3

I'm designing the communication mechanism for end user devices that will communicate with a row of servers. My current plan is

  1. on first run, a device will generate its own SSH key pair (RSA and 4096 bits)
  2. the device will transfer its ID and public key via HTTPS (utilizing a valid certificate) to one of the registration servers
  3. once confirmed, the device opens a SSH connection to a reg-server and receives the servers public key

Is this a valid approach, or would usage of "Server Authentication with Certificates" (DH key exchange) be the better == more secure way?

Improve this question
1
  • I don't think you fully understand Diffie-Hellman. It cannot be used by itself for exchanging asymmetric keys; what it does is negotiate a symmetric key between the parties. SSH will always use Diffie-Hellman to get the session key (SSH 2 has no alternative algorithms); you seem to want to exchange the host and client keys (the former is used to sign the server's ephemeral DH key; the latter is used after key-exchange to authenticate the client), but that doesn't have anything to do with Diffie-Hellman.
    – cpast
    Mar 19, 2015 at 22:51

1 Answer 1

Reset to default
2

Looks good to me. Note that, depending on the cipher list you enable, HTTPS will do a DH key exchange. As long as you trust the SSL implementation on the device and the server, and that you audit the certificate trust list on the device, the connection between the device can be considered secure.

The only thing I'm concerned about is that the device can open an SSH access to the server. Securing SSH is very difficult because you are giving people a shell access (which includes, among other things, the ability to transfer and store files and to execute almost arbitrary programs). If you don't fully trust all the people that might have access to the device, this could be very risky to your server.

Unless you truly need to give people the ability to run arbitrary programs, it would usually be a better to expose a certain predetermined list of resources through a service wrapper, like HTTPS. This gives you more control over the execution of commands on your server.

Improve this answer
4
  • 2
    Thanks! I need to connect to the server to open a reverse tunnel to the device in order to get around firewalls, NATted networks and obstacles alike. The application's purpose is putting data on those devices. I thought using no-pty in my SSH config should help?
    – 5drive
    Mar 19, 2015 at 22:48
  • 1
    @5drive: can't the device just open a WebSocket to get push notifications, and download the files it need from the server with regular HTTPS connection? If you don't need the real time push, you can also just poll the server from time to time to get the list of files to download.
    – Lie Ryan
    Mar 19, 2015 at 22:59
  • That would be to asynchronous for the usecase. The data needs to arrive in real time as soon as the transfer starts, so the servers will mount remote shares and put the data directly on the devices.
    – 5drive
    Mar 19, 2015 at 23:17
  • @5drive: you can also push the file within the websocket directly if you want. Pushing large file with websocket isn't a good idea for browser based application, but you're not writing a browser-based application anyway, I believe, so that doesn't apply.
    – Lie Ryan
    Mar 20, 2015 at 12:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .