Apparently, SSH does send (albeit using an encrypted connection) the client's login password to the server if password authentication is being used instead of a pair of public and private keys: Does ssh send the password over the network?

I know of methods used by HTTP Digest access authentication, for example and I'm wondering why something like this isn't being used instead of sending the password itself?

  • If SSH supported MD5 as a cipher (which it doesn't), wouldn't this be more or less what it's doing? Although instead of sending a hash in plain text of the username and password, "the entire packet is encrypted by the transport layer" (as RFC 4252 puts it). – Kusalananda Nov 24 '19 at 17:51
  • @Kusalananda, but isn't the difference that with a digest the remote end doesn't get to see the (plaintext) password, while in SSH it does? That doesn't matter if it's the correct password, but might matter if the user accidentally enters the password of another service. Though as far as I understand, those simple digest authentications require the server to keep a plaintext copy of the password, which is bad for other reasons. – ilkkachu Nov 24 '19 at 19:05
  • There's stuff like SRP, which SSH could use for authentication, but I'm not sure if there are any actual implementations of it. – ilkkachu Nov 24 '19 at 19:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.