1

Cisco have two ways of enabling public key authentication: using the public key and using the public key hash.

ip ssh pubkey-chain
  username <user>
    key-string <public key>
    OR  
    kye-hash <public key MD5 hash, aka fingerprint>

I know how to enable public key authentication using openssh. The question is can you authenticate using only the key signature - that is provide to the ssh server the key fingerprint instead of the whole public key?

Improve this question

1 Answer 1

Reset to default
1

No. The authorized_keys file contains strictly only the public key, as described in the manual page for sshd:

AUTHORIZED_KEYS FILE FORMAT

Each line of the file contains one key (empty lines and lines starting with a ‘#’ are ignored as comments). [...] Protocol 2 public key consist of: options, keytype, base64-encoded key, comment.

Accepting the key only based on the fingerprint can work only if you will send the public key before you request authentication (the server needs to verify your authentication by decrypting the challenge using the public key). Since MD5 is already considered as cryptographically broken it might be a security issue.

Improve this answer
4
  • how does Cisco do it then? you in give the server only the key fingerprint of you public key and then you can authenticate using that public key...
    – Pandrei
    Jun 23, 2016 at 11:15
  • You are sending the public key during the first (test) authentication phase and hashing it, they can match it with the fingerprint.
    – Jakuje
    Jun 23, 2016 at 11:16
  • and openssh does not support a similar feature?
    – Pandrei
    Jun 23, 2016 at 11:19
  • Openssh sends the public key too, but it does not support storing only fingerprint in the above files as already explained in the answer and in the quoted manual page.
    – Jakuje
    Jun 23, 2016 at 11:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .