# How exactly is signature verification done in SSH v2 authentication?

One of the authentication methods in SSH involves the client signing a message with its private key and sending it to the server for verification.

RFC 4252 (page 9) says:

The value of 'signature' is a signature by the corresponding private
key over the following data, in the following order:

string    session identifier
byte      SSH_MSG_USERAUTH_REQUEST
string    user name
string    service name
string    "publickey"
boolean   TRUE
string    public key algorithm name
string    public key to be used for authentication


The same RFC (page 8) says that all the above information other than the session identifier is passed to the server along with the signature. To verify the signature then, the server would have to recontruct the message (adding the session identifier) and then pass it on to the signature verification algorithm, alongside the received signature and public key.

Is this what happens?

• Just to clarify that this isn't a part of you question, did you mean to say that it involves the client signing a message with its private key? Assuming that was just a typo, is your question whether in practice the server has to reconstruct the message before verifying it? I guess I'm just a bit unclear on which aspects of this you are debating. – thesquaregroot Jul 15 at 20:58
• @thesquaregroot Yes, I meant private key, not public key. Have edited the question now. Also, yes.. I want to know whether the server has to recontruct the message before verifying it – Daud Jul 15 at 21:07

Regardless, from a protocol perspective this is sufficient evidence that the signature pre-image must be reconstructed. But for what it's worth, this can also be seen in the OpenSSH source code where the buffer, b, is constructed using a series of sshbuf_put_* operations and then ultimately passed into sshkey_verify.