论文标题
哦，ssh-it，我的指纹是什么？ SSH主机密钥指纹验证记录的大规模分析
Oh SSH-it, what's my fingerprint? A Large-Scale Analysis of SSH Host Key Fingerprint Verification Records in the DNS
论文作者
论文摘要
SSH协议通常用于访问Internet上的远程系统，因为它为通信提供了加密和身份验证的通道。如果建立了新连接后，客户端不知道呈现的服务器密钥，则要求用户手动验证键指纹，这很容易出现错误，并且经常被盲目信任。 SSH标准描述了此类手动密钥验证的替代方法：使用域名系统（DNS）在SSHFP记录中发布服务器密钥信息。 在本文中，我们进行了一项大规模的互联网研究，以衡量DNS域名中SSHFP记录的普遍性。我们在26天的时间内从证书透明度日志中扫描了Tranco 1M列表，并从证书透明度日志中扫描了超过5亿个名称。结果表明，在两个研究的人群中，大约有10,000个域具有SSHFP记录，其中一半以上在不使用DNSSEC的情况下部署了一半以上，从而大大降低了安全效益。
The SSH protocol is commonly used to access remote systems on the Internet, as it provides an encrypted and authenticated channel for communication. If upon establishing a new connection, the presented server key is unknown to the client, the user is asked to verify the key fingerprint manually, which is prone to errors and often blindly trusted. The SSH standard describes an alternative to such manual key verification: using the Domain Name System (DNS) to publish the server key information in SSHFP records. In this paper, we conduct a large-scale Internet study to measure the prevalence of SSHFP records among DNS domain names. We scan the Tranco 1M list and over 500 million names from the certificate transparency log over the course of 26 days. The results show that in two studied populations, about 1 in 10,000 domains has SSHFP records, with more than half of them deployed without using DNSSEC, drastically reducing security benefits.
