When creating a connection between an SSH client and an SSH server, often asymmetric encryption algorithms and keys are used for authentication (see the TScKey description). One of sides generates a pair of keys - private key and public key. The private key is used for signing data. Public key is used for signature verification. It should be passed to another side. It is important to take care about safe keys transferring.
Note: The private key should be protected and it should be known only to another side.
The is a possibility to intercept and substitute the public key when transferring.
| • | Key interception does not have any consequences. If a violator obtains a public key, he will not be able to read or change any data transferred through an SSH channel. |
| • | When the public key is substituted, the violator will have a possibility to replace the SSH server with his own computer. This lets the violator to intercept and to change data that is transferred between the client and the server. |
| • | If the public key of the client is substituted, the violator will have a possibility to replace the user's computer with his own computer and have an access to the SSH server. |
There are several ways for safe keys transferring.
| 1. | Key can be transferred though secure communication links. However, in most cases this method is unacceptable by technical reasons. Therefore other ways are used. |
| 2. | When obtaining a key form the other side, you should create a print from the key and verify it in any reliable way, for example by a phone. However, you should trust the person you are talking to. To get a finger print, you can use the GetFingerprint method of the TScKey class. |
| 3. | You can pass the signature of the key along with the key itself. The receiver verifies the key and the signature. If the signature is correct, the key is considered valid. In this case it is required both sides to have a certificate that will be used for signing the transferred key. This certificate can be obtained from one of two sources: A certificate authority (CA) such as VeriSign or GTE can provide certificates, or a privately controlled certificate server can issue certificates as well. To create a certificate, you should create a paid of keys. The private key remains on your computer, whereas the public key should be passed to CA for certification. After that the each side will be able to verify received certificate contacting with the corresponding CA. |
| 4. | One more way is to transfer the key along with its signature encrypted by asymmetric algorithms using certificates. For information on how to get certificates, see above. |
SecureBridge Components