38

When you are connected to another computer over SSH, is all data transferred between the two computers encrypted? Or is any data sent in plaintext or any other "easy to intercept" format?

  • Note: Look up the Diffie–Hellman key exchange method for an example that builds a shared secret upon a non-secured channel in the presence of an eavesdropper. – user47081 May 22 '14 at 14:27
  • No. - The public keys that are established are not encrypted. This is intentional and isn't a security risk. – user10800 May 22 '14 at 23:34
61

For any protocol, you could come up with a definition of "all data" that would necessarily imply that something isn't sent encrypted.

For example, during the initialization and key exchange, the algorithm selection is public. Your average cryptographer will give you little more than a raised eyebrow if you complain about that fact though, since obviously it can't be encrypted as you haven't selected an algorithm yet.

Obviously something has to be sent unencrypted if for no other purpose than to set up encryption. But once the connection is secure, everything is secure. Once you have an encrypted channel, nothing from that point on is sent outside that channel. Furthermore, the protocol is extremely cautious to avoid sending any sensitive data before encryption is available. No username, no password, no identification of any sort, no indication of purpose, or any of that.

What little there is to decode is readily decode-able using common free tools such as wireshark. Fire up a packet capture, start an SSH session, and examine the exchange yourself. You'll see immediately what can be seen and what can't. Wireshark does a great job at decoding the protocol to allow you to view the internals of how it works.... to the extent that it's visible to someone watching the network traffic.

The typical flow looks like this:

  1. SSH version/software identification
  2. Key exchange init (algorithm selection)
  3. Diffie-Helman key exchange (uses SSH host key to prevent MITM)
    Everything after this is encrypted
  4. User authentication (including user key-based authentication)
  5. SSH Session now activate
  • 1
    What if a password is used for authentication instead of logging in with a public key? – IQAndreas May 22 '14 at 7:00
  • 6
    @IQAndreas the encrypted session is set up before any authentication is attempted. – tylerl May 22 '14 at 7:09
  • 13
    @IQAndreas: Your login key is not the same as the server's SSH key. No matter how you login, the SSH session has already been established. – Lightness Races in Orbit May 22 '14 at 9:23
  • 1
    I think that point should be added to the answer. – Cthulhu May 23 '14 at 4:28
  • @tylerl Actually the public key of the server is encrypted. That's not because the public key needs to be kept secret, but rather because the SSH protocol is designed to negotiate a session key and enable encryption, before it does anything else. – kasperd May 23 '14 at 6:23

protected by Community May 23 '14 at 8:50

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.