RSA relation to SSH key exchange

Question

I do not fully understand SSH. I was hoping someone could fix my confusion.

When you generate an ssh key pair, you create four files.

authorized_keys, id_rsa, id_rsa.pub and known_hosts

My confusion comes from that fact that RSA is an encryption tool, you release a public key pair (n,e) but in the id_rsa.pub file, there is no pair, it's just one gigantic string, where does it split?

Furthermore, how does SSH create a server side password check, RSA is used for encrypting messages, how does them having my public key, combining with my private key create some sort of password confirmation, RSA is used for encrypting messages not password authentication?

Answer 1

known_hosts has nothing to do with public key authentication. It's a list of servers you've previously connected to and fingerprints of their SSH keys to help verify the connection to the server is not being man-in-the-middled.

authorized_keys is a file stored on the server containing the SSH public keys of users authorized to log in to the server.

id_rsa is the private key. id_rsa.pub is the public key. The public key is encoded according to the format in RFC 4253, but basically it's a PEM-encoded blob that contains the key type, length, and the values n and e.

Public key authentication does not involve passwords at all. There's no "password confirmation" step at all. When the client connect, it offers the keys it has to server. If the server can use one of those to connect, it asks the client to sign metadata about the request, including data provided by both the client and server. The client takes the request data, signs it with the private key, and then sends it back to the server. The server verifies the signature of the blob, which shows that the client possess the correct private key (matching one of the public keys in authorized_keys) and grants access.

Answer 2

With regard to ...but in the id_rsa.pub file, there is no pair, it's just one gigantic string, where does it split?:

First and foremost, the private key file contains the pair of large primes, the public key file contains the product of these two large primes (this is called the 'modulus').

Although the private key and public key files produced by ssh are not PEM files per se (as pointed out by dave_thompson_085), you can use openssl to read these files and see the underlying pair of large primes in the private key file, and see the modulus in the public key file. Furthermore, you can verify that the modulus in the public key file is in fact the product of the pair of large primes in the private key file. See my answer at https://crypto.stackexchange.com/questions/45151/anatomy-of-an-rsa-private-key/78460#78460 for the steps. (Although this answer is written in the context of RSA private and public key files produced by openssl, the same steps can be used with RSA private and public key files produced by ssh).

Answer 3

Ignore authorized_keys and known_hosts for now.

I don't think the "pair of big primes" is in the public digest, it's more akin to a hashed scramble, irreversible and asymmetric. The split you speak of is done with the private key (somehow).

RSA is not used for symmetric decryption of your (ssh) state channel, new, ephemeral AES-128/AES-256 type keys are used (actually Chacha now?), modern stream cyphers rolling one byte per time. Every new ssh connection probably has new ephemeral stream cyphers generated, and long running sessions maybe shift keys each hour!

Apart from the SSL wrapping the entire connection, the ephemeral keys are sent somehow using a blend of a portion of the (presumed) prime number that only a certain person could hold? Dunno how this part works, say your challenge is the number 2 and the public key 4162.574257426 only the owner could deduce the ephemeral authenticate magic phrase maybe is 840840 because (420420 / 101) * 2 = 840840.

It is immune to a replay attack because a new challenge number or nonce is generated at the server side: lets say the new nonce is 3, your secret primes (oops, 420420 is not a prime my bad) will produce the answer 12487.722772277 that being 420420 / 101 but multiplied by 3 in this case, changing maybe called a nonce (nonsense).

The old RSA private key files are specially formatted. The two large primes are extracted from this file an agent on your machine similar to:

openssl rsa -noout -text -inform PEM -in 4096-id_rsa
RSA Private-Key: (4096 bit, 2 primes)
modulus:
    00:f1:be:ce:47:2c:30:65:c0:94:9d:a6:b3:8e:21:
    06:06:8f:c2:ad:59:d7:dd:e9:18:41:6b:75:25:60:
    87:2b:87 (greatly shortened enormous string)
publicExponent: 65537 (0x10001)
privateExponent:
    2c:fe:9c:9a:36:a9:53:67:02:c2:4d:12:c2:73:a3:
    1a:f6:fe:b3:3a:db:de:07:65:f5:73:04:d7:f0:04:
    83:01 (shortened quite long enormous string)
prime1:
    00:f9:4d:fb:6e:52:bd:ba:d7:0b:41:a3:94:b1:c6:
    a1:02:b7:27:38:0d:72:5c:d2:2e:5f:ce:e1:0d:88:
    ae:c1 (I can see two on my terminal at once)
prime2:
    00:f8:3c:da:21:d8:ae:9d:93:47:d9:ee:3d:e9:6b:
    27:f9:0d:27:fe:4c:b0:66:9f:8b:9d:d6:cf:93:7f:
    b4:47 (I can see two on my terminal at once)
exponent1:
    0c:af:ba:36:c0:01:25:ab:e1:c7:c2:52:43:c5:a7:
    40:2a:1f:d5:cb:61:61:75:d4:a4:4d:7b:c8:5b:87:
    41 (not sure why - these are also bigger than my primes)
exponent2:
    00:ec:fb:fb:2b:30:d7:92:eb:96:3e:c1:a9:2d:7b:
    c0:c3:8d:01:cf:4e:9b:61:7d:93:26:7e:7a:f0:cf:
    8b:e5 (not sure why - these are also bigger than my primes)
coefficient:
    79:7a:00:14:81:9d:a8:ba:a9:2c:24:df:07:c4:2d:
    a9:e3:63:bd:f0:5f:83:b2:b5:74:1b:4e:72:c9:5a:
    ff (not sure why - these are also bigger than my primes)