4 ms·
Ask HN: Why doesn't SSH implement a 'Perfect hash function' for known hosts
I know that this is a bit paranoid, but once/if you get access to someone's computer, you're pretty much left with a catalog of other systems that you might have access to in ~/.ssh/known_hosts
My question is: why aren't those entries hashed in a way that there are no collisions? if someone wants to verify if the fingerprint is ok, there should be a command that given the domain would print the existing fingerprint (by calculating the hash meanwhile)
Ofcourse, the Hash would have to be salted (and/or peppered) by system.
*Perfect 'hash' function: https://en.wikipedia.org/wiki/Perfect_hash_function
- cjbprime 10y agoHuh? known_hosts files are hashed by default. If yours aren't, it's probably because you have `HashKnownHosts no` in your config somewhere.
- joantune 10y agogosh, nevermind you're right, I just checked and on a 'recent' Linux VPS that I had spinned out and indeed they are. But they weren't on my Mac and I had never noticed that detail on new machines. All of the other ones where I looked into ~/.ssh/known_hosts had plain hosts there. on a side note: it's great to know that it's supported :)
- deleted 10y ago[deleted]
- joantune 10y agoWell, they are now :) (my ssh autocomplete ceased to work [ofcourse] though..)