Host Keys

SSH Host Key Continuity Is a Client Trust Boundary

SSH Host Key Continuity Is a Client Trust Boundary An SSH connection can negotiate strong encryption and still authenticate the wrong server. Encryption protects the transport after key exchange establishes its cryptographic context; it does not independently tell a client that the server key belongs to the intended host. That identity decision rests on host-key verification. For many interactive clients, the visible artifact is a known_hosts entry. The deeper security property is continuity: a client needs a trustworthy basis for accepting a host key now and for deciding whether a different key later represents legitimate rotation or an unexpected endpoint.