Using DNS to Securely Publish Secure Shell (SSH) Key Fingerprints

Schlyter, Jakob; Griffin, Wesley

doi:10.17487/rfc4255

Cited by 26 publications

(9 citation statements)

References 5 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Today, most users blindly accept the presented key. However, the SSHFP record attempts to provide a solution to this problem by providing the fingerprint of server public keys trough DNS [19]. An SSH client can query the DNS for this record and verify the fingerprint before accepting server's public key.…”

Section: Secure Shell (Ssh) Fingerprintsmentioning

confidence: 99%

Touring DNS Open Houses for Trends and Configurations

Kalafut

Shue

Gupta

2011

IEEE/ACM Trans. Networking

View full text Add to dashboard Cite

Abstract-DNS is a critical component of the Internet. It maps domain names to IP addresses and serves as a distributed database for various other applications, including mail, Web, and spam filtering. This paper examines DNS zones in the Internet for diversity, adoption rates of new technologies, and prevalence of configuration issues. To gather data, we sweep 60% of the Internet's domains in June -August 2007 for zone transfers. 6.6% of them allow us to transfer their complete information. Surprisingly, this includes a large fraction of the domains deploying DNSSEC. We find that DNS zones vary significantly in size and some span many ASes. Also, while antispam technologies appear to be getting deployed, the adoption rates of DNSSEC and IPv6 continue to be low. Finally, we also find that carelessness in handing DNS records can lead to reduced availability of name servers, email, and Web servers. This also undermines anti-spam efforts and the efforts to shut down phishing sites or to contain malware infections.

show abstract

Section: Secure Shell (Ssh) Fingerprintsmentioning

confidence: 99%

Touring DNS Open Houses for Trends and Configurations

Kalafut

Shue

Gupta

2011

IEEE/ACM Trans. Networking

View full text Add to dashboard Cite

show abstract

“…RFC 4255 [17] proposes to use DNS to securely publish SSH host key fingerprints. This requires the deployment of secure DNS, as well as for DNS to act as a certificate authority for the host key fingerprints for the machines in its domain.…”

Section: Related Workmentioning

confidence: 99%

DoubleCheck: Multi-path verification against man-in-the-middle attacks

Alicherry

Keromytis

2009

2009 IEEE Symposium on Computers and Communications

View full text Add to dashboard Cite

Abstract-Self-signed certificates for SSL and self-generated hosts keys for SSH are popular zero-cost, simple alternatives to public key infrastructure (PKI). They provide security against man-in-the-middle attacks, as long as the the client connecting to those services knows the certificates or host keys a priori. A simple solution used in practice is to trust the certificate or the host key when the client connects to a server for the first time. This approach is susceptible to man-in-the-middle attacks, a fact exploited by adversaries in a variety of attacks against unsuspecting users. We develop a simple and scalable solution named DoubleCheck to protect against such attacks. Our solution is achieved by retrieving the certificate from a remote host using multiple alternate paths. Our scheme does not require any new infrastructure; we make use of the Tor anonymity system to reach the destination using multiple independent paths. Hence our solution is easy to deploy in practice. Our solution does not introduce any privacy concerns. We have implemented DoubleCheck as SSH and Firefox extensions, demonstrating its practicality. Our experimental evaluation shows that the impact of DoubleCheck on performance is minimal, since the Tor network is used only for retrieving the certificate for the first time, while the data transfer and subsequent connection establishment follow normal routing rules. Our scheme is an effective way of mitigating the impact of man-in-the-middle attacks without requiring new infrastructure and at low overhead.

show abstract

“…In the long-term, the DNSSEC vision-using PKI to secure all DNS informationwould enable a nice solution (e.g., [7]); however, we don't see this happening in the near-term. Perhaps the next natural approach would be to establish a traditional hierarchical PKI for SSH servers; all SSH clients would know the trust root; all SSH servers would have access to a CA/RA system that would sensibly bind the public keys to usable names; trust paths for any given server would somehow arrive at any given client.…”

Section: Introductionmentioning

confidence: 99%

Flexible and Scalable Public Key Security for SSH

Ali

Smith

2004

Public Key Infrastructure

View full text Add to dashboard Cite

Abstract.A standard tool for secure remote access, the SSH protocol uses publickey cryptography to establish an encrypted and integrity-protected channel with a remote server. However, widely-deployed implementations of the protocol are vulnerable to man-in-the-middle attacks, where an adversary substitutes her public key for the server's. This danger particularly threatens a traveling user Bob borrowing a client machine. Imposing a traditional X.509 PKI on all SSH servers and clients is neither flexible nor scalable nor (in the foreseeable future) practical. Requiring extensive work or an SSL server at Bob's site is also not practical for many users. This paper presents our experiences designing and implementing an alternative scheme that solves the public-key security problem in SSH without requiring such an a priori universal trust structure or extensive sysadmin work-although it does require a modified SSH client. (The code is available for public download.)

show abstract

Using DNS to Securely Publish Secure Shell (SSH) Key Fingerprints

Cited by 26 publications

References 5 publications

Touring DNS Open Houses for Trends and Configurations

Touring DNS Open Houses for Trends and Configurations

DoubleCheck: Multi-path verification against man-in-the-middle attacks

Flexible and Scalable Public Key Security for SSH

Contact Info

Product

Resources

About