Possible ways of
SSH server authentication are:
- Server public key fingerprint verification
- Implicit authentication
- Explicit authentication
In case of fingerprint verification everything runs on trust and there is no way to prove the server's authenticity.
In implicit authentication the client waits for initial response before sending further data. However, if the public key is already changed by a man in middle then this initial response would could come from this middle man and further communication is compromised.
In case of explicit authentication we have signature alongwith key. What if a middle man replaces both the public key and signature. Yet again the communication is compromised.
Also there are no certificates involved. Is there no solid way to authenticate the server in SSH?
I might be having some understanding gaps, so clarifications are always welcome.