3Com Switch 8800 Advanced Software V5 Configuration Guide

SSH2.0 Overview 937
You can also use the asymmetric key algorithm for digital signature. For example,
user 1 adds his signature to the data using the private key, and then sends the
data to user 2. User 2 verifies the signature using the public key of user 1. If the
signature is correct, this means that the data originates from user 1.
Revest Shamir and Adleman (RSA) is an asymmetric key algorithms. RSA can be
used for both data encryption and signature.
SSH Operating Process The session establishment between an SSH client and the SSH server involves the
following five stages:
Version negotiation
■ The server opens port 22 to listen to connection requests from clients.
■ The client sends a TCP connection request to the server. After the TCP
connection is established, the server sends the first packet to the client, which
includes a version identification string in the format of “SSH-<primary protocol
version number>.<secondary protocol version number>-<software version
number>”. The primary and secondary protocol version numbers constitute the
protocol version number, while the software version number is used for
debugging.
■ The client receives and resolves the packet. If the protocol version of the server
is lower but supportable, the client uses the protocol version of the server;
otherwise, the client uses its own protocol version.
■ The client sends to the server a packet that contains the number of the
protocol version it decides to use. The server compares the version carried in
the packet with that of its own to determine whether it can cooperate with the
client.
■ If the negotiation is successful, the server and the client go on to key and
algorithm negotiation; otherwise, the server breaks the TCP connection.
n
All the packets involved in the above steps are transferred in plain text.
Key and algorithm negotiation
■ The server and the client send key algorithm negotiation packets to each other,
which include the supported public key algorithm list, encryption algorithm list,
MAC algorithm list, and compression algorithm list.
■ Based on the received algorithm negotiation packets, the server and the client
figure out the algorithms to be used.
Tab le 39 Stages in establishing a session between the SSH client and the server
Stages Description
“Version negotiation” on page 937 SSH1 and SSH2 are supported. The two parties
negotiate a version to use.
“Key and algorithm negotiation” on
page 937
SSH supports multiple algorithms. The two parties
negotiate an algorithm for communication.
“Authentication” on page 938 The SSH server authenticates the client in response
to the client’s authentication request.
“Session request” on page 939 This client sends a session request to the server.
“Interactive session” on page 939 The client and the server start to communicate with
each other.