2 ms·
You are saying that the ssh client that I have that locally validates SSHFP records using getdns doesn't actually work because DNSSEC is not universally deploye
by phicoh 9y ago
You are saying that the ssh client that I have that locally validates SSHFP records using getdns doesn't actually work because DNSSEC is not universally deployed?
Strange if something I've been using for a couple of years cannot exist.
- dogecoinbase 9y agoYou are correct that using previously obtained information over a secure channel will allow you to continue connecting to an unchanged endpoint. Again, not helpful when connecting to new or changed endpoints over an untrusted path unless you assume that all endpoint implement the mechanism (and, of course, that you trust the CA).
- xorcist 9y agoSSH does not operate with trust-on-first-use when using DNSSEC. It will not store key information locally in that case, specifically to be able to operate with changed endpoints over untrusted networks.