From SSH handshake process explained http://www.cathaycenturies.com/blog/?p=1635
Key Exchange
- The client has a public & private key pair. The server has a public & private key pair.
- The client and server exchange their public keys.
- The client now has its own key pair plus the public key of the server.
- The server now has its own key pair plus the public key of the client.
- This exchange of keys is done over an insecure network.
- The client takes its private key and the server’s public key and passes it through a mathematical equation to produce the shared secret (session key).
- The server takes its private key and the client’s public key and passes it through a mathematical equation to produce the shared secret (session key). Both these shared secrets are identical! This is an asymmetrical key.
- This encrypted tunnel is used for the remainder of the session, including the next phase: User Authentication.
Is the exchange of public keys between the server and client done once for the following all sessions, until they are changed?
are the sessions keys generated on the client and on the server once per session?
Each time they are generated, they take private keys and public keys as inputs. Does it mean that the session keys for different sessions are the same, as long as the private and public keys stay the same?
why does the quote say that the session keys generated on the server and on the client in the same session are "identical"?
the bullet 8 seems to say that user authentication happens after the session keys are generated?
If yes, does user authentication use the session keys generated on the client and on the server, or just use the public and private keys on the client and on the server?
By the way, is there some reference about how the process goes and uses the public and private keys and session keys on the server and on the client?
Thanks.