RFC 4432

RSA Key Exchange for the Secure Shell (SSH) Transport Layer Protocol

📅 published March 2006, from ietf

RSA Key Exchange for the Secure Shell (SSH) Transport Layer Protocol 🎀

okay bestie, so this one is RFC 4432 from March 2006, written by B. Harris and filed in the Network Working Group as a Standards Track doc 💅 It doesn't say it obsoletes or updates anything. It's all about a key exchange for SSH that uses RSA instead of Diffie-Hellman, and it's giving "faster on slow devices" energy 🦋

Status of This Memo ✨

ok so this is an Internet standards track protocol for the Internet community, and the doc is basically inviting everyone to talk about it and suggest improvements 🫶 Go check the current edition of the "Internet Official Protocol Standards" (STD 1) for the official standardization state and status. Distribution is unlimited, so share away 🌈

Copyright Notice 🌸

Abstract 💜

this memo describes a key-exchange method for SSH based on Rivest-Shamir-Adleman (RSA) public-key encryption 🔐 It uses way less client CPU time than the Diffie-Hellman algorithm in the core protocol, so it's extra suitable for slow client systems. no cap, that's the whole pitch 💅

1. Introduction 🧚

okay so SSH [RFC4251] is a secure remote-login protocol, and its core uses Diffie-Hellman key exchange 🍓 The problem is that on slow CPUs, that exchange can take tens of seconds, which is honestly so irritating for the user 😭 An older SSH version, described in [SSH1], used an RSA-based key exchange that eats about an order of magnitude less CPU time on the client. That makes it great for slow stuff like mobile devices 📱

So this memo describes an RSA key-exchange mechanism for the SSH version in [RFC4251]. It's similar to the old one and about as fast, but it keeps the security perks of the newer protocol. it's giving best of both worlds ✨

2. Conventions Used in This Document 💖

The key words "MUST" and "SHOULD" in this document are to be interpreted as described in [RFC2119].

The data types "byte", "string", and "mpint" are defined in Section 5 of [RFC4251].

Other terminology and symbols have the same meaning as in [RFC4253].

3. Overview 🌈

okay, the RSA key-exchange method is three messages, so let's do it step by step 🎀

The server sends the client an RSA public key, K_T, and it holds the private key for it. This could be a transient key made just for this SSH connection, or it could get reused for several connections.
The client makes a string of random bytes, K, encrypts it using K_T, and sends the result back. The server decrypts it.
The client and server each hash K, K_T, and the various key-exchange parameters to create the exchange hash, H. H is used to generate the session's encryption keys. The server signs H with its host key and sends the signature to the client. Then the client verifies the host key as described in Section 8 of [RFC4253].

This method gives explicit server identification, as defined in Section 7 of [RFC4253]. It needs a host key that's capable of signatures 🔑

4. Details 🔍

The RSA key-exchange method has these parameters:

    HASH     hash algorithm for calculating exchange hash, etc.
    HLEN     output length of HASH in bits
    MINKLEN  minimum transient RSA modulus length in bits

Their values are defined in Section 5 and Section 6 for the two methods defined by this document.

The method uses the following messages. First, the server sends:

    byte      SSH_MSG_KEXRSA_PUBKEY
    string    server public host key and certificates (K_S)
    string    K_T, transient RSA public key

The key K_T is encoded according to the "ssh-rsa" scheme described in Section 6.6 of [RFC4253]. Heads up: unlike an "ssh-rsa" host key, K_T is used only for encryption and not for signature 🙅‍♀️ The modulus of K_T MUST be at least MINKLEN bits long.

The client generates a random integer, K, in the range 0 <= K < 2^(KLEN-2*HLEN-49), where KLEN is the length of the modulus of K_T, in bits. Then the client uses K_T to encrypt:

    mpint     K, the shared secret

The encryption follows the RSAES-OAEP scheme of [RFC3447], with a mask generation function of MGF1-with-HASH, a hash of HASH, and an empty label. See Appendix A for a proof that the encoding of K is always short enough to be encrypted this way.

heads up bestie: this copy of the doc doesn't actually include an Appendix A, so you'll need the full RFC to read that proof 📖

After the encryption is done, the client sends:

    byte      SSH_MSG_KEXRSA_SECRET
    string    RSAES-OAEP-ENCRYPT(K_T, K)

