Host Authentication

Cybersecurity 23 Sep 2026 5 min read

SSHFP Publishes SSH Host Key Fingerprints Through DNSSEC

SSHFP Publishes SSH Host Key Fingerprints Through DNSSEC SSH clients need a trustworthy basis for deciding whether a server’s host key belongs to the intended host. A local known_hosts entry supplies that basis after a key has been accepted, but the first connection still needs a verification path if the key was not provisioned in advance. SSHFP moves a host-key fingerprint into DNS. RFC 4255 defines the SSHFP resource record so a client can compare the public key presented by an SSH server with a fingerprint published for that hostname. The security property depends on authenticated DNS data: a matching fingerprint from an unauthenticated DNS answer does not provide the trust condition defined for secure SSHFP verification.

Cybersecurity SSH

Cybersecurity 23 Sep 2026 6 min read

OpenSSH Host Certificates Replace Per-Host Key Pinning

OpenSSH Host Certificates Replace Per-Host Key Pinning SSH host authentication protects a client from silently accepting a different server key for a name it intended to reach. The familiar known_hosts model can pin a key directly to a host. That model is simple, but operating it across a large fleet creates a distribution problem: new hosts need trusted entries, planned key rotation changes pins, and stale entries can survive after infrastructure changes.

Cybersecurity OpenSSH