5 ms·

SSH supports CA-style key signing, and it also supports server fingerprint validation over DNSSEC (search for SSHFP DNS). Unfortunately neither of these things

by shazow 12y ago

SSH supports CA-style key signing, and it also supports server fingerprint validation over DNSSEC (search for SSHFP DNS). Unfortunately neither of these things are commonly used yet. Cloudflare is adding DNSSEC support soon, so hopefully that will change.

agwa 12y ago
It's going to take a lot more than Cloudflare adding DNSSEC support to make SSHFP records viable. Every system running an SSH client will need to run its own validating resolver. If you leave validation to an upstream server you lose a significant amount of security.
- tptacek 12y ago
  Not to mention that if your adversary is the Global Adversary, DNSSEC is mostly useless.