在 RSA 密码套件中，了解服务器私钥即可解密会话。
One of the benefits of ephemeral Diffie-Hellman (the DHE ciphersuites of TLS) is that it provides perfect forward secrecy. This means that even if the private DSA key used to authenticate the server (and possibly client) are obtained by an attacker someday, she won't be able to go back and decrypt any sessions captured in the past.
In other words, you can't decrypt these captures unless you recorded the secret session key; there's no way to recover it afterward.
This is different than the RSA cipher suites, where knowledge of the server private key allows one to decrypt the session.
由于会话是由临时“会话密钥”加密的，因此最后拥有服务器和/或客户端的公钥/私钥对您来说没有用。这些密钥仅用于验证是否存在中间人攻击。
为了解密 SSH 会话，您必须以某种方式获取会话密钥（可能通过将调试器附加到任一侧的客户端）或执行中间人攻击 - 这需要服务器的私钥（以及客户端（如果正在使用密钥身份验证）。有关后一个选项的更多信息可以在这里找到：http://taosecurity.blogspot .com/2007/08/love-ssh.html
Because the session is encrypted by a transient "session key", having the public/private keys of the server and/or client at the end is of no use to you. Those keys are only used to verify that there has been no man-in-the-middle attack.
In order to decrypt a SSH session, you must either somehow obtain the session key (perhaps by attaching a debugger to a client on either side) or perform a man-in-the-middle attack - this requires the private key of the server (and the client, if key authentication is being used). Some more info on the latter option can be found here: http://taosecurity.blogspot.com/2007/08/loving-ssh.html
因此，如果我理解得很好，解密 SSH 会话的过程与解码 wifi WPA2-PSK 非常相似，您需要捕获 4 次握手才能导出临时密钥（又名 PTK）。在 wifi WPA2-PSK 中，如果我们没有 4 次握手，即使您知道实际的密码，也无法恢复临时密钥并解密流量。
So if I understand well, the process to decrypt a SSH session is very similar to decoding wifi WPA2-PSK, you need to capture the 4-way handshake to be able to derive the transient key aka PTK. In wifi WPA2-PSK if we don't have the 4-way handshake, there is also no way to recover the transient key and decrypt the traffic even if you know the actual passphrase.