> >> From sshd(8):
>
> > -k key_gen_time
> > Specifies how often the ephemeral protocol version 1 server key
> > is regenerated (default 3600 seconds, or one hour).
>
> Hmmm. But a server key isn't the same as a session key, is it? Is this
> an argument for renegotiating session keys at all?
The server and client can kick off a key renegotiation. Generally
it's left up to the client from what I can tell. The key specified
above is the public key used before the session is encrypted so that
makes sense to rekey... once encrypted though, I don't think it's
necessary to rekey that often. 10MB would likely be a nice and
conservative level that should be outside of the scope of most
PostgreSQL transactions. -sc
--
Sean Chittenden