# How secure is Visual host key, and how is SHA2 converted into that representation?

SHA2 has 256 bits of possibilities.

Visual host key seems to have the following

• upper and lowercase = 26*2
• numbers and symbols = 20

Total 94 characters represented in

• 9 columns
• 17 rows

How does visual host key generate the image?

• I calculate 94^(9*17)≈7*10^31≈2^1002, which is enough to represent the whole key. Commented Mar 17, 2015 at 22:00
• Oh I see... I multiplied instead of raising the exponent. Duh. I guess I started celebrating St Patricks day too early. Commented Mar 18, 2015 at 1:36

## Does the visual fingerprint uniquely identify a server's key?

No; the "visual host key" algorithm does not preserve enough information to give each key a 100%-guaranteed-unique image. But neither does a more traditional fingerprint. ECDSA keys like yours have 256 bits. RSA keys have 2048. But if you count the hex digits in your image, you come up with 32 of them: 128 bits.

Those 128 bits are an MD5 hash of the public key. The MD5 algorithm is hard-coded in a lot of the code that generates fingerprints for display.

The visual host key algorithm (known as "randomart" in the source), takes that MD5 hash and uses it to trace a path. As to how "secure" this is, I'll let the source speak for itself:

If you see the picture is different, the key is different. If the picture looks the same, you still know nothing.

## Isn't this insecure? Isn't MD5 insecure?

If I wanted to trick you with a traditional fingerprint, I wouldn't bother with trying to generate a full MD5 collision of a pre-existing SSH key. That's hard even today.

Instead, I'd generate keys until I found one where the first few digits and the last few digits of the fingerprint matched. Unless you're very disciplined about validating, it wouldn't matter whether the fingerprint was MD5 or SHA256; your eyes would skim the number and it would look "good enough". That's what the visual fingerprint is trying to protect against.

If you're paranoid, then don't use any human-verified fingerprint if you can help it, visual or otherwise. Instead, put a known-good copy of the expected server key in your known_hosts file.

Finally, for each square you stepped on, choose a symbol based on the number of times you stepped on the square, from the following list of 14 symbols: `.o+=*BOX@%&#/^`. (That's 15 symbols total if you include "" for unvisited squares.) Mark your start and end points specially, with an `S` and an `E`, respectively.