Is there at present a way to open a SSH connection using pre-existing symmetric session keys?

In other words, if I create a list of symmetric keys can I send that list to the recipient on a CD or USB key (or otherwise) and we can then connect without the use of a key exchange algorithm that generates and transmits the session key over the wire.

My once-over of RFC4253's a key exchange section indicates that some sort of key exchange is mandatory, typically but not necessarily being one of Diffie-Hellman (RFC4419), RSA (RFC 4432), or GSSAPI (RFC4462). I was wondering if anyone had ever implemented external, pre-existing session keys.

The algorithm for such a key exchange is degenerate, falling into one of at least two possible categories: one-time use or temporal.

For one-time use, the key-exchange would be the client saying use key N where N is the next key the client believes to be unused. If the fifth key had already been used by the server, then the exchange fails. The client can then try the N+1. If the connection succeeds, the server then increments a next-valid-key index.

One close alternative is to use date/time-based keys, where the chosen key is based on the date and time. In this way the keys would have a predictable temporal lifespan. One could, for example, share keys for the next 5 years with 15 minute granularity – for 256 bit (32 byte) AES keys this is only ~3.5MB (3,506,400 bytes).

In any case, I would think there are folks who have done this but my searches have yielded no luck. The clear disadvantage is that the keys will have to be exchanged from time to time in another manner, but the symmetric keys need not ever be transferred over the same connection (or even medium) as the encrypted communication.

There seems to be no built-in option for this. With OpenSSH_6.6p1, OpenSSL 1.0.1g 7 Apr 2014 on OS X/Mavericks, the kex algorithms are:

$ ssh -Q kex

Is SSH inherently capable, or has anyone extended it, to implement a key exchange (or no key exchange at all) of the sorts described above?

  • I'm curious why do you want to do this? Is the idea that if some group broke the common trapdoor functions (prime factorization, discrete log, elliptic curve discrete log) underlying Diffie Hellman and ECDH (as well as RSA, DSA), but symmetric ciphers are still strong then you want to have a protocol to rely on pre-shared symmetric ciphers? – dr jimbob May 7 '14 at 19:36
  • @drjimbob: It just seems to be an interesting way to reduce or alter the attack surface. There are undoubtedly chinks in the algorithms and implementations, and cases where perhaps this could be useful to rely on, but I am really asking out of curiosity. – Brian M. Hunt May 7 '14 at 19:51
  • @BrianM.Hunt I don't understand how this reduces the attack surface. You're saving a step of key exchange, but you're introducing another step of key exchange. – Gilles 'SO- stop being evil' May 7 '14 at 20:36
  • @Gilles - it is intrinsic; e.g. There are surfaces on key exchange not under this model: 1. The key generation entropy; 2. The asymmetric fn math; 3. The asymmetric fn implementation. An ex ante key exchange has issues too! But they are different and avoidable. Entropy and exchange medium could be issues with the pre-shared, but addressable. At worst the pre sharing surface is the same as the asymmetric exchange. It could though remove possibly attackable steps. Sorry for laconic- typing on mobile. – Brian M. Hunt May 8 '14 at 0:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.