Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
As described in the SSH RFC an initial IV to server, initial IV to client, encryption key client to server, encryption key server to client, integrity key client to server, and an integrity key server to client are generated.
Why does SSH generate a key for server -> client communication and a key for client -> server communication?
There's a line of thought in crypto when it comes to keys: one usage, one key.
That gives a first level of rationale towards using separates keys in each direction: each direction is a different usage of the key.
Next level is to illustrate what class of attacks this prevents. That is: mirror attacks. Imagine an encryption key and a (separate) authentication key are used in both directions. It's at least plausible that an adversary can take an encrypted and authenticated piece of data sent by the server, and re-transmit it towards the server as if it came from the client. Baring details in the protocol, that piece of data would pass authentication and be decrypted as if it came from the client. That goes against the simpler statement of the objective of the protocol, and is a break (whether it's exploitable depends on details that we do not want to consider). Contrast with the situation using different keys: authentication fails (and decryption, if it occurs, yields rubbish).
Addition: There are other effective ways to prevent mirror attacks ( e.g. indicating the intended recipient in authenticated cryptograms). There sometime are good reasons to use this rather than multiple keys (e.g. minimizing the memory footprint of an open channel).
