Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

What format does SSH use to exchange (encrypted / plain) packets before new keys are derived? SSH Document says that after key exchange, client and server use negotiated algorithm to encrypt the packet. If they are encrypted even before key exchange then which key is used to encrypt the packet.

share|improve this question
add comment

1 Answer

In SSH 2, key exchange is done using the Diffie-Hellman key exchange. It is best described on the Wikipedia page (the link). Also on the Wikipedia page are a lot of links to documentation (RFCs) containing nitty gritty details. Wikipedia or Google is probably best to find out more about Diffie-Hellman.

As a cool experiment you can download Wireshark and try recording an SSH session, to see how it works:

This is a Wireshark capture of (some of) an SSH-2 session

This is a Wireshark capture of (some of) an SSH-2 session. It is not a full picture, but shows the key exchange. Subsequent packets are encrypted directly after.

SSH can be done with Putty

And to be clear: the key exchange is not encrypted, but it is done in a very clever way, invented by two hippies in the 70's.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.