From 8397f103e23044b0110097490662ec895a9047ff Mon Sep 17 00:00:00 2001 From: Jakub Jelen Date: Oct 25 2020 20:38:07 +0000 Subject: Clarify SSH protocol and rekeying steps --- diff --git a/modules/system-administrators-guide/pages/infrastructure-services/OpenSSH.adoc b/modules/system-administrators-guide/pages/infrastructure-services/OpenSSH.adoc index bd012a5..e82945f 100644 --- a/modules/system-administrators-guide/pages/infrastructure-services/OpenSSH.adoc +++ b/modules/system-administrators-guide/pages/infrastructure-services/OpenSSH.adoc @@ -75,15 +75,15 @@ The primary role of the transport layer is to facilitate safe and secure communi Once an SSH client contacts a server, key information is exchanged so that the two systems can correctly construct the transport layer. The following steps occur during this exchange: -* Keys are exchanged +* The key exchange algorithm is determined -* The public key encryption algorithm is determined +* The public key signature algorithm is determined * The symmetric encryption algorithm is determined * The message authentication algorithm is determined -* The hash algorithm is determined +* Keys are exchanged During the key exchange, the server identifies itself to the client with a unique _host key_. If the client has never communicated with this particular server before, the server's host key is unknown to the client and it does not connect. OpenSSH notifies the user that the authenticity of the host cannot be established and prompts the user to accept or reject it. The user is expected to independently verify the new host key before accepting it. In subsequent connections, the server's host key is checked against the saved version on the client, providing confidence that the client is indeed communicating with the intended server. If, in the future, the host key no longer matches, the user must remove the client's saved version before a connection can occur. @@ -97,7 +97,7 @@ It is possible for an attacker to masquerade as an SSH server during the initial SSH is designed to work with almost any kind of public key algorithm or encoding format. After an initial key exchange creates a hash value used for exchanges and a shared secret value, the two systems immediately begin calculating new keys and algorithms to protect authentication and future data sent over the connection. -After a certain amount of data has been transmitted using a given key and algorithm (the exact amount depends on the SSH implementation), another key exchange occurs, generating another set of hash values and a new shared secret value. Even if an attacker is able to determine the hash and shared secret value, this information is only useful for a limited period of time. +After a certain amount of data has been transmitted using a given key and algorithm (the exact amount depends on the SSH implementation, encryption algorithm and configuration), another key exchange occurs, generating another set of hash values and a new shared secret value. Even if an attacker is able to determine the hash and shared secret value, this information is only useful for a limited period of time. [[s2-ssh-protocol-authentication]] ==== Authentication