Usually, people recommend to use a single private-public key pair everywhere (if we're not talking about a possibility of compromising the private key):
- Best Practice: “One per-user ssh key” or “multiple per-host ssh keys”
- Reusing Private/Public Keys
It seems that this would result in a vulnerability when using client certificate authentication over SSH. Since it is so popular to suggest, I suspect the "algorithm" below won't work. But I just don't get what exactly is wrong with it.
I've tried to make my description as detailed as possible, to minimize possible discrepancies, so, please excuse me for the length...
- PC1 has both (S1_id_rsa.pub and S2_id_rsa.pub) fingerprints in his known hosts.
- Server1 somehow knows about existence of PC1's account on Server2.
- PC1 : has P1_id_rsa , S1_id_rsa.pub, S2_id_rsa.pub.
- Server1, the attacker : has S1_id_rsa, P1_id_rsa.pub, S2_id_rsa.pub.
- Server2: has S2_id_rsa, P1_id_rsa.pub
This is something like a well-known man-in-the-middle attack, but a bit different.
- PC1 sends "Hi" to Server1
- Server1 sends "Hi" to Server2
Server shares it's public key
- Server2 sends Server1 S2_id_rsa.pub
- Server1 sends PC1 S1_id_rsa.pub (instead of S2_id_rsa.pub)
- PC1 accepts S1_id_rsa.pub's fingerprint (as it's known)
Two separate shared-secret tunnels are generated using Diffie-Hellman:
- Server2 generates DH1.a, and sends DH1.A,signed with S2_id_rsa, to Server1
- Server1 generates DH1.b and sends DH1.B to Server2
- Tunnel established
- Server1 generates DH2.a, and sends DH1.A, signed with S1_id_rsa, to PC1
- PC1 generates DH2.b and sends DH2.B to Server1
- Tunnel is established.
Client Authentication (Server2 now wants to be sure he is talking to PC1)
- PC1 sends P1_id_rsa.pub to Server1
- Server1 sends P1_id_rsa.pub to Server2
- Server2 generates a challenge, which could be solved only with P1_id_rsa and sends it to Server1
- Server1 just tunnels challenge to PC1
- PC1 solves the challenge and sends answer to Server1
- Server1 tunnels answer to Server2
P.S. I've looked through public-key cryptography and man-in-the-middle attack on Wikipedia, and this quite detailed answer (my view of the whole process is largely based on it), but I've not found the answer..
I wasn't able to find a readable "complete ssh authentication and encryption processes for dummies"...
I've already asked the same question on Server Fault, but was suggested to re-post it here.