Say that A is behind a firewall that logs all packets, communicating with B over a publickey-authenticated SSH connection:
A <-------- {ssh} --------> B
v
v
[Encrypted packets all logged]
The firewall is unable to inspect the contents of the SSH session due to design of SSH.
What happens if, say a day or two (or maybe an hour) later, the owner of the firewall assumes root control of the SSH server B
? I'm assuming it's possible for the owner to extract the server's SSH private key and decrypt the contents of the old SSH session that was saved to fw logs.
Is this possible? If not, what other data would the owner need?