As far as I know, the fingerprint is based on the public key (or is
the key? someone who knows more than I might want to clarify this) of
the SSH server. Eve could pass on the fingerprint, but she would not
have the private key, so data encrypted using the public key
associated with that fingerprint could not be decrypted by Eve. Of
course, nothing stops Eve from presenting her own key and hoping that
the user doesn't check the fingerprints.
On Aug 29, 2006, at 3:35 PM, Christ, Bryan wrote:
All,
Please pardon my naivete.
I was looking at the diagram on the URL listed below and contemplating
how host fingerprinting prevents MITM attacks.
http://www.vandyke.com/solutions/ssh_overview/
ssh_overview_threats.html
So my question is this... Given the illustration in the URL above,
what
prevents Eve from *first* contacting Alice to obtain a fingerprint
which
then gets passed to Bob on the first connection attempt?
