2

I have no config file, and every host I connect to, it seems the ssh is going through all of the keys until it finds the correct one.

Is it safe to send the key to the host that's potentially malicious? Like it could be pretending that the key ssh is offering is correct, and like intercept the secret?


I guess this kinda answers my question: https://security.stackexchange.com/a/23242 - as in the keys are safe, and I guess the only thing having a lot of keys would do is possibly locking me out if I don't specify which one to use

  • like idk why i got the upvote but ok – user12a Dec 27 '16 at 23:33
3

If you're worried about your private key being compromised, that won't happen. It isn't transmitted.

The public key is, though. I suppose you could identify someone with that, but that only really seems like an issue if you're logging into servers without permission.

Here is a well written post that goes into more detail about how SSH connections work. Relevant excerpt:

The server can use the public key in this file to encrypt a challenge message to the client. If the client can prove that it was able to decrypt this message, it has demonstrated that it owns the associated private key.

Additionally, you cannot get a private key from a public key.

  • good stuff tyvm – user12a Dec 27 '16 at 23:45
2

You should be safe to send public keys to untrusted servers; it's a core principle of ssh.

However, this year Qualys discovered a very major vulnerability that allowed a malicious server to steal private keys from a client configured in the default way. This was present for six years.

That specific issue has been fixed now, of course, but it brought to attention the fact that even OpenSSH has vulnerabilities. The fact remains that it is designed to connect safely to potentially malicious servers; whether or not your particular situation requires a stronger guarantee than "should" is something you have to determine yourself.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.