Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have often advised people to use an SSH tunnel to secure their browsing on open WIFIs or in other insecure situations.
I was recently asked by a friend how secure a SSH tunnel is after I had suggested SSH tunneling. I stumbled a bit and reiterated "its secure".

Even though he was satisfied with this answer it bugged me a bit that I couldn't fully answer.
So the question goes out to you guys:

"How secure is an SSH tunnel?"

share|improve this question
Short comment; Providing a SSH tunnel is used, the security of that connection is only as good as its endpoints. Meaning that if someone/something has lowlevel access to OS or network, it is possible to hook into the carrier and read the content of the tunnel. – Mogget Oct 1 '15 at 13:00
up vote 21 down vote accepted

I'd just like to quote a little from Wikipedia here:

Even if a symmetric cipher is currently unbreakable by exploiting structural weaknesses in its algorithm, it is possible to run through the entire space of keys in what is known as a brute force attack. Since longer symmetric keys require exponentially more work to brute force search, a sufficiently long symmetric key makes this line of attack impractical.

With a key of length n bits, there are 2n possible keys. This number grows very rapidly as n increases. Moore's law suggests that computing power doubles roughly every 18 to 24 months, but even this doubling effect leaves the larger symmetric key lengths currently considered acceptably well out of reach. The large number of operations (2128) required to try all possible 128-bit keys is widely considered to be out of reach for conventional digital computing techniques for the foreseeable future. However, alternative forms of computing technology are anticipated which may have superior processing power than classical computers. If a suitably sized quantum computer capable of running Grover's algorithm reliably becomes available, it would reduce a 128-bit key down to 64-bit security, roughly a DES equivalent. This is one of the reasons why AES supports a 256-bit key length. See the discussion on the relationship between key lengths and quantum computing attacks at the bottom of this page for more information.

So a 128 bit key would have 340,282,366,920,938,463,463,374,607,431,768,211,456 possible permutations. Imagine going through all those. Even a powerful desktop computer can only try a few per second.

So although it's theoretically possible to brute-force decrypt an SSH stream, by the time the key has been decrypted by the most powerful computer imaginable two things would have happened:

  1. The key would have been changed by SSH
  2. We would all have died and the sun exploded and destroyed the earth.
share|improve this answer
+1 In just 12 seconds I learned that I and everyone I know is going to die and the sun is going to explode. – ioSamurai Jan 15 '13 at 14:04
@ioSamurai Meh... no, the sun will not explode, it is far more complex than that. – Doorhandle Dec 19 '14 at 3:53

The real problem of SSH security is certificates. A lot of companies will give out secure keys for SSH connections, and it is not the first time the databases containing these keys get hacked. So the best solution to be secure is to generate your own key-pair, but that is a hassle, and that is whay we rely on these companies... Until they get hacked and we don;t have to check 340,282,366,920,938,463,463,374,607,431,768,211,456 keys but only the onces in the database..

share|improve this answer
Generating a keypair for SSH is hardly a hassle: you click a button or type a command, and wait a few seconds. I've never heard of anyone using a third-party SSH key-generator service. You should never rely on someone else to generate a private key for you. – Wyzard Feb 19 at 23:06

<disclaimer: not an expert on cryptography>

SSHv2 uses mostly the same algorithms as TLS/SSL:

  • DH, recently ECDH or RSA for key exchange;
  • RSA, DSA or ECDSA for server authentication (and very often, client authentication).
  • AES for symmetric encryption (the entire data stream is encrypted using a randomly-generated key).

All of them are widely used and proven secure for everyday use.

However, in any protocol, security depends on knowing that you are communicating with the right server. In the case of SSH (standard configuration), the first time you connect to the server you have to verify its fingerprint. (Don't just confirm it without actually checking, as many people do.) The next time, the server's key will be checked against a cached copy to prevent man-in-the-middle attacks – but only if the right key was cached in the first place.

(In comparison, TLS/SSL handles the above by using X.509 certificates issued by well-known authorities which are trusted to not sign bogus certificates.)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.