Identifying the Encryption Algorithm of SSH Session Keys

Identifying the encryption algorithm is a crucial part of extracting the SSH session keys. Knowledge of the encryption algorithm is required since it involves the decryption attempt of ciphertext. Memory heap dumps contain valuable information, such as cryptographic keys, that can be obtained through memory forensics. This study proposes SSH session keys extraction tool to assist digital forensics investigators. The first step is to determine the SSH encryption algorithm by inspecting SSH communication in the network capture. Second, the SSH session keys on the memory heap dump are localized using SmartKex model. Finally, the tool made an attempt to decrypt the SSH session keys. The test results demonstrate that the proposed tool successfully identifies nearly all the keys in the test dataset while delivering efficient performance.