Subject: "Host name" definition somewhere in the ID set?

From: Thierry Moreau <[email-masked]>
Date: Wed, 09 Mar 2005 17:36:09 -0500

Dear all:

As an outsider of the SSH protocol community (if any), I looked at the 
latest Internet-Drafts. I was looking at the initial trust on a host 
public key (well explained in tha architecture draft at 4.1  Host Keys).

My question refers to the definition of a server host name, from a 
security perspective. It should be in a security certificate sent by the 
SSH server.

Q.1 Should "host name" be defined?

Q.2 Should the specification mandate that security certificates MUST use 
the so-defined "host name" perhaps with some encoding?

Sorry if I should have found this information in one of the references. 
The OpenPGP certificate specification isn't very explicit.

Regards,

-- 

- Thierry Moreau

CONNOTECH Experts-conseils inc.
9130 Place de Montgolfier
Montreal, Qc
Canada   H2M 2A1

Tel.: (514)385-5691
Fax:  (514)385-5900

web site: http://www.connotech.com
e-mail: [email-masked]

---

From: Bill Sommerfeld <[email-masked]>
Date: Wed, 09 Mar 2005 17:28:25 -0600

> security perspective. It should be in a security certificate sent by the 

specifications for optional use of certificates of any sort with SSH would be
desirable, but everyone who has stepped up and volunteered to write a draft
on how to do this has later had to apologize for not having time to follow
through...

are you volunteering? :-)

							- Bill

---

From: Thierry Moreau <[email-masked]>
Date: Wed, 09 Mar 2005 20:20:45 -0500

> are you volunteering? :-)

Actually, I found the security certificate usage in SSH IDs well explained.

My single concern is that "host name" is not defined anywhere in the SSH 
     Internet drafts. This definition would be by reference to another 
document, I guess.

May I apologize immediately for lack of voluntary contribution from my part.

Regards,

-- 

- Thierry Moreau

Tel.: (514)385-5691
Fax:  (514)385-5900

---

From: [email-masked] (Niels Möller)
Date: 13 Mar 2005 17:50:37 +0100

Thierry Moreau <[email-masked]> writes:

> My single concern is that "host name" is not defined anywhere in the
> SSH    Internet drafts. This definition would be by reference to
> another document, I guess.

Why do you think "host name" needs to be defined? For the "known-hosts
database", which assocaites keys to host names?

The known-hosts database is mostly an implementation issue. I think
it's best to associate keys with whatever name the user types on the
command line to connect to it.

I've considered if it might be better to use the dns name used to look
up the corresponding A/AAAA record, i.e. after processing of the
search directive in /etc/resolv.conf, and cname processing. But then
one might get fooled by a rogue dns or dhcp server, which defeats the
purpose of host authentication.

(I think openssh also records the ip address together with the host
keys, but I'm not sure how that information is used).

/Niels