Re:SSH Artwork
by yccs27 on Wednesday November 27, 2024 @08:10AM
(#42255781)
The fact that this works means that comparing keys visually by their artwork is insecure, since it allows you to generate a key pair which looks very similar to a target public key. I guess visual fingerprints might not have enough entropy.
[ Parent
| on HN ]
Re:SSH Artwork
by tayiorrobinson on Wednesday November 27, 2024 @09:21AM
(#42256293)
It's probably still more secure than trying to compare the regular old string representations (who checks more than the last 5 characters from the end?)
And plus, you still have to brute force it to get one that looks close
Where's the proof that this works?
It's a brute forcing tool with the goal of finding the desired fingerprint, but there's no demonstration of it actually working.
It's enough to find a fingerprint that's visually similar enough. It doesn't have to be exactly the same. That's many orders of magnitude easier than finding an exact match!
Re:SSH Artwork
by doctoboggan on Wednesday November 27, 2024 @01:22PM
(#42258336)
> and kill the artist when patience is depleted.
This is the key part. You probably have to have _a lot_ of patience to get anything reasonable.
Re:SSH Artwork
by simlevesque on Wednesday November 27, 2024 @01:50PM
(#42258605)
> means that comparing keys visually by their artwork is insecure
I'm not sure if this goal is achievable.
A very easy way to find such "visual" collisions is described in section 4.2 of our drunken bishop paper: http://www.dirk-loss.de/sshvis/drunken_bishop.pdf
Comparing visually wasn't safe in the first place for the same reason, this changes nothing
Here's my key's [1] art:
+------[RSA]------+
| .+.+ oE+=oo |
| .B.O.o=+B . |
| o.O +*.o.= |
| . = ++ = . . |
| + +S. o . |
| . *. . . |
| o o |
| . |
| |
+-----[SHA256]----+
+------[RSA]------+
| o+*B*=+Bo |
| o.+.*X=O o |
| = +*+* o o |
| E = += + o |
| + =S . + |
| o . . . |
| . |
| |
| |
+-----[SHA256]----+