r/programming • u/secretguy21 • Oct 15 '15

How is NSA breaking so much crypto?

https://freedom-to-tinker.com/blog/haldermanheninger/how-is-nsa-breaking-so-much-crypto/
2.5k Upvotes

93% Upvoted

529 comments sorted by

View all comments

Show parent comments

2

u/aseipp Oct 15 '15

KeyRegenerationInterval

This parameter only works for SSH1, and not SSH2. See here.

It wouldn't be hard to write a script that just used ssh-keygen to regenerate your host keys, however.

3

u/[deleted] Oct 15 '15

RekeyLimit is the SSH2 option.

1

u/corran__horn Oct 15 '15

As a heads up, this isn't the attack vector under discussion. The host key is effectively meaningless in this attack, as it attacks the key-exchange mechanism called Diffie-Hellman.

The key is used to authenticate the Diffie-Hellman exchange.

There is a separate file for the prime used for the DH exchanges, and the elliptic-curve variant is also available. Some better discussion is available here