key rotation on ssh servers

[Damien Miller]

On Tue, 14 May 2013, Daniel Kahn Gillmor wrote:

> Reading the spec i don't see an explicit prohibition against multiple
> keys of the same key type, but i don't see how it would be handled
> exactly in the protocol either:
> 
>   https://tools.ietf.org/html/rfc4253#page-18
> 
> Looking at sshd.c, it seems to me that get_hostkey_by_type() only
> permits sshd to offer a single key of each type.

Right. The protocol only supports sending a single host key as part of 
key exchange. E.g. RFC4253 section 8 (search for "K_S")

We've toyed with an extension to express "since you trust this one,
here all my other keys" but never implemented it. To my mind, it would
look something like:

  byte    SSH_MSG_HOSTKEYS
  string  hostkeys
  string  signature

Where "hostkeys" contains:

  string  hostkey[0]
  ...
  string  hostkey[n]

and "signature" is made with the hostkey that was used to sign the last
KEX exchange.

-d