oss-security - Re: OpenSSH key blacklisting

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / NEWS community lists Wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Wed, 28 May 2008 17:14:22 +0200
From: Florian Weimer <fw@...eb.enyo.de>
To: oss-security@...ts.openwall.com
Subject: Re: OpenSSH key blacklisting

* Tim Brown:

> Maybe I've missed something, in which case, shoot me down, but why
> unlike other services that make use of public key cryptography, does
> OpenSSH not have use a model which supports proper authorisation and
> revocation mechanisms?

I haven't seen a working revocation mechanism implemented elsewhere.
It's a very difficult problem.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.