Re: [TLS] TLS, PKI,

[Yoav Nir <[e-mail]>]

On Jul 14, 2010, at 2:38 PM, Bruno Harbulot wrote:

> 
> 
> On 14/07/10 06:11, Peter Gutmann wrote:
>> Martin Rex<[e-mail]>  writes:
>> 
>>> Being able to easily network a small number of computers and network-attached
>>> devices at home without involvement of outside third parties is a pretty
>>> common use case.  It is where SSH started and excels in.  It is where TLS
>>> hardly worked from the beginning and where it has become much worse since due
>>> to the Scare-Consumers-Away-From-This-Technology pages in recent Browsers.
>> 
>> +1.
> 
> Agreed, but that's comparing two different things: one is SSH, the other 
> is the combination of TLS and PKIs.
> 
> I wonder how many people really check the fingerprint of the SSH server 
> key when they connect to a server they haven't connected to before.

I would guess that the answer is "none". But usually, you first connect to the SSH server through a trusted connection (in the workplace, or you set it up and then connect). After that, you're good to go, and you can connect remotely.

> I've had warnings of key-changes by a server, for which I hadn't been 
> notified of the change by the provider. After asking the technical 
> customer service, it seemed that they weren't aware of the implications 
> of changing the keys (I asked them what the new fingerprint was supposed 
> to be but all I got was a confirmation that the key had changed, not the 
> actual new fingerprint). Maybe services (for which you can't know the 
> key in advance) should be encouraged to publish the fingerprints on 
> their HTTPS website (whose identity will be asserted by PKIs...)

Or maybe in a DNS record. And now that DNSSEC is deployed, you can use that
http://www.ietf.org/mail-archive/web/ietf/current/msg62449.html

> I think SSH clients do a bit better than browsers for TLS+PKI in that 
> respect because the client remembers the fingerprint after the first 
> connection, but apart from that, there's little to check the identity of 
> the server.

If browsers accepted private CAs for domain (after a one-time dialog), and self-signed certificates for a particular server only, they would get to the same level of usability and security as SSH clients. As it is, they're better if you have no way to verify the server fingerprint, and worse if you can.