H3C Technologies H3C SecPath F1000-E - Manual (Page 58)

2
Stages Description
Interaction
After the server grants the request, the client and
server start to communicate with each other.
Version negotiation
1. The server opens port 22 to listen to connection requests from clients.
2. The client sends a TCP connection request to the server. After the TCP connection is established, the
server sends the first packet to the client, which includes a version identification string in the format
of “SSH-.-
version number>”. The primary and secondary protocol version numbers constitute the protocol
version number, while the software version number is used for debugging.
3. The client receives and resolves the packet. If the protocol version of the server is lower but
supportable, the client uses the protocol version of the server; otherwise, the client uses its own
protocol version.
4. The client sends to the server a packet that contains the number of the protocol version it decides
to use. The server compares the version carried in the packet with that of its own. If the server
supports the version, the server and client will use the version. Otherwise, the negotiation fails.
5. If the negotiation is successful, the server and the client proceed with key and algorithm
negotiation; otherwise, the server breaks the TCP connection.
NOTE:
All the packets involved in the above steps are transferred in plain text.
Key and algorithm negotiation
• The server and the client send algorithm negotiation packets to each other, which include the
supported public key algorithms list, encryption algorithms list, Message Authentication Code
(MAC) algorithms list, and compression algorithms list.
• Based on the received algorithm negotiation packets, the server and the client figure out the
algorithms to be used. If the negotiation of any type of algorithm fails, the algorithm negotiation
fails and the server tears down the connection with the client.
• The server and the client use the DH key exchange algorithm and parameters such as the host key
pair to generate the session key and session ID, and the client authenticates the identity of the
server.
Through the above steps, the server and the client get the same session key and session ID. The session
key will be used to encrypt and decrypt data exchanged between the server and client later, and the
session ID will be used to identify the session established between the server and client and will be used
in the authentication stage.
CAUTION:
Before the negotiation, the server must have already generated a DSA or RSA key pair, which is not only
used for generating the session key, but also used by the client to authenticate the identity of the server. For
more information about DSA and RSA key pairs, see Public Key Configuration in the Security Volume.
Authentication
SSH provides two authentication methods: password authentication and publickey authentication.