SSH Session Structure.pdf

http://www.emtec.com/

Hashes
Another form of data manipulation that SSH takes advantage of is hashing. A hashing function is a
method of creating some sort of fingerprint of a set of data. The hash is much shorter than the data itself,
but is still different for each data set.
The data can not be created from the hash, but looking at the hash, you can prove that you have the
same originating data. Thus comparing hashes is a way to prove that the originating data was the same,
i.e. that it was not tampered with.

Initial Steps of an SSH Connection
The SSH protocol uses a client-server model to authenticate both sides and encrypt the data between
them. The server listens on a given port for connections. It handles the details of the ssh connection,
user-authentication and runs the remote shell.
A SSH session is established in two separate stages. The first is to agree upon and establish encryption
to protect future communication. The second stage is to authenticate the user and discover whether
access to the server should be granted.

The Negotiation Phase of the Connection
After a ssh client initiates a TCP connection to the server, the server sends a string indicating which
protocol it supports. These days, by way the most common protocol version is SSH2. The server also
sends its public host key, which the client uses to verify the authenticity of the host (in order to detect a
possible man-in-the-middle attack). The ssh client can do this by computing a hash on the server key
and comparing it to a previously stored hash.
They also exchange a list of features they support, e.g. key-exchange methods, encryption protocols,
and if each group of features overlap by at least one common method, the communication can continue.
Now appears one of the most critical and most challenging parts of the communication. Both sides,
which may have never met before, need to agree on an encryption key for symmetric encryption,
knowing that the connection so far is not yet encrypted and an adversary could listen to the negotiation.
The negotiation is done through a process called the Diffie-Hellman algorithm. This method makes it
possible for each party to combine some of their private data with public data from the other system and
compute a secret byte sequence that is identical for both sides. The key will then be used to encrypt the