Questions tagged [ssh]

The Secure Socket Shell (SSH) protocol is an authentication protocol (described in RFC 4252) for securely getting access to a remote computer.

Filter by
Sorted by
Tagged with
0 votes
1 answer
25 views

MOSH - Decrypt session when the shared secret is known

Currently I'm working on an intercepting proxy server for mosh connections. I'm able to intercept the ssh session to get the shared secret and alter the connection information for the mosh client. The ...
0 votes
3 answers
60 views

What purpose does an SSH private key passphrase serve?

Let's say you generate an SSH RSA key pair with ssh-keygen -t rsa -b 2048. You'll end up with a public and private key. id_rsa <...
2 votes
1 answer
493 views

Is the combination of X25519 ECDH and NTRU in OpenSSH 9.X secure against quantum attacks?

Can the combination of X25519 ECDH and NTRU in OpenSSH 9.X defend me against quantum attacks? Why is it believed that this combination is secure?
0 votes
0 answers
37 views

OpenSSL and ETSI QKD protocol

Has anyone integrated OpenSSL with the ETSI QKD key request protocol? I want to make my most critical SSH sessions quantum-safe by integrating with a QKD system and it appears the QKD vendors use the ...
2 votes
1 answer
78 views

Does TLS use use two symmetric keys in the same way SSH does? One for client to server and one for server to client communication?

As described in the SSH RFC an initial IV to server, initial IV to client, encryption key client to server, encryption key server to client, integrity key client to server, and an integrity key server ...
  • 73
5 votes
1 answer
2k views

Why does the SSH protocol generate two keys: an encryption key for client to server communication and server to client communication?

As described in the SSH RFC an initial IV to server, initial IV to client, encryption key client to server, encryption key server to client, integrity key client to server, and an integrity key server ...
  • 73
0 votes
1 answer
162 views

How does SSH generate keys for RSA algorithm?

As far as I understood, the core of the RSA algorithm is to have 2 (large) primes ‘p’ and ‘q’, so that ‘n=pq’. Then ‘n’ is the public key, and ‘p’ the private one. The security comes from the fact ...
  • 103
2 votes
0 answers
61 views

Coursera Course or book(s) That covers the following subjects: OPENSSL, SSH, PKI, MD5, RSA, Certificates, keys, signatures

I started working as a developper in a cryptography company 3 months ago where the applications are for mostly windows applications. I found that I don't have enough knowledge concerning the topics ...
  • 121
1 vote
1 answer
42 views

Where are the seeds for the initial key exchange phase taken from?

I know that the standard DH and ECDH key exchange algorithms require the client and server to agree on a large prime number and a generator (in the DH algorithm) or a curve and a point (in the ECDH ...
1 vote
2 answers
354 views

Is it possible to unscramble a scrambled ed25519 SSH key?

Let's say I generate an ed25519 SSH key with ssh-keygen -t ed25519. Then I take the private key file and randomly scramble the order of base64 encoded characters. ...
  • 13
0 votes
0 answers
149 views

Why if i change some characters of a Public key on authorizedKeys the login still works

This question is similar to: [1] Why does my SSH private key still work after changing some bytes in the file? But in this case (on Windows) after editing the authorized_keys file and changing some ...
0 votes
0 answers
13 views

SSH - Diffie-Hellman; prime & g exchange [duplicate]

The Diffie-Hellman key exchange algorithm can be used with SSH. But how does SSH exchange the large safe prime p and the ...
0 votes
0 answers
130 views

How to generate private SSH RSA key from given primes?

I have two primes and public exponent. How I can generate private key with this values and "ssh-rsa" format?
2 votes
2 answers
545 views

Question about SSH host key algorithms

I'm currently writing a report for my Master's degree on the SSH protocol. Quite interesting! However I'm having trouble getting into the inner workings of the host key algorithms. For example, ...
  • 21
7 votes
2 answers
7k views

Why OpenSSH prefers ECDSA nistp256 keys over -384 and -521, and those over Ed25519, for host key verification?

According to ssh_config(5), HostKeyAlgorithms “specifies the host key algorithms that the client wants to use in order of ...
  • 251
0 votes
1 answer
334 views

How exactly is signature verification done in SSH v2 authentication?

One of the authentication methods in SSH involves the client signing a message with its private key and sending it to the server for verification. RFC 4252 (page 9) says: ...
  • 127
0 votes
1 answer
204 views

Prior art: SSH key authn over TLS?

