Subject: Session_id in SSH?

From: Paul Hoffman / VPNC <[email-masked]>
Date: Sat, 16 Aug 2003 09:16:33 -0700

Greetings again. I'm trying to figure out the key exchange in SSH 
from reading secsh-transport-16 and have hit a roadblock. Section 5.2 
has you doing hashes over strings that include "session_id", but that 
is never defined in the document.

The text in the first paragraph of 5.2 says:
       The exchange hash H from the first key exchange is
       additionally used as the session identifier, which is a unique
       identifier for this connection.
It sounds like session_id and H are the same thing, but that makes no 
sense when looking at the contents of the hashed strings. Why would 
you include the contents of "H" twice?

Any help would be appreciated.

--Paul

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Sat, 16 Aug 2003 19:17:59 -0400

On Saturday, August 16, 2003 09:16:33 -0700 "Paul Hoffman / VPNC" 
<[email-masked]> wrote:

> Greetings again. I'm trying to figure out the key exchange in SSH from
> reading secsh-transport-16 and have hit a roadblock. Section 5.2 has you
> doing hashes over strings that include "session_id", but that is never
> defined in the document.
>
> sense when looking at the contents of the hashed strings. Why would you
> include the contents of "H" twice?

"H" is the exchange hash resulting from the key exchange just completed, 
and is used to tie the encryption keys to the key exchange, and thus to the 
host authentication.  It changes each time key exchange is performed (that 
is, during every rekey operation)

"session_id" is the exchange hash resulting from the _first_ key exchange 
on a given session.  For that first exchange, it is the same as "H", but 
unlike "H", the "session_id" does not change during a rekey.  It is used to 
tie authentication operations to a particular session.

I believe the first paragraph of section 5.2 spells this out, but it might 
be a little less clear than it could be about the distinction.

-- Jeffrey T. Hutzelman (N3NHS) <[email-masked]>
   Sr. Research Systems Programmer
   School of Computer Science - Research Computing Facility
   Carnegie Mellon University - Pittsburgh, PA