Aaah I don't know whats with my brain this morning... Anyway... I failed at the part where New key is sent... Doughnut should be encrypted as a part of new password to prevent operator from extracting it and sending its own key...
Send(EncryptWithPubKey("doughnut" + NewKey)); // + means concat

This way, security problem no longer exists...

Advanges? I don't know how ssh works in detail.

Reply via email to