I’m developing an application that runs over TLS. In addition to password-based authentication we’d like to be able to use SSH keys. Is there any prior art in using SSH keys for authentication over ...
0 votes
0 answers
69 views

Can a duplicate ssh private key be dangerous?

For convenience I had an id_rsa keypair and duplicated them with a new name. I may or may not use them consistently on different machines. (The reason was to keep an existing id_rsa on a machine I ...
  • 1
2 votes
2 answers
1k views

What's the downside of using X.509 in SSH instead of PKI

ssh uses public keys for authentication and not signed X.509 certificates. Specify a drawback which would be the use of X.509 certificates instead of public keys. I've tried to look up a lot of ...
2 votes
0 answers
175 views

where are ssh.com's crypticore and seed defined?

ssh.com's Tectia offers a few algorithms seemingly unique to itself. Chief among them: crypticore128@ssh.com, crypticore-mac@ssh.com and seed-cbc@ssh.com Are these algorithms publicly defined ...
  • 2,795
12 votes
2 answers
3k views

Why does SSH authentication protocol send a challenge message instead of using digital signature to verify client

Why does SSH authentication protocol choose to have the server with the public key send a challenge message encrypted with this public key of the client instead of having the client send a message ...
  • 321
5 votes
1 answer
1k views

Is there asymmetric encryption in SSH?

I've read in DigitalOcean article about SSH that in order for a server to authenticate a client: The server sends the client this encrypted message. If the client actually has the associated ...
3 votes
1 answer
818 views

Is SSH over TLS 1.2/1.3 overkill?

I am designing a protocol that will have security in mind as one of its key goals. Currently I have selected SSH with TLS as the underlying transport. I selected SSH because it had a variety of ...
  • 33
0 votes
0 answers
265 views

How the counter of AES-CTR in SSH is used

I am currently trying to decrypt an SSH session using memory derived keys and IVs. My current problem is that the counter value seems to be the IV plus some value < 256. My question is now why the ...
1 vote
2 answers
945 views

How does the SSH server know the length of data encrypted?

In am learning the SSH RFC An encryption algorithm and a key will be negotiated during the key exchange. When encryption is in effect, the packet length, padding length, payload, and padding fields ...
  • 151
4 votes
3 answers
2k views

Is the curve25519 algorithm a special(implementation) one of ECDH?

It's the first time for me to learn about Key Exchange Protocol. And I thought that in both ECDH and DH there is a necessary step to share some public infomation(the common parameters) to each sides ...
  • 151
0 votes
1 answer
68 views

Book request about elliptic curves, RSA and DSA

I understand that this question can be hardly downvoted, but so be it if someone gives me really useful references :) I wanna learn difference (deeply) between RSA, DSA, and ECC, especially I am ...
1 vote
1 answer
69 views

Is there any point to encrypting a file if it's transferred via ssh?

Suppose I have two machines which can ssh into each other. Is there very little point in using gpg with a password protected symmetric cipher to transfer a ...
1 vote
2 answers
1k views

how does AES GCM in SSH work?

I was looking at RFC5647: AES Galois Counter Mode for the Secure Shell Transport Layer Protocol and had some questions about section 7.1 "IV and Counter Management". Here's that section: <...
  • 2,795
2 votes
0 answers
217 views

Sharing RSA private key between SSH and SSL services. How bad is it?

An appliance uses a curious way of obtaining ssh-rsa host keys: There is a single configuration option "management certificate" that sets RSA private keys both for HTTPS and SSH management. ...
7 votes
3 answers
1k views

Are SSH key-pairs an example of a zero knowledge proof?

Quoting from source, authentication using SSH key pairs goes something like this: 1) The client begins by sending an ID for the key pair it would like to authenticate with to the server. 2) ...
  • 71
0 votes
3 answers
274 views

How is public-key cryptography secure?

Quite strange question, but here goes: I don't quite understand how asymmetric encryption works. Take SSH for an example: The server will always be listening for commands, so anyone who has the ...
  • 103
2 votes
1 answer
915 views

What is the encoding protocol for passphrase protected RSA private keys?

