Re: Hardware potential to duplicate existing host keys... RSA DSA

RW <[e-mail]> writes:
> Dag-Erling Sm=C3=B8rgrav <[e-mail]> writes:
> > You do know that these keys are used only for authentication, and
> > not for encryption, right?
> I'm not very familiar with ssh, but surely they're also used for
> session-key exchange, which makes them crucial to encryption. They
> should be as secure as the strongest symmetric cipher they need to work
> with.

No.  They are used for authentication only.  This is crypto 101.

Having a copy of the host key allows you to do one thing and one thing
only: impersonate the server.  It does not allow you to eavesdrop on an
already-established connection.

If the server is set up to require key-based user authentication, an
attacker would also have to obtain the user's key to mount an effective
man-in-the-middle attack.

DES
--=20
Dag-Erling Sm=C3=B8rgrav - [e-mail]
_______________________________________________
[e-mail] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "[e-mail]"