I have a problem spotting both "DH base (G)" and "DH modulus (P)" in my sshv2 trace. I scrutinized each message exchanged between both my ssh client and the ssh server, there is no trace of "DH base (G)" and "DH modulus (P)". I tried even to filter my trace using ssh.dh.p and ssh.dh.g nothing comes out. The trace does not contain the message "Diffie-Hellman GEX Request". Is there an interpretation of this result?

  • In SSH protocol, you can use various key exchange methods from which only few are DH GEX. First of all, turn on debug log in the client or server and have a look what key exchange method is used. – Jakuje Jun 4 '17 at 17:56
  • How would both the client and the server agree then on the generator and the modulus if there are no such exchanged messages since they are using Diffie-Hellman key exchange scheme? – sasuke Jun 4 '17 at 21:29
  • If they agree on DH-group1 then they use the p,g defined for that group, which is really Oakley/IKE group 2. If they agree on DH-group14 then they use the p,g defined for Oakley/IKE group 14. Read RFC 4253 section 8. – dave_thompson_085 Jun 5 '17 at 2:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.