mån 2011-12-05 klockan 01:46 +0100 skrev Peter Krempa:
> The private SSH keys are _NOT_ sent to the server in any case. The
> authenitcation is done in a following way (simplified):
>
> 1) The server creates a random message.
> 2) The server encrypts the message using the client's public key
> 3) The server sends the encrypted challenge to the client
> 4) The client decrypts the message using his private key and replies to
> the server using plaintext of the message
> 5) The server verifies, that the client is in posession of the private
> key, as he was able to decrypt the message. (In ideal world) Only the
> rightful owner is in posession of the private key and thus able to
> decrypt the message.
> 6) Authentication succeeds.
SSH2 public key user authentication is not really that complex. It
builds on the session identifier established earlier condensing the
sequence to
0. client optinally asks if a given public key may be used
1. client generates a session unique signature of the session identifier
+ static data (SSH_MSG_USERAUTH_REQUEST minus the signature component),
signed with the private key.
2. server verifies the signature using the public key
libssh2 always performs step 0, and so do most other ssh clients as
well.
Regards
Henrik
_______________________________________________
libssh2-devel http://cool.haxx.se/cgi-bin/mailman/listinfo/libssh2-devel
Received on 2011-12-05