3 ms·
A major problem with doing this is that you have to worry about cross-protocol attacks because there is no namespace parameter like there is with SSH signatures
by agwa 5y ago
A major problem with doing this is that you have to worry about cross-protocol attacks because there is no namespace parameter like there is with SSH signatures. SSH signatures provide the necessary structure to safely use a single key for multiple purposes.
- chasil 5y agoIt's true, I do remember the DROWN exploit relying upon keys presented over differing protocols. It doesn't take long to generate an RSA key, though. A dedicated signing key would seem to be the obvious thing to do. https://en.wikipedia.org/wiki/DROWN_attack https://en.wikipedia.org/wiki/DROWN_attack