Linux Server Security, Second Edition

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

130

|

Chapter 4: Secure Remote Administration

3. Alice receives the message and decrypts it with her private key.

4. Alice uses Bob’s public key to verify that it was signed using his private key.

Compared to block ciphers such as blowfish and IDEA, in which the same key is

used both for encryption and decryption, this may seem convoluted. Unlike block

ciphers, though, for which secure key exchange is problematic, PK crypto is easier to

use securely.

This is because in PK schemes, two parties can send encrypted messages to each

other without first exchanging any secret data whatsoever. There is one caveat: pub-

lic-key algorithms are slower and more CPU-intensive than other classes of crypto-

graphic algorithms, such as block ciphers and stream ciphers (e.g., 3DES and RC4,

respectively). As it happens, however, PK crypto can be used to generate keys

securely that can be used in other algorithms.

In practice, therefore, PK crypto is often used for authentication (“Are you really

you?”) and key negotiation (“Which 3DES keys will we encrypt the rest of this ses-

sion with?”), but seldom for the bulk encryption of entire sessions (data streams) or

files. This is the case with SSL, and it’s also the case with SSH.

Advanced SSH Theory: How SSH Uses PK Crypto

As described in the beginning of