Public storage for public keys

[Frank Cusack]

On Mon, Jan 14, 2002 at 05:26:01PM -0500, Ed Phillips wrote:
> JH would have to first, intercept DNS traffic from A DNS and return a
> spoofed public host key for system B (okay - that should be easy enough
> for JH).  Then the hard part - JH would have to play man-in-the-middle
> between A and B enough to convince A that the spoofed host key for B is
> okay... but how can JH do this without knowing the REAL private host key
> for system B?  What am I missing?

The proposal is that the ssh client trusts the public key provided by
DNS.  An attacker would send his own IP address and public key in a
spoofed (or poisoned) DNS reply.

/fc