Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If I simply connect to an SSH server, get its key fingerprint, and immediately disconnect, does the SSH protocol ensure that the server also had the private key in order to get that far into the handshake?

That is, could this entire connection have been spoofed by someone pretending to be the server, but did not possess the server's private key?

share|improve this question
up vote 12 down vote accepted

No, this is not possible. Depending on the key exchange mechanism in use, there are (slightly) different mechanisms for proving the identity of the server. This is defined in RFC4253 where it requires "explicit server authentication." In the case of RSA (RFC 4432), the server signs a piece of data provided by the client (actually a hash of several pieces) with its private key and sends it back to the client. This signature proves that the server is in possession of the private key. Without this, there would be no protection at all against MITM attacks on SSH.

share|improve this answer
Thanks for a clear answer. Do you know which one of the many SSH RFCs that mentions this? – Belorn Jun 21 '14 at 18:30
I've added mentions of the specific RFCs, but basically RFC4253 for the general concept, RFC 4432 for the RSA implementation – David Jun 21 '14 at 18:50

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.