4 ms·
Given that key based logins require signing a per-session token to verify the owner of the key is trying to connect (otherwise they would be useless since someo
by snuxoll 11y ago
Given that key based logins require signing a per-session token to verify the owner of the key is trying to connect (otherwise they would be useless since someone could just perform a replay attack) MITM'ing a key-authenticated session would allow you to perform attacks with that session, but it would not allow you to re-authenticate against that server later.
- Buge 11y agoWould active MITM be possible with key login? I would think it should be impossible. If the symmetric session key is chosen by the server and encrypted with the client's public key, the attacker won't know it and cannot mess with the session. The only thing the attacker can do is completely impersonate the server. But the attacker cannot communicate with the actual server at all.