The SSH handshake
An SSH connection begins with a key exchange — typically ECDH over Curve25519 (curve25519-sha256) in modern implementations — to establish a shared session key, followed by the server presenting its host key so the client can verify it's connecting to the right machine, and finally derivation of symmetric session keys (commonly AES or ChaCha20) used for the rest of the session.
SSH connection setup
- 1
TCP connection + version exchange
Client and server announce their SSH protocol versions.
- 2
Key exchange (ECDH)
Both sides derive a shared secret via elliptic-curve Diffie-Hellman, typically over Curve25519.
- 3
Host key verification
The server proves it holds the private key matching its known host key fingerprint.
- 4
Session keys derived
Symmetric keys (AES or ChaCha20) are derived from the shared secret for the rest of the session.
- 5
User authentication
The client authenticates — typically by proving possession of a private key listed in authorized_keys.
The exchange, client and server
The same setup, viewed as messages crossing the wire rather than internal steps: both sides contribute to the key exchange, then the server proves its identity before anything else is trusted.
Trust-on-first-use vs. certificate authorities
Unlike TLS, which relies on a global PKI of Certificate Authorities, SSH's default host key model is trust-on-first-use: the first time you connect to a server, its host key fingerprint is recorded, and every future connection is checked against that record — which is exactly what the "the authenticity of host X can't be established" warning is asking you to verify manually. Larger organizations often layer an SSH certificate authority on top, having a trusted CA sign both host keys and user keys, closer to the TLS model.
User authentication
Public-key authentication — where the client proves possession of a private key whose matching public key is listed in the server's authorized_keys — is the recommended alternative to password authentication. Modern SSH deployments increasingly default to Ed25519 keys (a specific, fast elliptic-curve signature scheme) over RSA, for smaller key size and simpler, more misuse-resistant implementation.