Can an old SSH session be reconstructed given root access to the server?

Question

Say that A is behind a firewall that logs all packets, communicating with B over a publickey-authenticated SSH connection:

  A <-------- {ssh} --------> B
                v
                v
  [Encrypted packets all logged]

The firewall is unable to inspect the contents of the SSH session due to design of SSH.

What happens if, say a day or two (or maybe an hour) later, the owner of the firewall assumes root control of the SSH server B? I'm assuming it's possible for the owner to extract the server's SSH private key and decrypt the contents of the old SSH session that was saved to fw logs.

Is this possible? If not, what other data would the owner need?

Answer 1

Since almost all key exchange methods offered by SSH today use forward secrecy it is not enough to get the private key of the server in order to get to the session secrets and decrypt the traffic. While RSA authentication was used with SSH-1 and is also a proposed standard for SSH-2 it is usually not implemented or enabled (see ssh -Qkex for key exchange algorithms enabled in OpenSSH).

Because of forward secrecy an attacker would need to have access to the internal SSH state of either the client or server at the time the SSH connection still exists. It is not possible to get the necessary data later to decrypt previously sniffed connections.