Skip to main content
Information Security

Return to Question

added 23 characters in body
Source Link
sampablokuper
sampablokuper
  • 2.1k
  • 1
  • 21
  • 33

Yes, I know that after giving an SSH public key to someone else, one should always assume that it might have been swiftly published somewhere. (For instance, give your SSH public key to GitHub, and GitHub will publish it. E.g. presumably this one belongs to @Jeff Atwood, aka Coding Horror.) This question is about an exception to that general rule.

Suppose:

  • SSH client C is attempting to log in to an SSH server S for the first time, as user u, via public-key authentication;
  • C does not know S's SSH public key fingerprint (i.e. the host key fingerprint);
  • S has a copy of C's public key in /home/u/.ssh/authorized_keys;
  • nobody but C and S know C's public key;
  • M is a malicious server identical to S in all respects (e.g. equally as capable as S is of presenting itself to C at the IP address where C expects to find S), except that M does not know C's public key.

Question: Can C distinguish between M and S?

Yes, I know that after giving an SSH public key to someone else, one should always assume that it might have been swiftly published somewhere. (For instance, give your SSH public key to GitHub, and GitHub will publish it. E.g. presumably this one belongs to @Jeff Atwood, aka Coding Horror.) This question is about an exception to that general rule.

Suppose:

  • SSH client C is attempting to log in to an SSH server S as user u via public-key authentication;
  • C does not know S's SSH public key fingerprint (i.e. the host key fingerprint);
  • S has a copy of C's public key in /home/u/.ssh/authorized_keys;
  • nobody but C and S know C's public key;
  • M is a malicious server identical to S in all respects (e.g. equally as capable as S is of presenting itself to C at the IP address where C expects to find S), except that M does not know C's public key.

Question: Can C distinguish between M and S?

Yes, I know that after giving an SSH public key to someone else, one should always assume that it might have been swiftly published somewhere. (For instance, give your SSH public key to GitHub, and GitHub will publish it. E.g. presumably this one belongs to @Jeff Atwood, aka Coding Horror.) This question is about an exception to that general rule.

Suppose:

  • SSH client C is attempting to log in to an SSH server S for the first time, as user u, via public-key authentication;
  • C does not know S's SSH public key fingerprint (i.e. the host key fingerprint);
  • S has a copy of C's public key in /home/u/.ssh/authorized_keys;
  • nobody but C and S know C's public key;
  • M is a malicious server identical to S in all respects (e.g. equally as capable as S is of presenting itself to C at the IP address where C expects to find S), except that M does not know C's public key.

Question: Can C distinguish between M and S?

Source Link
sampablokuper
sampablokuper
  • 2.1k
  • 1
  • 21
  • 33

Can a malicious SSH server successfully *pretend* to know a client's public key?

Yes, I know that after giving an SSH public key to someone else, one should always assume that it might have been swiftly published somewhere. (For instance, give your SSH public key to GitHub, and GitHub will publish it. E.g. presumably this one belongs to @Jeff Atwood, aka Coding Horror.) This question is about an exception to that general rule.

Suppose:

  • SSH client C is attempting to log in to an SSH server S as user u via public-key authentication;
  • C does not know S's SSH public key fingerprint (i.e. the host key fingerprint);
  • S has a copy of C's public key in /home/u/.ssh/authorized_keys;
  • nobody but C and S know C's public key;
  • M is a malicious server identical to S in all respects (e.g. equally as capable as S is of presenting itself to C at the IP address where C expects to find S), except that M does not know C's public key.

Question: Can C distinguish between M and S?