I’m new to Wireshark (and packet-capturing in general). I’d like to have the ability to create the keylog file apparently needed by Wireshark to decrypt SSH packets; after some research, I would’ve successfully done so for TLS/SSL traffic, but I don’t know how to do so for SSH. I know there’s already a thread that asked this same question, but my use-case is different and the link that the only reply gave (for configuration of the keyfile) is broken. I’m not asking this for any nefarious reasons, but only to see the contents of my own SSH traffic within my local network (it’s the same premise for TLS/SSL, in that it’s only to decrypt and analyze packets that only involve me). Thanks for listening.
A simple google search would tell you it is impossible unless shared secret from Diffie-Hellman key exchange is known.
See also SSH - Wireshark Wiki
With all due respect, I’m already aware of that (I even looked at the same link you just referenced), just like it’s impossible to decrypt TLS/SSL packets unless the necessary secrets for those packets are known (that’s fundamentally how any encryption system works—you can’t see the plaintext data with the necessary key(s)). Well, it’s simply that I’ve noticed that Wireshark had an option for adding a keylog file analogous to its SSL/TLS option.
Plus, there’s this line here from the same source you’ve referenced: "Decryption can be enabled by supplying a key log file. This text file must follow the following format:
Every line consists of a cookie, key type, and key separated by one space. The cookie is a hex-encoded 16-byte value (32 characters) found in the SSH_MSG_KEXINIT sent during algorithm negotiation by the endpoint whose private random is disclosed. The key type is either SHARED_SECRET or PRIVATE_KEY. The key is hex-encoded and either the shared secret (‘K’ in RFC 4253) or the private random number (referred to as ‘x’ for the client and ‘y’ for the server in RFC 4253) used to generate the shared secret during DH key exchange; its length depends on the algorithm.
The cookie is used to identify the session, and either the SHARED_SECRET is used directly, or is derived from the PRIVATE_KEYs from both sides.
The key log file can be embedded in a pcapng Decryption Secrets Block."
Again, I understand that it’s impossible without the necessary encryption secrets, but I’m respectfully asking for a way to derive those secrets.
I was just pointing to the link to gitlab in this url, Add SSH decryption support (#16054) · Issues · Wireshark Foundation / Wireshark · GitLab
It is IN_PROGRESS since 2019, but you may ask there or read the code, or help to let it work.
Thanks for the advice. I’m new to Wireshark and packet analyzing, so I found it interesting/amazing that Wireshark at least has the functionality for decrypting otherwise protected network packets (e.g., SSL/TLS) and wanted to enjoy more of those features. Hopefully, the SSH decryption support arrives in due time.