1

Cisco have two ways of enabling public key authentication: using the public key and using the public key hash.

ip ssh pubkey-chain
  username <user>
    key-string <public key>
    OR  
    kye-hash <public key MD5 hash, aka fingerprint>

I know how to enable public key authentication using openssh. The question is can you authenticate using only the key signature - that is provide to the ssh server the key fingerprint instead of the whole public key?

1

No. The authorized_keys file contains strictly only the public key, as described in the manual page for sshd:

AUTHORIZED_KEYS FILE FORMAT

Each line of the file contains one key (empty lines and lines starting with a ‘#’ are ignored as comments). [...] Protocol 2 public key consist of: options, keytype, base64-encoded key, comment.

Accepting the key only based on the fingerprint can work only if you will send the public key before you request authentication (the server needs to verify your authentication by decrypting the challenge using the public key). Since MD5 is already considered as cryptographically broken it might be a security issue.

  • how does Cisco do it then? you in give the server only the key fingerprint of you public key and then you can authenticate using that public key... – Pandrei Jun 23 '16 at 11:15
  • You are sending the public key during the first (test) authentication phase and hashing it, they can match it with the fingerprint. – Jakuje Jun 23 '16 at 11:16
  • and openssh does not support a similar feature? – Pandrei Jun 23 '16 at 11:19
  • Openssh sends the public key too, but it does not support storing only fingerprint in the above files as already explained in the answer and in the quoted manual page. – Jakuje Jun 23 '16 at 11:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.