I understand that most people don't use it and indeed rely on tofu, but the statement is not absolutely correct.
ssh server keys can be authenticated using (the DNSSEC "CA" system and) SSHFP, and it's possible to setup a signing CA for the host key (similar to ssh certificates, however not applicable for foreign servers).
And of course, the fingerprint could be advertised out of band e.g. on the homepage with tls
sshfp is not PKI. It's an option and it is off by default in ssh(1). In practice no one actually deploys it, exe.dev, terminal.shop, jobs.{whoever.com}, etc. I've yet to see an in the wild deployment. The aforementioned sites let you perform electronic payment transactions over ssh without it, which is probably a PCI violation tbh, but auditors aren't good enough.
Agreed. Amid all this hype, once again we continue to see such disregard for basic security implications and using ssh outside it's intended use-case; especially sshing into random servers.
Now we wait for the discovery of an RCE, key leakage vulnerability or a security bypass that leads to a trivial mitm attack to magnify why ssh apps make no sense security wise.
SSH does in fact have a PKI, just not a global one. Large-fleet SSH installs all tend to use certificate authorities, for this reason (and to simplify SSO).
When I last harassed Crawshaw about this and we discussed bits, he submitted <a href="https://github.com/C2SP/C2SP/blob/main/well-known-ssh-hosts.md" rel="nofollow">https://github.com/C2SP/C2SP/blob/main/well-known-ssh-hosts....
Unfortunately neither of us has taken time (AFAIK) to go back and implement it anywhere.
I don't understand the impulse behind these things --- this is a bootstrap mechanism for a global PKI for SSH. But cold introductions to SSH hosts (that is, first connections to hosts you have no business or technical relationship with) virtually never happen. What problem does it solve?
When you see people advertising a coffee shop at a conference and people TOFU'ing on conference wifi then plugging in credit card numbers, the picture gets a little more clear.
So really the trend I'm talking about here is people turning SSH into a browser, hosting apps behind SSH that expect a much higher volume of TOFU happening, which is a departure from the "first time i setup my vps" kind of case.
Honestly at this point I'd be kind of happy if we could just use an x.509 cert from a webpki acme provider in the sshd and be done with it, for the host identity part.
raggi · · focus · HN ↗
pzacik · · focus · HN ↗
raggi · · focus · HN ↗
on terminal.shop, steal credit cards on jobs endpoints, perform identity theft on exe.dev, whatever you put on there
kro · · focus · HN ↗
ssh server keys can be authenticated using (the DNSSEC "CA" system and) SSHFP, and it's possible to setup a signing CA for the host key (similar to ssh certificates, however not applicable for foreign servers). And of course, the fingerprint could be advertised out of band e.g. on the homepage with tls
raggi · · focus · HN ↗
webpki is on by default.
rvz · · focus · HN ↗
Now we wait for the discovery of an RCE, key leakage vulnerability or a security bypass that leads to a trivial mitm attack to magnify why ssh apps make no sense security wise.
sph · · focus · HN ↗
<a href="https://en.wikipedia.org/wiki/Man-in-the-middle_attack" rel="nofollow">https://en.wikipedia.org/wiki/Man-in-the-middle_attack
<a href="https://en.wikipedia.org/wiki/Trust_on_first_use" rel="nofollow">https://en.wikipedia.org/wiki/Trust_on_first_use
tptacek · · focus · HN ↗
raggi · · focus · HN ↗
When I last harassed Crawshaw about this and we discussed bits, he submitted <a href="https://github.com/C2SP/C2SP/blob/main/well-known-ssh-hosts.md" rel="nofollow">https://github.com/C2SP/C2SP/blob/main/well-known-ssh-hosts....
Unfortunately neither of us has taken time (AFAIK) to go back and implement it anywhere.
tptacek · · focus · HN ↗
raggi · · focus · HN ↗
edmccard · · focus · HN ↗
raggi · · focus · HN ↗
tptacek · · focus · HN ↗
raggi · · focus · HN ↗
Honestly at this point I'd be kind of happy if we could just use an x.509 cert from a webpki acme provider in the sshd and be done with it, for the host identity part.