Subject: Re: server public key fingerprint?

From: Markus Friedl <[email-masked]>
Date: Thu, 1 Feb 2001 13:37:13 +0100

hi, tried to send this earlier, but it did not arrive on
the list:

http://wwwcip.informatik.uni-erlangen.de/~msfriedl/fp.txt

contains a short drafts about pubkey-fingerprints.

-m

On Wed, Jan 31, 2001 at 04:11:16PM +0100, Markus Friedl wrote:
> On Mon, Jan 29, 2001 at 04:27:52AM +0100, denis bider wrote:
> > Hello everyone,
> > 
> > is there a standardized fingerprint calculation method for verifying the
> > integrity of a server's public key? I searched the archives for the string
> > 'finger', and it only occurs once - in a PGP-related header field of a
> > single message...
> > 
> > I would think a standardized fingerprinting method would be necessary in
> > order to facilitate interoperation of clients and servers from different
> > vendors. How can you call up a server's administrator to verify the public
> > key if your client calculates the fingerprint in a manner that is
> > incompatible with the server?
> 
> openssh is using fingerprints for more than a year i think, so
> i wrote this short draft.
> 
> any comments appreciated.
> 
> Cheers,
> -markus

---

From: [email-masked] (Niels M�ller)
Date: 01 Feb 2001 17:03:24 +0100

> contains a short drafts about pubkey-fingerprints.

Thanks. Is there any particular reason why you use md5, and not sha1
(or truncated sha1, if the size is an issue)?

/Niels

---

From: Markus Friedl <[email-masked]>
Date: Thu, 1 Feb 2001 17:41:06 +0100

> (or truncated sha1, if the size is an issue)?

fingerprinting was Bjoern's idea ([email-masked]) and since his OSSH
did only contain md5 we decided that there is no need for sha1.

so now OpenSSH and OSSH use md5-fingerprints since October 1999.

-markus

---

From: [email-masked] (Niels M�ller)
Date: 01 Feb 2001 18:38:44 +0100

> so now OpenSSH and OSSH use md5-fingerprints since October 1999.

Ok. I'll see if I can add compatible fingerprinting to lsh. I liked
SPKI hashes as fingerprints because it isn't application specific. But
perhaps that doesn't matter, people won't (or perhaps even shouldn't)
use the same keys for several applications.

/Niels

---

From: "David B. Coningham" <[email-masked]>
Date: Thu, 1 Feb 2001 14:47:10 -0700

> contains a short drafts about pubkey-fingerprints.

Thanks to Markus for posting this draft.

The SSH Communications software presents the fingerprint in what
they describe as "the ingenious Bubble Babble format," which appears
to be a string of 11 words made up of 5 seemingly-random characters.

Since "Bubble Babble" is a much longer random string than the hex
string proposed in the draft, is there any reason for using it instead
of the hex string format?  If having a string of words is the reason,
should a string of words like the one defined for one-time passwords
(OTP) in RFC2289 be used instead?  This would yield, I believe, 12
words, which a user may find easier to compare than 32 characters.

If something like this is truly useful, should it be added to the draft?

Is there any documentation available for the "Bubble Babble" format?

---
David B. Coningham
[email-masked]

---

From: Markus Friedl <[email-masked]>
Date: Fri, 2 Feb 2001 00:59:03 +0100

On Thu, Feb 01, 2001 at 02:47:10PM -0700, David B. Coningham wrote:
> of the hex string format?

i don't know. perhaps its easier to memorize than hex strings?
but i don't memorize fingerprints, i just compare them.

> If having a string of words is the reason,
> (OTP) in RFC2289 be used instead?

yes, i think this is a much better option than the "Bubble Babble".
the OTP words are in use for a long time. i was thinking about this before
but decided that the hex format is simple and already in use by some clients.

> This would yield, I believe, 12

why not. feel free to edit the draft.

cheers,
-markus

---

From: "denis bider" <[email-masked]>
Date: Fri, 2 Feb 2001 13:21:29 +0100

> > This would yield, I believe, 12 words, which a user
> > may find easier to compare than 32 characters.
> >

I think it would be best if the fingerprint specification mandated a single
fingerprint format, not multiple formats; and that the single fingerprint
format be simple to implement.

In other words - it's OK if you want to define 5 different fingerprint
formats in the specification, as long as you point out a single one that is
THE fingerprint format, and make that format required, and all other formats
optional.

Also, if there are multiple formats, the specification should mandate that
an application must ALWAYS use the required fingerprint format when
displaying fingerprints. It may at the same time display the fingerprint in
any other formats, but it must display it in the required format as well.
[I.e., no configuration setting to change the preferred format - always
display all of them, or at least the required one.]

I would hope that the required fingerprint format would be a straightforward
one, like the currently defined MD5 format. I wouldn't vote for a
specification that mandates a bubble-babble kind of thing; I think the
required format should be one that is straightforward and simple to
implement.

Finally, I don't think there's really any need to define more than one
fingerprint format. But if you nevertheless decide to define multiple,
please consider the above comments.

Regards,

denis

---

From: "David B. Coningham" <[email-masked]>
Date: Tue, 6 Feb 2001 17:07:11 -0700

----- Original Message ----- 
From: "denis bider" <[email-masked]>
To: <[email-masked]>
Sent: Friday, February 02, 2001 5:21 AM
Subject: RE: server public key fingerprint?

> please consider the above comments.

I agree with this almost completely: the specification should definitely
mandate that one format be required and always displayed, and I think
the hex format presented in the draft should be that required format.
The hex format certainly does not introduce any new implementation
problems regarding processor and memory limitations.

I only think an additional format should be added to the draft if
there is a lot of agreement that it meets a need that the hex format
does not.  I am not completely convinced that the OTP format I
mentioned earlier does this, and there certainly does not seem to
be a large majority in favor of it yet.

---
David B. Coningham
[email-masked]

---

From: [email-masked] (Niels M�ller)
Date: 07 Feb 2001 14:16:48 +0100

> problems regarding processor and memory limitations.

It would make sense to me to specify one standard fingerprinting
method and format (and the one in Markus' draft is good enough for
me). The spec (either the dransport spec or a separate spec) can say
that if an implementation supports fingerprints at all, then it SHOULD
use the specified method and format.

I don't think it is appropriate for the spec to require that
fingerprints be supported in an implementation's UI. Likewise, support
for alternative fingerprinting mechanisms also seems out of scope. 

/Niels