3 ms·

I'm a bit confused about this. I merely glanced at the RFC, so maybe I missed that: I guess most people connect to a server by name (using DNS lookups, vs. dir

• randywaterhouse 13y ago
  While I think you're right, in the sense that an attacker who can forge your DNS request for ssh.example.com to direct your SSH from 192.168.1.111 to 192.168.1.200 might have the ability to manipulate the TXT entry of your public key signature in the DNS records, it's a matter of who you think your attacker could be. Security is all relative, but I'm quite sure it would be possible for your to just sign your public key signature (which is what the article covers), and presumably you've kept your private key a real secret, so that isn't forge-able (unless your enemy has cracked your 2046/4096-bit RSA key).
• Tharkun 13y ago
  The RFC acknowledges this problem, which is why it kindly suggests you use DNSSEC ;-) As another commenter mentioned, it all depends on who your attacker is. A MITM ssh attack won't necessarily forge your DNS request (maybe your router is compromised?), so even without DNSSEC there might be some use in enabling this.