0

I'm using Dropbear as an SSH server in my embedded system.

I want to know if Dropbear supports SSH key revocation? If yes, how I can do it?

  • what do you mean by "key revocation". The key is either stored in the server's ~/.ssh/authorized_keys and allowed or not and rejected for authentication. – Jakuje Jun 20 '16 at 10:18
  • @Jakuje en.wikipedia.org/wiki/Revocation_list – MOHAMED Jun 20 '16 at 10:54
  • I know what is KRL, but SSH keys do not use anything like this. So the question is how do you want to relate these two. – Jakuje Jun 20 '16 at 11:13
2

SSH public key authentication does not support anything like key revocation. The list of "allowed" keys is store in the ~/.ssh/authorized_keys and if you remove the key from there, you revoke the access (if this is what you want to hear).

Revocation list is related to Public Key Infrastructure usually based on the X.509 certificates with certificate authorities, which is really overkill to implement in lightweight Dropbear. SSH keys are standalone cryptographic primitives and they do not use anything like this. There is possibility to use certificates in OpenSSH, but not with Dropbear.

  • 1
    OpenSSH does support (its fairly simple version of) Key Revocation Lists since 6.2 (May 2013), see RevokedHostKeys in ssh_config and RevokedKeys in sshd_config and -k in ssh-keygen. I don't know for Dropbear though. – dave_thompson_085 Jun 20 '16 at 16:04
  • 1
    @dave_thompson_085 Yes, but only for the certificate authentication (openssh protocol extension), not for the public key authentication as defined by the SSH protocol. – Jakuje Jun 20 '16 at 16:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.