As I understand it, when two systems create a secure SSH tunnel, the first step involves communicating the 'guidelines' for the encryption of that tunnel. If an third system is able to listen in on this initial conversation, wouldn't it be able to decode all of the data that is sent through the tunnel? How is the tunnel secured if the initial conversation is conducted across a public connection?
The good old safe-with-two-locks analogy:
Alice has a safe with a message for Bob. (The message is what you refer to as
the 'guidelines' for the encryption of that tunnel).
She locks the safe with the message in it with her lock (and keeps the key).
Bob receives the safe, but cannot open it. Instead, he adds his lock on the safe, and send the safe back to Alice
Alice, now satisfied that the safe is locked with Bob's lock, removes here own lock (with her private key), and send the safe again
Bob receives the safe, with his lock only on it, and can now open it.
This is the basics of how exchanging private information over a public network works, with an asymmetrical key for each participant.
Through this mechanism, Alice and Bob are able to exchange information as to how to establish the encrypted connexion.