What is the protocol used to encode an RSA key protected with a passphrase? If I generate an RSA key with ssh-keygen -t rsa -b 4096 and do: ...
  • 155
6 votes
1 answer
282 views

Reason for 3 rounds ChaCha in ChaCha20Poly1305@openssh

OpenSSH uses a slightly different ChaCha20Poly1305 AEAD construct then the one proposed by A. Langley and others for TLS. The TLS version The openSSH version (and here) The openSSH version uses two ...
3 votes
1 answer
338 views

Does it make sense to have long SSH Key with shorter Passphrase?

If we encrypt our data with a longer SSH key which is protected by a shorter passphrase (with a decent entropy), then the limiting factor is entropy of the passphrase. So why do we use a longer key at ...
  • 133
2 votes
2 answers
634 views

Max size for exponent and modulus in RSA and for y, p, q, g in DSS

I'm writing a method in Java to read SSH public key in RFC 4253 format, which, in my case, can be either RSA, or DSS. What I really need is to read exponent and <...
94 votes
2 answers
32k views

Why doesn't SSH use TLS?

Most cryptographically protected protocols use TLS these days. This applies to mail protocols, HTTP and many others. The newly designed QUIC has also adopted TLS as its cryptography layer. However, ...
  • 1,135
3 votes
1 answer
206 views

SSH sequence number validity?

Looking at RFC4253, I came across the notion that the MAC is applied the encoded packet concatenated with a sequence number which acts as a counter. However, I couldn't find any information on how ...
  • 337
1 vote
2 answers
455 views

how does OpenSSH use bcrypt to set IV's?

I generated an encrypted OpenSSH private key for test purposes: ...
  • 2,795
1 vote
1 answer
488 views

Why hash ( clear text + Secret ) instead of hash (encrpt(clear text) [ + secret ] )

Here is an excellent article on how SSH Authentication and Encryption works. While thinking about how MAC's work, I had the same doubt as one of the comments left on the post: The client combines ...
  • 111
3 votes
1 answer
271 views

How does authentication work for SSH login with a public key?

For SSH public key authentication in Cisco IOS it is sufficient to add RSA public key hash instead of content of that public key. For example: ...
1 vote
0 answers
1k views

See the RSA's $n = p q, e \text{ and } d$ from ssh-keygen

For learning purposes, how to get the RSA's parameters (I use standard notation): $n = p q $, where $p$ and $q$ are prime and $e$, $d$, such that $ed = 1 \ (mod\ \varphi (n)) $ when doing ...
  • 501
0 votes
2 answers
830 views

Public key cryptography instead of passwords for web authentication

The usual way for a user to authenticate themselves to a website at the application layer is with a shared secret - the user's password. If a user is connecting to a bank, they give the bank their ...
0 votes
2 answers
84 views

Security implications of storing an ssh passphrase

I'm trying to understand the security implications of encrypting an ssh key with a passphrase, and storing the passphrase in the MacOS key chain or Gnome key-ring. As I understand it, my ssh key ...
  • 101
12 votes
2 answers
12k views

ed25519 ssh public key is always 80 characters long?

I am creating some ssh keys using ed25519, something like: ...
  • 225
3 votes
1 answer
1k views

Is encrypt-and-MAC secure for AES-CTR + UMAC?

OpenSSH will (especially in older versions) use AES-CTR plus a MAC in encrypt-and-MAC. This is not secure in general (meaning that there exist secure ciphers and secure MACs such that using them in ...
  • 4,663
2 votes
0 answers
140 views

Can I use a GnuPG created key for OpenSSH or authentication purposes? [closed]

I created a key pair using PGP (GnuPG) for the purpose of encrypting and signing data (documents, emails, and so on). That key was created with the RSA algorithm, and naturally starts with: -----...
  • 129
26 votes
3 answers
15k views

How many KDF rounds for an SSH key?

What is the best practice on choosing how many key derivation function (KDF) rounds/iterations when generating an SSH key pair with ssh-keygen? Am I correct in saying that it is unnecessary if the ...
2 votes
3 answers
2k views

Which hash function is used for signatures ssh-rsa and ssh-dss?

I'm building a fuse client for ssh/sftp. I write the required ssh and sftp functions myself. Now I read in RFC4253 that before signing the data to sign is default hashed. In RFC4253 8. "Diffie-...
0 votes
0 answers
100 views

Why public host key still need be sent in SSH_MSG_KEX_DH_GEX_REPLY?

RFC 4251(https://www.rfc-editor.org/rfc/rfc4251) states, [page 4] The protocol provides the option that the server name - host key association is not checked when connecting to the host for the first ...