LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 02-25-2012, 07:46 PM   #1
wulp
LQ Newbie
 
Registered: Mar 2011
Posts: 8

Rep: Reputation: 0
Question Does public key cryptography encrypt data in both directions with SSH?


Let's say that I have an SSH tunnel and my private encryption key. The server has my public key which it uses to encrypt data sent to me. Does the information that I send to the server also get encrypted? Does the SSH server send me it's own public key through the downstream when I connect to it?
 
Old 02-25-2012, 09:49 PM   #2
agentbuzz
Member
 
Registered: Oct 2010
Location: Texas
Distribution: Debian, Ubuntu, CentOS, RHEL
Posts: 131

Rep: Reputation: 25
wulp,
Once you put your public key that was created with ssh-keygen (it is at ~/.ssh/id_rsa.pub) on the server at ~/.ssh/authorized_keys, then log out and log in again, SSH will use the files in the ~/.ssh directory to authenticate you. During the session setup, a session key is created and shared. Now you will no longer be using public/private asymmetric encryption once the session key (actually keys for each direction, client-to-server and server-to-client, and separate keys for encryption and for integrity checking), meaning the symmetric secret, is shared. Bulk encryption is done using the session keys, not the public and private keys.
If you do an "ssh -vvv user@server", you can see everything done in the session setup. It will help you if you can follow along to see what each of those lines in the debug dump means. I recommend that you buy the book "SSH, The Secure Shell: The Definitive Guide" (Second Edition) ISBN-13: 978-0-596-00895-6.
You can prove to yourself that data are encrypted in both directions by setting up an SSH session in one terminal window and, in another terminal window, running "snort -vde" as root.
 
Old 02-27-2012, 09:32 AM   #3
Noway2
Senior Member
 
Registered: Jul 2007
Distribution: Gentoo
Posts: 2,125

Rep: Reputation: 781Reputation: 781Reputation: 781Reputation: 781Reputation: 781Reputation: 781Reputation: 781
This might also be of interest to you: https://en.wikipedia.org/wiki/Diffie...n_key_exchange

SSH was designed to establish connections in a secure manner under the assumption that it is operating in a hostile environment.
 
Old 02-28-2012, 09:05 AM   #4
sundialsvcs
LQ Guru
 
Registered: Feb 2004
Location: SE Tennessee, USA
Distribution: Gentoo, LFS
Posts: 10,671
Blog Entries: 4

Rep: Reputation: 3945Reputation: 3945Reputation: 3945Reputation: 3945Reputation: 3945Reputation: 3945Reputation: 3945Reputation: 3945Reputation: 3945Reputation: 3945Reputation: 3945
Public-key encryption (PKI) techniques are computationally expensive, and would be weakened if very large amounts of data were sent using them. Therefore, PKI is used only in the initial "handshaking" that is used to initiate the conversation -- and that may from time to time thereafter be used during the conversation. This handshaking establishes:
  1. The mutually acceptable identity of the two parties who are communication. ("Alice, is that really you?")
  2. The conventional cipher algorithm that is to be used.
  3. The secret key that is to be plugged into that cipher.

You see similar techniques being used in simpler crypto situations, such as the ones that are commonly used to secure (sic... ) wireless networks. The encryption hardware is built into the device itself; the weakness of the original technique was that it used a single fixed, unchanging key. (You could brute-force the algorithm and, once you had done so, you could eavesdrop on everybody in the coffee shop.) The replacement algorithms use a software agent to conduct a preliminary key-exchange. The same fast hardware is still used, but everyone's key de jour is different and subject to change.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
open-ssh vs. commercial ssh (tru64), public-key auth not possible? cf050 Linux - Networking 8 03-28-2012 11:15 AM
SSH skips public key authentication for a key, but works with another key simopal6 Linux - General 1 07-06-2011 08:33 AM
Putty/SSH login failed when using RSA public key: 'Server refused our key' itsecx@gmail.com Linux - Server 10 10-04-2010 01:19 PM
LXer: OpenSSH with Public Key Cryptography Tutorial LXer Syndicated Linux News 0 10-13-2006 08:03 AM
GPG Data, Secret Key but no Public Key? Aeiri Linux - Software 5 07-20-2004 06:00 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 12:27 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration