Re: [TLS] TLS, PKI,

[Peter Gutmann <[e-mail]>]

Bruno Harbulot <[e-mail]> writes:

>I wonder how many people really check the fingerprint of the SSH server key
>when they connect to a server they haven't connected to before.

I don't know about connecting to new servers, but if the fingerprint changes
when connecting to an existing server then the same number check it as the
number who perform out-of-band verification of certs when they change: Zero.

(I did a survey of two large .edus as groundwork for a paper I was thinking of
writing and needed to know the base rate for a fuzzy-fingerprint attack, which
allows you to spoof SSH server fingerprints unless the user methodically
verifies all 160 bits of the fingerprint.  It was zero, which meant that the
fuzzy-fingerprint attack couldn't be any worse than that.  This lead to a
proposed paper with the title "Do users check SSH fingerprints to defeat MITM
attacks?" and an abstract of "No", which I felt was brief and to the point).

This result represents good news for both the SSL/TLS PKI camps and the SSH
key-continuity camps, since SSH advocates can rejoice over the fact that the
expensive PKI-based approach is no better than the SSH one, while PKI
advocates can rest assured that their solution is no less secure than the SSH
one.

Peter.