31–40 of 61 posts
Notably from the changelog: It is now possible[1] to perform chosen-prefix attacks against the SHA-1 algorithm for less than USD$50K. For this reason, we will be disabling the "ssh-rsa" public key signature algorithm by default in a near-future release.
Oh deer, perhaps someone at Microsoft DevOps should be told. https://developercommunity.visualstudio.com/idea/365980/supp...
Earlier quoted context omitted.
Just for fun, most users on Github have RSA keys exclusively. Did you know that your SSH keys are public on Github? https://github.com/taylorotwell.keys https://github.com/alexcrichton.keys https://github.com/andrew.keys https://github.com/egoist.keys https://github.com/fabpot.keys Some of the most popular users even have DSS keys.
> Just for fun, most users on Github have RSA keys exclusively. Rare ecdsa-sha2-nistp256 guy here. I'd welcome Brainpool, but support mostly boils down to NIST compromised curves on the majority of applications. sadface > Did you know that your SSH keys are public on Github? Wait, what? Github makes public keys public? Outrageous!
Notably from the changelog: It is now possible[1] to perform chosen-prefix attacks against the SHA-1 algorithm for less than USD$50K. For this reason, we will be disabling the "ssh-rsa" public key signature algorithm by default in a near-future release.
Just for fun, most users on Github have RSA keys exclusively. Did you know that your SSH keys are public on Github? https://github.com/taylorotwell.keys https://github.com/alexcrichton.keys https://github.com/andrew.keys https://github.com/egoist.keys https://github.com/fabpot.keys Some of the most popular users even have DSS keys.
Earlier quoted context omitted.
> Just for fun, most users on Github have RSA keys exclusively. Rare ecdsa-sha2-nistp256 guy here. I'd welcome Brainpool, but support mostly boils down to NIST compromised curves on the majority of applications. sadface > Did you know that your SSH keys are public on Github? Wait, what? Github makes public keys public? Outrageous!
It's not intuitive because there's really no need for it.
Unless for some reason someone imports one into their authorized_keys (which presumably would require deliberate steps not random numbskullary) in which case there is a (low) risk as they have just given a dev access to an account said dev does not know exists.
Earlier quoted context omitted.
Honest question: has this any relevance outside of academia?
Sure. Consider the Web PKI ("SSL Certificates"). Suppose you have a web site pmf.example it is of course pretty easy to get yourself a certificate to make https://pmf.example/ work, today for free but even many years ago it was pretty affordable from several commercial vendors. The way those certificates work is they use a digital signature based on a hash algorithm, the CA uses its private key to sign the hash, and…
Earlier quoted context omitted.
I haven't built the new version, but I assume it defaults to ed25519 now. You can otherwise make one with ssh-keygen -t ed25519.
Last time I tried AWS doesn't support anything but RSA keys.
Earlier quoted context omitted.
Just for fun, most users on Github have RSA keys exclusively. Did you know that your SSH keys are public on Github? https://github.com/taylorotwell.keys https://github.com/alexcrichton.keys https://github.com/andrew.keys https://github.com/egoist.keys https://github.com/fabpot.keys Some of the most popular users even have DSS keys.
Those are just the public portion of the key, not the private key.
Earlier quoted context omitted.
It's not intuitive because there's really no need for it.
No harm in it either though. Unless for some reason someone imports one into their authorized_keys (which presumably would require deliberate steps not random numbskullary) in which case there is a (low) risk as they have just given a dev access to an account said dev does not know exists.
Type in a github username during the installer to import from github.com/%s.keys to /root/.ssh/authorized_keys.
The FIDO/U2F support is really nice! Though I had a question about this: is it only necessary for the client to use an OpenSSH version (>= 8.2) that supports this, or should the server also have support?
I'm pretty sure the server also needs to support it. The U2F signature stuff is different from SSH, so it needs a new authentication protocol: https://github.com/openssh/openssh-portable/blob/master/PROT...
https://marc.info/?l=openssh-unix-dev&m=157259802529972&w=2
This step is very straightforward; append the public key to authorized_keys as you would normally. Note that U2F keys are a new OpenSSH key type, so the server must support it too.
I guess it will take a few years until all servers are upgraded.