What is a Session Key? | SSH

In cryptographic protocols, a session key is a cryptographic key that is used for encrypting the bulk of transmitted data and ensuring integrity of the data.

Most cryptographic protocols, such as SSH utilize a key exchange algorithm for deriving unique keys for each session or connection. Typical key exchange algorithms include Diffie-Hellman and elliptic curve Diffie-Hellman.

Algorithms such as Diffie-Hellman can generate a shared secret that is only known to the communicating parties, and not to a passive eavesdropper. However, such algorithms are vulnerable to man-in-the-middle attacks, which allows an active attacker to pretend to be the other side to each communicating party, sitting in the middle, basially establishing a separate session with each party.

To prevent man-in-the-middle attacks, key exchange typically includes some kind of authentication. The authentication is generally a digital signature of all data exchanged during the key exchange as seen by the signing party. The data (or hash of it) is then signed by some shared secret - typically a private key. The other end verifies the signature using a public key and makes sure the signed values how it saw the exchanged data.

Some kind of shared key pair or shared secret is generally needed to prevent man-in-the-middle attacks.

Perfect forward secrecy means that compromise of long-term keys (e.g., host keys) does not compromise session keys. In other words, an attacker who breaks into the server is not able to decrypt earlier sessions.

The SSH protocol provides perfect forward secrecy by using Diffie-Hellman or elliptic curve Diffie-Hellman for every session. This differs from SSL/TLS, that is usually configured without perfect forward secrecy, even though the standard does support it.

Managing SSH keys is important to ensure host keys are properly up to date (to prevent man-in-the-middle attacks) and to ensure that user authentication using SSH keys is properly under control.

Authorized keys and identity keys grant access, and managing them is an important part of identity and access management. In some organizations, SSH keys constitute more than 90% of all access credentials.