Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I need to understand SSH key exchange, I have tried to read RFC document but it seems very difficult to understand so I have captured packets using wireshark ,I found various packets for ssh keyexchange

SSHv2 Client: Key Exchange Init
SSHv2 Server: Key Exchange Init
SSHv2 Client: Diffie-Hellman Key Exchange Init
SSHv2 Server: Diffie-Hellman Key Exchange Reply
SSHv2 Client: Diffie-Hellman GEX Init
SSHv2 Server: Diffie-Hellman GEX Reply
SSHv2 Client: New Keys

Can any one explain me each packet in detail or sequence of ssh key exchange ??

share|improve this question
    
It's not clear what information you are looking for. However have you tries initiating an SHH session while uning the verbose switch a few times? ie ssh -vvvv user@1.1.1.1 –  kalikid021 Apr 11 at 20:38
    
Do you actually have a problem you are trying to solve? –  Matthew Ife Apr 11 at 20:54

1 Answer 1

up vote 8 down vote accepted
+50

First of all you should understand the concept of a Diffie-Hellman exchange. It allow to establish a channel between 2 endpoints with these features:

  • Protects against eavesdropping. Someone sniffing on the channel cannot decrypt it.
  • Diffie-Hellman Does NOT protect against man-in-the middle attacks. This kind of attacks are prevented through verification of host key. This is done after DH exchange, so it is encrypted and cannot be analyzed with wireshark at this time.
  • It generates random number that cannot be determined by neither of the peers alone, but the two together. This is an interesting concept to me.

  • From the wikipedia article here is a simplified structure of the exchange:

    1. Let g be a known public number from a finite cyclic group.
    2. Alice picks a random natural number a and sends ga to Bob.
    3. Bob picks a random natural number b and sends gb to Alice.
    4. Alice computes (gb)a = gab
    5. Bob computes (ga)b = gab

As a result they have generated a safe random secret gab.

AND NOW FOR THE WIRESHARK CAPTURE!

  1. SSHv2 Client: Key Exchange Init

    Several parameters negotiation, like compression and some crypto algorithms.

  2. SSHv2 Server: Key Exchange Init

    Reply to above

  3. SSHv2 Client: Diffie-Hellman Key Exchange Init

    Negotiation of the DH parameters about mathematical group. (See RFC4419 section 3 for more details).

  4. SSHv2 Server: Diffie-Hellman Key Exchange Reply

    Reply to above.

  5. SSHv2 Client: Diffie-Hellman GEX Init

    First actual exchange of DH. Following wikipedia notation this would be step 2 (Alice sends ga).

  6. SSHv2 Server: Diffie-Hellman GEX Reply

    The exchange finishes (Bob sends gb).

    After receiving this packet both peers know the secret key (gab) and establish a pseudo-secure channel with it (secure against casual eavesdropping, but not against man-in-the-middle-attacks).

  7. SSHv2 Client: New Keys

    This looks like a simple acknowlegding message to me. It is small and contains no significative data.

    Ok, I suppose there's a lot going on after this (server public key verification, user authentication, establishment of data channels for shell/sftp/scp/tunnels, etc). I don't know the exact details and (un)fortunately all this is encrypted.

Useful references:

  1. http://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange
  2. http://www.ietf.org/rfc/rfc4251.txt
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.