Prior to any authentication, a private session key is negotiated and used for encryption for the life of the session. The password (or proof of key ownership,

Prior to any authentication, a private session key is negotiated and used for encryption for the life of the session. The password (or proof of key ownership, or cert) used for auth is only used for auth, and is only sent after DH key negotiation is complete.