3
$\begingroup$

RFC 4253 "The Secure Shell (SSH) Transport Layer Protocol" states on page 18:

  server_host_key_algorithms
     A name-list of the algorithms supported for the server host
     key.  The server lists the algorithms for which it has host
     keys; the client lists the algorithms that it is willing to
     accept.  There MAY be multiple host keys for a host, possibly
     with different algorithms.

My question is,
In RFC 4253, "encryption_algorithms" is used for symmetric encryption and "mac_algorithms" is used for integrity protection, but what are "server_host_key_algorithms" used for?

I read RFC 4253, but still can't find possible uses for the algorithms.

Improve this question
$\endgroup$
1
  • $\begingroup$ Another possible option (?): This actually means the authentication algorithms (eg RSA and Ed25519) for which you'd need to put your public key on the server. $\endgroup$
    – SEJPM
    Sep 6, 2016 at 12:48

1 Answer 1

Reset to default
3
$\begingroup$

In SSH, it is also necessary that the server authenticates itself to the client. Otherwise, a man-in-the-middle (or any other party capable of manipulating the connection, e.g., via DNS spoofing) could impersonate the server and trick the client into revealing its password or, in the case of public-key authentication, a valid response to a cryptographic challenge (which the attacker may then use to log in at the real server).

This authentication step is done via the server's host keys. Section 8 of RFC 4253 states:

The key exchange is combined with a signature with the host key to provide host authentication.

Typically, servers support more than one signature algorithm for interoperability reasons, hence they need to tell the client which key types they have available: The server_host_key_algorithms field contains this list.

That mechanism is the reason you see the following (probably familiar) warning when first connecting to some server:

The authenticity of host 'example.org (192.0.2.121)' can't be established.
ECDSA key fingerprint is SHA256:Lj0PQQnA9K2NupAxdjJSnxQhVWoVvjTLcUQQWDFS+9A.
Are you sure you want to continue connecting (yes/no)?

Here, the client essentially asks you to confirm that you have verified the server's host key. After the first connection, the client stores the server's host key in its known_hosts file and will only warn the user again if the host key changes (for instance, if the server has been reinstalled or there really is an attack taking place).

Improve this answer
$\endgroup$
3
  • $\begingroup$ whatever.org is a bogus server name you are connecting to. $\endgroup$
    – Jakuje
    Sep 6, 2016 at 16:19
  • $\begingroup$ host key = server's public key, is it right? Also , what part is hot key in your example "ECDSA key fingerprint is SHA256:Lj0PQQnA9K2NupAxdjJSnxQhVWoVvjTLcUQQWDFS+9A"? $\endgroup$
    – Matt Elson
    Sep 6, 2016 at 16:33
  • 1
    $\begingroup$ The key itself is not displayed. The fingerprint is a cryptographic hash over the encoding of the key (itself encoded as base 64 in this case). As the hash is "unique" for the key it can be used to identify the keys without displaying the key itself. $\endgroup$
    – Maarten Bodewes ♦
    Sep 6, 2016 at 16:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.