1

With SSH, most of my servers use ed25519 (the twisted Edwards variant EC) for authentication.

I was wondering, after authentication with ed25519, does SSH protocol 2 simple use ephemeral/ephemeral ECDH over curve25519 for the session key?

I can't see what else it's doing unless it converts the ed25519 x,y co-ordinates to curve25519 Montgomery variants to establish the session key.

Example output verbose is:

debug1: kex: algorithm: curve25519-sha256
debug1: kex: host key algorithm: ssh-ed25519
debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug1: Server host key: ssh-ed25519 SHA256:KvJtkvHyH/+oU3VaDDMQbUHIyI9P+LDLv0FqLdrfmEk
debug1: Host 'ubuntu-prime.local' is known and matches the ED25519 host key.
debug1: Found key in /Users/john/.ssh/known_hosts:40

My question is, what curve25519 keypairs are being used here?

2

It uses ephemeral (single use) Curve25519 points in X25519 (Curve25519 ECDH) for key agreement and static long term Ed25519 keys for authentication. Like basically every other protocol from around the same era.

If you want to know how some cipher suites for SSH work, you should read the RFCs or openssh documentation (for their extensions). For example:

https://tools.ietf.org/html/draft-ietf-curdle-ssh-curves-12

https://tools.ietf.org/html/draft-ietf-curdle-ssh-ed25519-ed448-11

| improve this answer | |
  • Thanks makes sense. Couple of minor points, it’s ephemeral on both sides right? Also when you say that era, is there a better way? – Woodstock Jan 3 at 23:52
  • 1
    It should be ephemeral on both sides, reusing ECDH is bad (some TLS servers reuse ECDH keys, but I don't think openssh ever does). I guess Noise protocol that doesn't need ed25519 code is more elegant, but x22519+ed25519+chapoly is the current best practice and next upgrade is post quantum crypto when the recommendations for that are settled. – Z.T. Jan 3 at 23:57
  • Thanks @Z.T. - appreciate it. – Woodstock Jan 4 at 8:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.