With SSH, most of my servers use ed25519 (the twisted Edwards variant EC) for authentication.
I was wondering, after authentication with ed25519, does SSH protocol 2 simple use ephemeral/ephemeral ECDH over curve25519 for the session key?
I can't see what else it's doing unless it converts the ed25519 x,y co-ordinates to curve25519 Montgomery variants to establish the session key.
Example output verbose is:
debug1: kex: algorithm: curve25519-sha256 debug1: kex: host key algorithm: ssh-ed25519 debug1: kex: server->client cipher: email@example.com MAC: <implicit> compression: none debug1: kex: client->server cipher: firstname.lastname@example.org MAC: <implicit> compression: none debug1: expecting SSH2_MSG_KEX_ECDH_REPLY debug1: Server host key: ssh-ed25519 SHA256:KvJtkvHyH/+oU3VaDDMQbUHIyI9P+LDLv0FqLdrfmEk debug1: Host 'ubuntu-prime.local' is known and matches the ED25519 host key. debug1: Found key in /Users/john/.ssh/known_hosts:40
My question is, what
curve25519 keypairs are being used here?