3

Is is the same as a public key in RSA, except they made it more suitable for self-signed hosts? What happens behind the scenes when our ssh client presents it to us?

4

The "fingerprint" is a hash of the server's public key. It is not the public key itself; however, hash functions are so that it is not feasible to actually compute two public keys with the same fingerprint. Therefore, if you want to know whether you are talking to the right server (and not some impersonator), then you "just" need to compute the server's key fingerprint (from the public key that the server just sent to you) and compare it with a "reference fingerprint".

Fingerprints are used because they are small enough to be managed by humans: checking a fingerprint entails verifying 40 hexadecimal characters; that's not something that you want to do ten times a day, but it is feasible. When the SSH client presents the fingerprint, it has received the public key from the server, and noticed that this is a new server, never encountered by that client yet, and as such the server's public key cannot be compared with the known and expected value. The client thus computes the fingerprint, and displays it to the user, so that the user finishes the validation business.

You still need a "reference fingerprint" against which to compare that which is computed and printed by the client. You could, for instance, phone the expected server's sysadmin and ask him to spell out the fingerprint over the phone. That way, you can still connect to your main lab machines while you are on a trip to a conference two continents away, and using the laptop of another friendly researcher (because your own laptop broke when you dropped it while getting out of your plane).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.