As described in the SSH RFC an initial IV to server, initial IV to client, encryption key client to server, encryption key server to client, integrity key client to server, and an integrity key server to client are generated.

Why does SSH generate a key for server -> client communication and a key for client -> server communication?


1 Answer 1


There's a line of thought in crypto when it comes to keys: one usage, one key.

That gives a first level of rationale towards using separates keys in each direction: each direction is a different usage of the key.

Next level is to illustrate what class of attacks this prevents. That is: mirror attacks. Imagine an encryption key and a (separate) authentication key are used in both directions. It's at least plausible that an adversary can take an encrypted and authenticated piece of data sent by the server, and re-transmit it towards the server as if it came from the client. Baring details in the protocol, that piece of data would pass authentication and be decrypted as if it came from the client. That goes against the simpler statement of the objective of the protocol, and is a break (whether it's exploitable depends on details that we do not want to consider). Contrast with the situation using different keys: authentication fails (and decryption, if it occurs, yields rubbish).

Addition: There are other effective ways to prevent mirror attacks ( e.g. indicating the intended recipient in authenticated cryptograms). There sometime are good reasons to use this rather than multiple keys (e.g. minimizing the memory footprint of an open channel).

  • $\begingroup$ Thank you, follow up question: does TLS also generate two symmetric keys (one for client->server and one for server->client)? $\endgroup$
    – nilch
    Commented Mar 7, 2022 at 22:24
  • 2
    $\begingroup$ @nilch No it doesn't, which is a counter-argument to this answer. Other measures in the protocol address the issue mentioned here. $\endgroup$
    – user207421
    Commented Mar 8, 2022 at 2:39
  • 2
    $\begingroup$ @user207421: actually, TLS does generate separate symmetric keys for the two directions (client-to-server and server-to-client). $\endgroup$
    – poncho
    Commented Mar 8, 2022 at 14:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.