In an ideal world, where all links are fully trustworthy from a data integrity point of view, with proper settings, modern SSH can be more or less assumed to be fully secure against eavesdropping on the content of the communications, but may leak metadata (e.g. the fact that you are connecting to a specific host, and some about the usage pattern and amounts of data transferred).
In a somewhat more realistic world, however much we might not want that to be the case, links should be expected to be monitored. We know that encrypted traffic may be specifically retained by powerful adversaries. However, there is still a big difference between passively monitoring traffic on the one hand, and actively tampering with it in-flight on the other.
- the initial SSH host key is generated by unknown, possibly flawed, means;
- the administrator cannot directly verify the correctness of the SSH host key presented by the server on the first connection, beyond being able to tell whether the login attempt succeeds or fails, but can verify the host key fingerprint via commands within that session once established;
- the administrator quickly replaces the SSH host key with one generated in a trustworthy fashion and reestablishes a connection once the new host key has been loaded;
- the administrator diligently confirms SSH host key fingerprints between the client and the server;
- the administrator does not have access to a distinct channel to the server for key maintenance, so key replacements have to be performed through the SSH session established with the host key that happens to be on the server at the time;
- the attacker does not have access to the SSH private host key on the server, but can monitor, store and later process all communications to and from the server.
In such a scenario,
- what security guarantees can SSH-2 give against eavesdropping on the content of the communications (violation of confidentiality)?
- are these security guarantees any different in the initial connection (before the host key is replaced) and later connections?