RFC 4251(https://tools.ietf.org/html/rfc4251) states,

[page 4]

The protocol provides the option that the server name - host key
association is not checked when connecting to the host for the first

[page 3]

The client has a local database that associates each host name (as typed by the user) with the corresponding public host key.

RFC 4419(https://tools.ietf.org/html/rfc4419) states,
[page 3]

The server responds with:

 string  server public host key and certificates (K_S)
 mpint   f
 string  signature of H

My question is,
After the first time connecting, the client has got server's public host key.
Why does the server still send its host key to the client in SSH_MSG_KEX_DH_GEX_REPLY (K_S) ?

  • $\begingroup$ Does the server know who is connecting at this stage of the handshake (don't assume static IPs)? Does the server know they didn't clear their public key database for whatever random reason? $\endgroup$ – SEJPM Sep 10 '16 at 17:13
  • $\begingroup$ (@SEJPM) Plus the server sometimes needs to replace its key due to damage or compromise or policy (e.g. time limit) or change in standards -- like openssh deciding to quasi-prohibit DSA. Plus some servers can be reached by multiple addresses and/or names at different times or even the same time; how does it know which name(s)/address(es) the client previously used and maybe remembers? Note you don't need 4419 KEX-DHGEX to see this; 4253 sec8 has the same thing for (predefined) KEX-DH. $\endgroup$ – dave_thompson_085 Sep 11 '16 at 11:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.