I'm a cybersecurity student and I'm eager to understand the basic processes of an SSH session. I wrote down the stages to the best of my ability but need help understanding what happens right after the TCP handshake and right before the Diffie-Hellman key exchange. Please help:
Session Start/TCP Handshake
Client begins a session with Server by initiating a TCP handshake.
Assymetric Encryption for TCP Session
Server and Client negotiate back-and-forth and agree upon a mutually supported encryption protocol for the TCP session.
At this point, post-protocol-negotiation, it is unclear to me how their session is initially being encrypted. I used Wireshark to try and capture the Client or Server sending over their public key or something but could only see the protocol version exchange. Regardless, please explain this stage if you can.
Client and Server negotiate a shared secret key for this session using the Diffie-Hellman algorithm in order to establish a symmetric-key encrypted session.
Client and Server begin process of producing temporary key pairs, using
- Shared prime number
- Encryption generator (typically AES)
- Private prime number (as private key).
Client and Server use these three to each generate their own public key that can be derived from their own private key.
Client and Server each share their generated public key with each other.
Client and Server each use their own private key, the other's public key and their original shared prime number to generate the same secret key.
Client and Server use this key as their shared secret key to encrypt and decrypt all future communication on this session.
At this stage, Client and Server have successfully established a symmetric-key-encrypted session without having needed to send the secret key over the network.
If I got anything else wrong I'd really appreciate any clarification. Thanks!