6

What format does SSH use to exchange (encrypted / plain) packets before new keys are derived? SSH Document says that after key exchange, client and server use negotiated algorithm to encrypt the packet. If they are encrypted even before key exchange then which key is used to encrypt the packet.

Improve this question

1 Answer 1

Reset to default
9

In SSH 2, key exchange is done using the Diffie-Hellman key exchange. It is best described on the Wikipedia page (the link). Also on the Wikipedia page are a lot of links to documentation (RFCs) containing nitty gritty details. Wikipedia or Google is probably best to find out more about Diffie-Hellman.

As a cool experiment you can download Wireshark and try recording an SSH session, to see how it works:

This is a Wireshark capture of (some of) an SSH-2 session

This is a Wireshark capture of (some of) an SSH-2 session. It is not a full picture, but shows the key exchange. Subsequent packets are encrypted directly after.

SSH can be done with Putty

And to be clear: the key exchange is not encrypted, but it is done in a very clever way, invented by two hippies in the 70's.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .