full-disclosure - Re: [FD] Strength and Weakness of Methods to Confirm SSH Host Key

Open Source and information security mailing list archives

Message-ID: <5423A1FC.7060807@redbarn.org>
Date: Wed, 24 Sep 2014 22:02:52 -0700
From: Paul Vixie <paul@...barn.org>
To: Gunnar Wolf <gwolf@...lf.org>
Cc: fulldisclosure@...lists.org, bugtraq@...urityfocus.com,
	John Leo <johnleo@...ckssh.com>
Subject: Re: [FD] Strength and Weakness of Methods to Confirm SSH Host Key

> John Leo dijo [Mon, Sep 22, 2014 at 03:51:57PM +0800]:
>
>> "use DNSSEC to validate SSH fingerprints"
>> (advice from Micha Borrmann / Jeroen van der Ham / john)
>> This is a good solution.
>> Weakness: HTTPS is more mature than DNSSEC(in my personal opinion).

That's a truth but not nec'ily a weakness. RLOGIN is more mature than
SSH, but, I prefer SSH every time I get a choice.

DNSSEC mostly doesn't work, since EDNS mostly doesn't work, since UDP
fragmentation of DNS mostly doesn't work. So, deployment (lack of) could
be called a weakness, except: in our community (readers of and
contributors to fulldisclosure@ and bugtraq@), DNSSEC mostly does work,
because we are mostly on networks controlled by competent well informed
modern technologists.

So, in my personal opinion, we ought to pile on the DNSSEC bandwagon for
SSHFP support, as our way to make SSH key confirmation more secure.
(Right now most of us don't even read the hex, we just say Yes.)

-- 
Paul Vixie

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives