0

I'm using Dropbear as an SSH server in my embedded system.

I want to know if Dropbear supports SSH key revocation? If yes, how I can do it?

Improve this question
3
  • what do you mean by "key revocation". The key is either stored in the server's ~/.ssh/authorized_keys and allowed or not and rejected for authentication.
    – Jakuje
    Jun 20, 2016 at 10:18
  • @Jakuje en.wikipedia.org/wiki/Revocation_list
    – MOHAMED
    Jun 20, 2016 at 10:54
  • I know what is KRL, but SSH keys do not use anything like this. So the question is how do you want to relate these two.
    – Jakuje
    Jun 20, 2016 at 11:13

1 Answer 1

Reset to default
2

SSH public key authentication does not support anything like key revocation. The list of "allowed" keys is store in the ~/.ssh/authorized_keys and if you remove the key from there, you revoke the access (if this is what you want to hear).

Revocation list is related to Public Key Infrastructure usually based on the X.509 certificates with certificate authorities, which is really overkill to implement in lightweight Dropbear. SSH keys are standalone cryptographic primitives and they do not use anything like this. There is possibility to use certificates in OpenSSH, but not with Dropbear.

Improve this answer
2
  • 1
    OpenSSH does support (its fairly simple version of) Key Revocation Lists since 6.2 (May 2013), see RevokedHostKeys in ssh_config and RevokedKeys in sshd_config and -k in ssh-keygen. I don't know for Dropbear though.
    – dave_thompson_085
    Jun 20, 2016 at 16:04
  • 1
    @dave_thompson_085 Yes, but only for the certificate authentication (openssh protocol extension), not for the public key authentication as defined by the SSH protocol.
    – Jakuje
    Jun 20, 2016 at 16:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .