liftoff/GateOne — Issue #12: Feature request - SSHFP support
Author: owens-bill
Created: 2011-10-14 16:01:57+00:00
State: open

Don't know if this is the right way to send a feature request, it seemed more logical than attaching a comment to the screencast video ;) I'd like to suggest the addition of support for SSHFP records (RFC 4255). I know that they aren't used very often, and that they ought to be paired with DNSSEC for maximum security, but even without DNSSEC the presence of an SSHFP record would, IMO, increase the difficulty of an MITM attack against a Gate One connection.

Ultimately, having the SSL cert covered by a DANE TLSA record and the SSH fingerprint in an SSHFP record, with both of them signed and the DNSSEC validation taking place in a trusted way would be ideal; we're a ways off from achieving that, though.