My basic understanding is this:
- The (connected to) server's
sshduses the public key to encrypt some message
- The client's
ssh-agentdecrypts it and sends something back (the message's checksum? its signature?)
- The server's
sshdverifies that this is consistent with the message to authenticate the user
But what are the details? What is the "some message", what does
ssh(-agent) send back? Would doing this with the same original message over and over again always yield the same communication?
Can this authentication process be replayed via bash tools if
ssh-agent is used? E.g. the public keys that
ssh-agent provides can be obtained via
ssh-add -L, what about the rest of the process? Or would that require manually connecting to the
$SSH_AUTH_SOCK unix socket and some low-level communication?
Related: Thomas' Server-Bob dialogue here, though that suggests the client just signs some random data that will then be checked against all public keys of the server user's
authenticated_keys. This illustration on the other hand claims the message is encrypted to the previously determined user's public key (not the one for the ssh encryption) and the client outputs the checksum which also depends on some random session ID. Which one is correct? Or do both only tell part of the actually more complex story?