I know that the standard DH and ECDH key exchange algorithms require the client and server to agree on a large prime number and a generator (in the DH algorithm) or a curve and a point (in the ECDH algorithm), but if I inspect the SSH packets there is no sign of these shared seeds. How do they get them then?
I checked the packets and the only messages, after the "Key Exchange Init" and before the "New Keys" messages, are:
"Client: Elliptic Curve Diffie-Hellman Key Exchange Init"
In which there is only the ephemeral public key of the client (i.e. the one generated thanks to the chosen curve)
"Server: Elliptic Curve Diffie-Hellman Key Exchange Replay"
In which there is the public host key of the server, the ephemeral public key of the server (always the one generated with the curve) and the exchange hash (as it is called in rfc4253).
I think that which curve to use is explicit in the name of the algorithm (e.g. nistp256). But how do they agree on the point of order n?
And if I force the use of the DH algorithm (by typing
ssh -oKexAlgorithms=diffie-hellman-group14-sha256) there is no trace of the module and generator exchange.