On Sat, 24 Jul 2004, Jason Costomiris wrote:
On Jul 24, 2004, at 2:04 PM, Edwin Dicker wrote:
I think SSH is safe enough with its encryption.( Of course everything can eventually be cracked )
The problem with your statement is that there's not a single key in use all the time. Certainly an individual key can be broken given enough time to brute force it. Of course, by the time the would-be attacker has done that, your session has most likely been closed for days, and even still, either end of the connection can request re-keying of the session key periodically.
The symmetric key algorythms used in ssh (and most other applications that use symmetric keys for encryption) idea, blowfish aes and others are believed to be very very strong... the weakest point in the whole link is key-exchange and specifically m-i-t-m attacks aimed at the connection setup. worrying about the stream being brute-force-decrypted in something like real time (even if you were using des-56) isn't realistic, and there are much lower hanging fruitlike mitm or just subverting the machine on either end of the connection...
--
-------------------------------------------------------------------------- Joel Jaeggli Unix Consulting joelja@xxxxxxxxxxxxxxxxxxxx GPG Key Fingerprint: 5C6E 0104 BAF0 40B0 5BD3 C38B F000 35AB B67F 56B2
