Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm studying the TLS-OBC extension and would like to know if it improves security of non Web-based protocols?

Specifically, would it be of any benefit to SSH clients? (version 1 or version 2.x/secsh)

I'm just trying to understand the scope of applicability of this technology

share|improve this question
up vote 2 down vote accepted

SSH does not rely on SSL/TLS (see RFC 4253). OpenSSH relies on the OpenSSL library, but that's just because it reuses some of the cryptographic functions, which are common to the two protocols (OpenSSL does far more than SSL/TLS).

Therefore, you wouldn't be able to use TLS-OBS as such with SSH.

Would you want to generate a new key-pair every time you log on to a new SSH server, in a similar way to what's suggested in TLS-OBS? Possibly, but you wouldn't necessarily need a new extension to achieve the same goal. You might as well use the current methods: generate an SSH key-pair and add the public key to the authorized keys in your account the first time you log on.

share|improve this answer

OpenSSL is mostly two libraries and their associated includes. libcrypto is a generic cryptographic library, implementing stuff such as chaining modes, block ciphers and cryptographic hashes. The second component of OpenSSL is the libssl library, implementing the SSL and TLS protocols.

The SSH protocol is not based on SSL/TLS, and OpenSSH only uses the libcrypto component of OpenSSL.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.