Re: FTP/S and SFTP..... Hey, Scott K. or other SFTP guru in

[Adam Glauser <adamglauser@xxxxxxxxxxxx>]

John McKee wrote:
> > When I log onto the sftp site WITHOUT an entry in .ssh/known_hosts, I
> > AM required to enter a password.  The key pair has to be there for
> > sftp to do the encryption.  

Scott Klement wrote:
> The key pair is not required for encryption.  All the key pair does is 
> provide a means of proving your identity.

Just in case someone else is confused about this, I had always thought 
that the keypairs were used for authentication, but _also_ to agree upon 
a session key which would then be a shared secret for encrypting the 
rest of the communication.

As it turns out, SSH uses the Diffie-Hellman (DH) key exchange 
algorithm[1] to agree on a session key.  DH allows two parties to 
securely exchange a secret over an insecure channel.

[1] http://www.freesoft.org/CIE/Topics/145.htm