Home |
Licence |
FAQ |
Docs |
Download |
Keys |
Links
Mirrors |
Updates |
Feedback |
Changes |
Wishlist |
Team
We've just added support for a new host key format (ECDSA) for the first time in a long time. ECDSA host keys are already widely deployed in servers. If we do nothing, this is going to lead to lots of users prompted for host key verification as if they were connecting to the server for the first time; the existing host key(s) they already have cached will not be used to cross-certify the newly-valid key.
The SSH protocol doesn't have any facilities designed to help with this, but maybe we can cook up a cross-certification scheme that's compatible with existing servers using key re-exchange.
Ian Jackson has also made some suggestions for protocol extensions to allow more general key rollover (even with keys of the same type) with cooperating servers.
Audit trail for this wish.