Assuming the nodes themselves are not compromised (big ask) and identity can be confirmed(like via key exchange), state actors can listen as much as they want to the wires, they won't be getting much.
Except if some private key were out there...
Please explain, I was under the impression that the above could not reasonably be claimed anymore with any kind of certainty [1][2][3]. Perhaps I'm misunderstanding something important here or the 'Happy Dance!!' slide [4] made me paranoid.
[1] http://arstechnica.com/security/2016/10/how-the-nsa-could-pu... [2] http://arstechnica.com/security/2016/08/cisco-firewall-explo... [3] http://arstechnica.com/security/2015/10/how-the-nsa-can-brea... [4] http://www.spiegel.de/media/media-35515.pdf
Of course router/firmware exploits cannot be prevented in the general case, so NSA-likes could figure out a way get in. But the null hypothesis is still that the NSA cannot crack strong encryption without some sort of pre-built backdoor IMO.
Based off of the leaks, NSA gets into things via two ways: - poisoning the encryption methods - social engineering/legal coercion to get keys