The SSH handshake
An SSH connection begins with a key exchange — typically ECDH over Curve25519 (curve25519-sha256) in modern implementations — to establish a shared session key, followed by the server presenting its host key so the client can verify it's connecting to the right machine, and finally derivation of symmetric session keys (commonly AES or ChaCha20) used for the rest of the session.
SSH connection setup
- 1
TCP connection + version exchange
Client and server announce their SSH protocol versions.
- 2
Key exchange (ECDH)
Both sides derive a shared secret via elliptic-curve Diffie-Hellman, typically over Curve25519.
- 3
Host key verification
The server proves it holds the private key matching its known host key fingerprint.
- 4
Session keys derived
Symmetric keys (AES or ChaCha20) are derived from the shared secret for the rest of the session.
- 5
User authentication
The client authenticates — typically by proving possession of a private key listed in authorized_keys.
The exchange, client and server
The same setup, viewed as messages crossing the wire rather than internal steps: both sides contribute to the key exchange, then the server proves its identity before anything else is trusted.
User authentication
Public-key authentication — where the client proves possession of a private key whose matching public key is listed in the server's authorized_keys — is the recommended alternative to password authentication. Modern SSH deployments increasingly default to Ed25519 keys (a specific, fast elliptic-curve signature scheme) over RSA, for smaller key size and simpler, more misuse-resistant implementation.
Just how much smaller: Ed25519 vs. RSA key size
"Smaller key size" is easy to state and worth actually computing once. An Ed25519 public key is a single compressed point on a 256-bit curve, stored raw as exactly 256 bits — 32 bytes. An RSA key offering comparable classical security (roughly 128-bit strength) needs a 3072-bit modulus, stored as 3072 ÷ 8 = 384 bytes — before even counting RSA's extra exponent and ASN.1 structure overhead.
That gap compounds every time a key is transmitted, stored in authorized_keys, or verified: a config file with hundreds of deployed keys, or a handshake that exchanges one per connection, moves roughly twelve times as much data for RSA as for Ed25519 at equivalent strength.
Practice
An organization has 4,000 servers, each storing one RSA-3072 host key (384 bytes) in its known_hosts-equivalent inventory. Switching every host key to Ed25519 (32 bytes each) would shrink that total storage by how many bytes?