When you are connected to another computer over SSH, is all data transferred between the two computers encrypted? Or is any data sent in plaintext or any other "easy to intercept" format?

  • Note: Look up the Diffie–Hellman key exchange method for an example that builds a shared secret upon a non-secured channel in the presence of an eavesdropper.
    – user47081
    May 22, 2014 at 14:27
  • No. - The public keys that are established are not encrypted. This is intentional and isn't a security risk. May 22, 2014 at 23:34

1 Answer 1


For any protocol, you could come up with a definition of "all data" that would necessarily imply that something isn't sent encrypted.

For example, during the initialization and key exchange, the algorithm selection is public. Your average cryptographer will give you little more than a raised eyebrow if you complain about that fact though, since obviously it can't be encrypted as you haven't selected an algorithm yet.

Obviously something has to be sent unencrypted if for no other purpose than to set up encryption. But once the connection is secure, everything is secure. Once you have an encrypted channel, nothing from that point on is sent outside that channel. Furthermore, the protocol is extremely cautious to avoid sending any sensitive data before encryption is available. No username, no password, no identification of any sort, no indication of purpose, or any of that.

What little there is to decode is readily decode-able using common free tools such as wireshark. Fire up a packet capture, start an SSH session, and examine the exchange yourself. You'll see immediately what can be seen and what can't. Wireshark does a great job at decoding the protocol to allow you to view the internals of how it works.... to the extent that it's visible to someone watching the network traffic.

The typical flow looks like this:

  1. SSH version/software identification
  2. Key exchange init (algorithm selection)
  3. Diffie-Hellman key exchange (uses SSH host key to prevent MITM)
    Everything after this is encrypted
  4. User authentication (including user key-based authentication)
  5. SSH Session now activate
  • 1
    What if a password is used for authentication instead of logging in with a public key?
    – IQAndreas
    May 22, 2014 at 7:00
  • 7
    @IQAndreas the encrypted session is set up before any authentication is attempted.
    – tylerl
    May 22, 2014 at 7:09
  • 13
    @IQAndreas: Your login key is not the same as the server's SSH key. No matter how you login, the SSH session has already been established. May 22, 2014 at 9:23
  • 1
    I think that point should be added to the answer.
    – Cthulhu
    May 23, 2014 at 4:28
  • @tylerl Actually the public key of the server is encrypted. That's not because the public key needs to be kept secret, but rather because the SSH protocol is designed to negotiate a session key and enable encryption, before it does anything else.
    – kasperd
    May 23, 2014 at 6:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .