SSH

SSH Host Key Pinning Turns First Contact Into a Persistent Trust Decision

SSH Host Key Pinning Turns First Contact Into a Persistent Trust Decision An SSH client can negotiate strong encryption with the wrong server. The cryptographic channel may be intact while an active intermediary terminates one SSH connection and creates another, unless the client has a reliable basis for authenticating the server’s host key. OpenSSH addresses that boundary with host key verification. A client records or otherwise obtains trusted host key material and checks the key presented during later connections. This converts server identity from a property inferred from network routing into a cryptographic comparison anchored in local or externally authenticated state.