[prev in list] [next in list] [prev in thread] [next in thread] 

List:       full-disclosure
Subject:    Re: [FD] Strength and Weakness of Methods to Confirm SSH Host Key
From:       Paul Vixie <paul () redbarn ! org>
Date:       2014-09-25 5:02:52
Message-ID: 5423A1FC.7060807 () redbarn ! org
[Download RAW message or body]


> John Leo dijo [Mon, Sep 22, 2014 at 03:51:57PM +0800]:
>
>> "use DNSSEC to validate SSH fingerprints"
>> (advice from Micha Borrmann / Jeroen van der Ham / john)
>> This is a good solution.
>> Weakness: HTTPS is more mature than DNSSEC(in my personal opinion).

That's a truth but not nec'ily a weakness. RLOGIN is more mature than
SSH, but, I prefer SSH every time I get a choice.

DNSSEC mostly doesn't work, since EDNS mostly doesn't work, since UDP
fragmentation of DNS mostly doesn't work. So, deployment (lack of) could
be called a weakness, except: in our community (readers of and
contributors to fulldisclosure@ and bugtraq@), DNSSEC mostly does work,
because we are mostly on networks controlled by competent well informed
modern technologists.

So, in my personal opinion, we ought to pile on the DNSSEC bandwagon for
SSHFP support, as our way to make SSH key confirmation more secure.
(Right now most of us don't even read the hex, we just say Yes.)

-- 
Paul Vixie

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/
[prev in list] [next in list] [prev in thread] [next in thread]