Note that the last stage of RSAES-OAEP-ENCRYPT encodes an integer as an octet string using the I2OSP primitive of [RFC3447]. Combined with encoding the result as an SSH "string", that gives something similar to, but not identical to, the SSH "mpint" encoding of that integer. It's the same encoding that "ssh-rsa" signatures in [RFC4253] use 🧠

The server decrypts K. If a decryption error happens, the server SHOULD send SSH_MESSAGE_DISCONNECT with a reason code of SSH_DISCONNECT_KEY_EXCHANGE_FAILED, and it MUST disconnect. Otherwise, the server responds with:

    byte      SSH_MSG_KEXRSA_DONE
    string    signature of H with host key

The hash H is the HASH hash of the concatenation of the following:

    string    V_C, the client's identification string
              (CR and LF excluded)
    string    V_S, the server's identification string
              (CR and LF excluded)
    string    I_C, the payload of the client's SSH_MSG_KEXINIT
    string    I_S, the payload of the server's SSH_MSG_KEXINIT
    string    K_S, the host key
    string    K_T, the transient RSA key
    string    RSAES_OAEP_ENCRYPT(K_T, K), the encrypted secret
    mpint     K, the shared secret

This value is called the exchange hash, and it's what authenticates the key exchange 🔐 The exchange hash SHOULD be kept secret.

The signature algorithm MUST be applied over H, not the original data. Most signature algorithms already include hashing and extra padding. For example, "ssh-dss" specifies SHA-1 hashing. In those cases, the data is first hashed with HASH to compute H, and then H gets hashed again as part of the signing operation. it's hashes all the way down 🪆

5. rsa1024-sha1 🦋

The "rsa1024-sha1" method is RSA key exchange as described above, with these parameters:

    HASH     SHA-1, as defined in [RFC3174]
    HLEN     160
    MINKLEN  1024

6. rsa2048-sha256 👑

The "rsa2048-sha256" method is RSA key exchange as described above, with these parameters:

    HASH     SHA-256, as defined in [FIPS-180-2]
    HLEN     256
    MINKLEN  2048

7. Message Numbers 🔢

These message numbers are defined:

    SSH_MSG_KEXRSA_PUBKEY  30
    SSH_MSG_KEXRSA_SECRET  31
    SSH_MSG_KEXRSA_DONE    32

8. Security Considerations 🚨

this section is serious business, so pay attention bestie 🙈

The security considerations in [RFC4251] apply.

If the RSA private key the server generates is revealed, then the session key is revealed too 💀 The server should arrange to erase this from memory as soon as it's no longer required. If the same RSA key is used for multiple SSH connections, an attacker who can find the private key (either by factorising the public key or by other means) will get access to all of the sessions that used that key. So servers SHOULD use each RSA key for as few key exchanges as possible 🧹

[RFC3447] recommends that RSA keys used with RSAES-OAEP not be used with other schemes, or with RSAES-OAEP using a different hash function. Specifically, that means K_T should not be used as a host key, or as a server key in earlier versions of the SSH protocol.

Like all key-exchange mechanisms, this one depends on the randomness of the secrets generated by the client (the random number K) and the server (the transient RSA private key) for its security. It's absolutely essential that the client use a high-quality cryptographic pseudo-random number generator to generate K. If it uses a bad random number generator, an attacker can break all the encryption and integrity protection of the Secure Shell transport layer. Yikes 😱 See [RFC4086] for recommendations on random number generation.

The size of the transient key should be big enough to protect the encryption and integrity keys generated by the key-exchange method. For recommendations on this, see [RFC3766]. The strength of RSAES-OAEP partly depends on the hash function it uses. [RFC3447] suggests using a hash with an output length of twice the security level required, so SHA-1 is appropriate for applications requiring up to 80 bits of security, and SHA-256 for those requiring up to 128 bits.

Unlike the Diffie-Hellman key-exchange method defined by [RFC4253], this method lets the client fully determine the shared secret, K. This is believed not to be significant, since K is only ever used when hashed with data that's provided partly by the server (usually in the form of the exchange hash, H). But if an SSH extension used K directly and assumed it had been generated by Diffie-Hellman key exchange, that could create a security weakness. Protocol extensions that use K directly should be viewed with extreme suspicion 🕵️‍♀️

This key-exchange method is designed to resist collision attacks on the exchange hash, by making sure neither side can freely choose its input to the hash after seeing all of the other side's input. The server's last input is in SSH_MSG_KEXRSA_PUBKEY, before it has seen the client's choice of K. The client's last input is K and its RSA encryption, and the one-way nature of RSA encryption should ensure the client can't choose K in a way that causes a collision.

9. IANA Considerations 📋

IANA has assigned the names "rsa1024-sha1" and "rsa2048-sha256" as Key Exchange Method Names, in accordance with [RFC4250].

10. Acknowledgements 💌

The author acknowledges the help of Simon Tatham with the design of this key exchange method. 🫶

The text of this document is derived in part from [RFC4253].

11. References 📚

11.1. Normative References

[RFC2119]     Bradner, S., "Key words for use in RFCs to Indicate
              Requirement Levels", BCP 14, RFC 2119, March 1997.

[RFC3174]     Eastlake, D. and P. Jones, "US Secure Hash Algorithm 1
              (SHA1)", RFC 3174, September 2001.

[RFC3447]     Jonsson, J. and B. Kaliski, "Public-Key Cryptography
              Standards (PKCS) #1: RSA Cryptography Specifications
              Version 2.1", RFC 3447, February 2003.

[RFC4251]     Ylonen, T. and C. Lonvick, "The Secure Shell (SSH)
              Protocol Architecture", RFC 4251, January 2006.

[RFC4253]     Ylonen, T. and C. Lonvick, "The Secure Shell (SSH)
              Transport Layer Protocol", RFC 4253, January 2006.

[RFC4250]     Lehtinen, S. and C. Lonvick, "The Secure Shell (SSH)
              Protocol Assigned Numbers", RFC 4250, January 2006.

[FIPS-180-2]  National Institute of Standards and Technology (NIST),
              "Secure Hash Standard (SHS)", FIPS PUB 180-2,
              August 2002.

11.2. Informative References

[SSH1]        Ylonen, T., "SSH -- Secure Login Connections over the
              Internet", 6th USENIX Security Symposium, pp. 37-42,
              July 1996.

[RFC3766]     Orman, H. and P. Hoffman, "Determining Strengths For
              Public Keys Used For Exchanging Symmetric Keys",
              BCP 86, RFC 3766, April 2004.

[RFC4086]     Eastlake, D., Schiller, J., and S. Crocker, "Randomness
              Requirements for Security", BCP 106, RFC 4086,
              June 2005.

Appendix A. On the Size of K 🦋

okay so this appendix is the math behind why K always fits under K_T 🧮✨ the requirements on K are there so you can always encrypt it under K_T, no cap, and the sizing math is lowkey iconic 😭

The mpint encoding of K needs a leading zero bit, then padding to a whole number of bytes, then a four-byte length field. That gives a maximum length in bytes of:

B = (KLEN-2*HLEN-49+1+7)/8 + 4 = (KLEN-2*HLEN-9)/8

(where "/" means integer division rounding down, bestie 💅)

Now the max message size you can encrypt with RSAEP-OAEP is defined by [RFC3447] in terms of the key length in bytes, which is (KLEN+7)/8. So the max length works out to:

L = (KLEN+7-2*HLEN-16)/8 = (KLEN-2*HLEN-9)/8

Both expressions come out to the same thing 🫶 so the encoded version of K is always small enough to be encrypted under K_T. periodt 💖

Author's Address 🎀

Ben Harris 2a Eachard Road CAMBRIDGE CB4 1XA UNITED KINGDOM

EMail: bjh21@bjh21.me.uk

Full Copyright Statement 📜

This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.

This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Intellectual Property ⚖️

The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; nor does it represent that it has made any independent effort to identify any such rights. Information on the procedures with respect to rights in RFC documents can be found in BCP 78 and BCP 79.

Copies of IPR disclosures made to the IETF Secretariat and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr.

The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at ietf-ipr@ietf.org.

Acknowledgement 🌸

Funding for the RFC Editor function is provided by the IETF Administrative Support Activity (IASA).

And that's the whole thing, besties 🧚💜 Thanks for coming to my RFC-reading slumber party!

📦 where this page comes from

ietf: rfc4432 2006-03
💖 girlified by claude-haiku-5-5 on 2026-10-16: a language model's rewrite of the original, under its terms