4

I heard recently that WPA2 passwords can be brute forced if somebody captures handshake (which is not very difficult). Can somebody tell if a similar method exists for cracking SSH traffic? I mean some method for brute forcing my password on a local PC without having to connect to the server all the time.

8
  • "brute forcing my password on a local PC" -- what do you mean? Do you mean capturing enough traffic from your PC to brute force the password?
    – schroeder
    Commented Nov 5, 2022 at 23:45
  • Exactly like you said. Capture enough traffic from my PC to run brute force algorithm on another PC offline, i.e. the evil machine does not need to check each password variant by connecting to a server, for which the password is being guessed. Or, in other words, doing it similar to how it is done with brute forcing WPA2 algorithm.
    – John Smith
    Commented Nov 6, 2022 at 0:06
  • I assume you're referring specifically to WPA2-PSK and SSHv2?
    – forest
    Commented Nov 6, 2022 at 0:35
  • I am not a specialist in this area, so I cannot tell, which version I mean) The question was raised because somebody told me that since WPA2 can be brute forced by listening WiFi traffic and capturing handshake message, SSH connection with password can be brute forced in a similar way and therefore I should use SSH with key authentication. But using an SSH key seems to me less secure since anybody, who gets my computer with the key, seems to be able to start brute forcing passphrase to this key...
    – John Smith
    Commented Nov 6, 2022 at 7:25
  • @JohnSmith You generally should be using an SSH key, but with a password. You can do that by either requiring that both a key and a password are present to authenticate, or by encrypting the private key that you have on your computer (it will automatically prompt you for the password when you use it). The reason you should be using SSH public key authentication is not because SSH is anything like WPA2 though. It's only because it's easier to create a secure keypair than a secure text password.
    – forest
    Commented Nov 10, 2022 at 0:57

1 Answer 1

7

WPA2's design makes the serious mistake of using the same human-derived secret for confidentiality and authentication. If you capture the 4-way handshake and successfully brute force it offline, you can derive the key that is used to encrypt the data. SSH, on the other hand, uses public key cryptography. The SSH password, if one is even used, only performs authentication. The actual encryption key is generated randomly and is much too strong to brute force. The key agreement algorithm (ECDHE in most cases) is likewise too strong to attack. You could try to, but it would hold until the sun goes out.

Even if you could guess the authentication password (which would have to be brute forced online, which is noisy and slow), you would not be able to retroactively decrypt any captured session data.

How WPA2 exchanges keys

WPA2 exchanges encryption keys using the 4-way handshake, or 4WH. This handshake itself is encrypted by a key that is derived from the WPA2 password by passing it through an algorithm called PBKDF2. The encrypted 4WH allows both parties to hold all the necessary secrets required to establish a secure connection. An attacker can attempt to guess the password by rapidly feeding many possible passwords into PBKDF2 and using the output to attempt to decrypt the 4WH. If the decryption succeeds, the password has been found. The 4WH is decrypted and the encrypted session data can be retroactively decrypted using the derived secrets.

Note that this only applies to WPA2 Personal, not WPA2 Enterprise which is more secure.

How SSH exchanges keys

SSH works differently. Rather than using the user-supplied password to encrypt data, the password is used exclusively to authenticate the client to the server. Even before the client is authenticated, a key agreement takes place. This involves the client and the server both generating a public and private key and sending each other their public key. The client and server then perform calculations on the other's public key and their own private key. The mathematics of the algorithm, typically a variant of the Diffie-Hellman algorithm, works such that both calculations produce the same secret value. The encryption keys are then derived from this shared secret. Even if you capture both the client and server's public keys, you won't be able to figure out the shared secret.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .