Why does SSH use public key crypto each time you connect to the server? RSA/DSA are computationally expensive, so why can't they just be used the first time to share a secret, and then in the future the shared secret can be used both for authentication with MACs and encrpytion with AES?

  • The first thought is: how does one expire that shared secret? – schroeder Aug 30 '15 at 18:17
  • @schroeder Either party could expire the secret by requesting a new secret using public key crypto. Thus both parties are in control of the security – Elliot Gorokhovsky Aug 30 '15 at 18:21

If such computation is a concern for you (for instance if you have a lot of successive connections), depending on your usage you may be interested in SSH ControlMaster Session feature. It allows SSH to multiplex several sessions inside one TCP connection, so the handshake is realised only once then each new session can just reuse the already established channel without going through a full-fledged authentication again.

Of course, as soon as the ControlMaster session is ended, the authentication will be required again.

SSL implements an idea as yours, where the server can keep a cache of previously established SSL sessions and a client can recall such a session to avoid the authentication overhead. But SSL is designed to ensure the security of protocols which may produce a relatively large number of successive and very short TCP connections (think of all the different files retrieved to construct a web page: HTML code, style sheets, pictures, scripts, etc., even if HTTP 1.1 also brought his own solution to such issues).

Usual use-cases of the SSH protocol do not present the same behaviour. SSH sessions are usually few and long, so either the authentication overhead is accepted as presenting a relatively low impact compared the whole session activity, or a master session could be established covering all the underlying requests.

| improve this answer | |

The computation is not that heavy regarding the security advantages because if the server is spoofed or compromised, the attacker can not get the private key (and pwd); at best he can the signature which can not be very interesting for him because a signature cannot be re-used: that is why it is a worth while to perform some calculations for the sake of safety.

Add to this, the fact that one does not access his server that much (as when it comes to using a Facebook account, for instance), waiting a little bit for the computation to be performed is not that dramatic.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.