I have searched this site for RSA1 with no results. From multiple google searches I have understood that RSA1 was used in SSH1 (which isn't recommended). However if its a single algorithm why are there two different ones?

A bit of background on my setup/understanding:

  • I recently implemented OpenSSH on Ubuntu to script file sending (via scp) to a customers server
  • How I understand SSH (as I think I might be missing something):
    1. client connects to server
    2. server offers public host key
    3. client accepts
    4. encrypted authentication happens (via password or client public key)
    5. server accepts
    6. shell started (all future content is encrypted with client public key, then decrypted by client private key)
  • Another question: are there certain ciphers (such as RSA1) not allowed by OpenSSH Protocol 2 or SSH2 in general?
    – gregg
    Commented Feb 27, 2013 at 16:59

1 Answer 1


In version 1 of the SSH protocol, the server has a RSA key (always) and the client asymmetrically encrypts a random blob with the server's public key. The random blob is then used as basis for the session key which will be used to encrypt the data.

In version 2 of the SSH protocol, client and server use Diffie-Hellman (or an elliptic curve variant thereof) to established a shared session key. The server signs his half of the protocol with his key, which might be RSA or DSA.

While RSA encryption and RSA signature can both use the same kind of mathematical object (a "RSA key"), they are nonetheless distinct algorithms. The SSHv2 way additionally offers Perfect Forward Secrecy, which is good (if someone steals the server's key, he can decrypt past SSHv1 connections that he recorded, but not so with SSHv2 connections).

In the SSH model, the client makes sure that it talks to the right server by remembering the public key of each server (that's the .ssh/known_hosts file). When it encounters a new key (a server to which the client never connected yet), it wants to display something which the human user may use to confirm that the public key from the server is genuine. The fingerprint is a hash value; the user is then supposed to phone the intended server's sysadmin, to dictate the fingerprint and get confirmation that's it is the right one.

The "random art" is a visualisation of the fingerprint in a way which is supposed to be easily remembered by a human eye & brain. The idea is that the user first memorizes the "art" associated with the server, and later on visually checks that the recomputed "art" is the same. (Intended scenario: being able to use random client machines while travelling.)

Personally I prefer to learn by heart the fingerprint; at least I can compute the success probability of the attacker. Better yet, I travel with my own device, which at least should be less virus-ridden than a random machine from an Internet café.

  • Thanks for your thorough response. My brain is struggling to understand your response: -I have heard blob being thrown around, no idea what it is. Read wiki article for binary blob & still don't completely understand & think that may be the wrong one -Session key is the attempt at encrypting the actual conversation (future commands/content); not the authentication? I think it might be helpful if you know of an article with a thorough breakdown/walk-through of a SSH session
    – gregg
    Commented Mar 1, 2013 at 17:10
  • 1
    There one question regarding this. Does SSHv2 enabled Perfect Forward Secrecy by default? Thanks Commented Sep 12, 2013 at 20:12
  • 2
    SSHv2 always use a Diffie-Hellman temporary key pair, so yes, you have PFS by default. To NOT have PFS, the SSH client or the SSH server would have to go how of its way and store in a file a copy of its temporary DH private key. A malicious, hostile implementation can always do that, of course.
    – Tom Leek
    Commented Sep 12, 2013 at 20:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .