Host Authentication

Cybersecurity 24 Sep 2026 6 min read

SSHFP Anchors SSH Host Key Fingerprints in DNSSEC

An SSH client has to decide whether the host key presented by a server belongs to the intended host. A previously stored key can provide that reference on later connections, but the first connection needs another basis for authentication. SSHFP places a fingerprint of an SSH host public key in DNS so a client can compare the server key with independently retrieved data. The DNS record alone is not a trust anchor. RFC 4255 ties trusted SSHFP verification to authenticated DNS data. DNSSEC protects the lookup path and lets a validating client distinguish signed data from an unauthenticated DNS answer. The useful security property comes from that combination: SSH supplies the host key, SSHFP carries its fingerprint, and DNSSEC authenticates the DNS record used for comparison.

Cybersecurity SSH

Cybersecurity 23 Sep 2026 5 min read

SSHFP Publishes SSH Host Key Fingerprints Through DNSSEC

SSHFP Publishes SSH Host Key Fingerprints Through DNSSEC SSH clients need a trustworthy basis for deciding whether a server’s host key belongs to the intended host. A local known_hosts entry supplies that basis after a key has been accepted, but the first connection still needs a verification path if the key was not provisioned in advance. SSHFP moves a host-key fingerprint into DNS. RFC 4255 defines the SSHFP resource record so a client can compare the public key presented by an SSH server with a fingerprint published for that hostname. The security property depends on authenticated DNS data: a matching fingerprint from an unauthenticated DNS answer does not provide the trust condition defined for secure SSHFP verification.

Cybersecurity SSH

Cybersecurity 23 Sep 2026 6 min read

OpenSSH Host Certificates Replace Per-Host Key Pinning

OpenSSH Host Certificates Replace Per-Host Key Pinning SSH host authentication protects a client from silently accepting a different server key for a name it intended to reach. The familiar known_hosts model can pin a key directly to a host. That model is simple, but operating it across a large fleet creates a distribution problem: new hosts need trusted entries, planned key rotation changes pins, and stale entries can survive after infrastructure changes.

Cybersecurity OpenSSH