How can I get the symmetric encryption key used by SSH?

Question

I'm looking into a Wireshark trace made by myself, and I wanted to see what the client sent to the server and what the server replied in the encrypted application data stream. While I see what method was used for encryption (ChaCha), I obviously can't see the symmetric encryption key, which was negotiated using Diffie Hellman.

Is there an option for ssh or sshd to print or log the secret key used in the symmetric cipher?

Answer 1

No. You would have to recompile openssh to get this information from the client. All the keys are derived in kex.c.

Note that there are 6 of them derived from the shared secret, 2 IV, 2 for encryption and 2 for MAC (different for both directions).