The MITM needs the private key of the server to pose as the server and decrypt
private messages you send to to the server. The public key of the server is for
authenticating messages signed by the server and sending private messages to
the server, so you still need to verify its fingerprint. It's okay if the MITM
has the public key too. All that means is that the MITM can also authenticate messages from the
server and send private messages to the server.
In general, if all public keys are known to everyone, anyone can authenticate
anyone's signatures and anyone can send a private message to anyone. The private
key controls signing and decryption, so ideally no one can pose as another, and
no one can read a private message sent to another.
NB: The following is simplified model for educational purposes only, intended to
illustrate the point of the public key fingerprint. See this other question for more SSH details.
Review. For simplicity, instead of SSH over a computer network, consider a
public cork-board where agents can post text notes. At the start, the board is
S want to communicate, and wish to protect the privacy
and integrity of their messages from malicious agent
M. Assume private keys
are known only to their respective owners.
A encrypts a message with
S_pub, signs with
A_priv, and posts.
S decrypts the message with
S_priv, verifies signature using
S encrypts a response with
A_pub, signs with
S_priv, and posts.
- I think you know what
A does here.
M cannot decrypt these messages.
M can post encrypted messages
A. However, an attempt at forgery would fail. A message signed with
M_priv would not pass verification using
Now for the function of the public key fingerprint. Suppose
M_priv, and attempts to fool
A by posting
My public key is
[contents of M_pub]
A believes this lie,
A will encrypt messages to
M_pub so that
can decrypt them, and
M can forge messages as
M_priv. However, if
A has the fingerprint of
A can compare it with the fingerprint of
M_pub and discover the lie. Hence
A will refuse to use
encryption of messages to
S and authentication of messages from
Therefore when SSH gives a warning about the pubic key fingerprint being unknown
or changed, it means you could be the victim of an MITM attack. If you proceed,
the MITM will be able to decrypt your messages and forge responses as the
server. If the fingerprint check succeeds you have a very high confidence you
are not a victim of MITM, assuming the fingerprint you have is the real
fingerprint of the server, the private keys (both yours and the server's) are
indeed private, the implementations of SSH are correct, and the public-key crypto math is not