A Study of Key-Fingerprints: Hex vs. Base32 vs. Wordlists Vs(usenix.org)
usenix.org
A Study of Key-Fingerprints: Hex vs. Base32 vs. Wordlists Vs
https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/dechand
2 comments
My WAG at this problem a few years ago: https://en.bitcoin.it/wiki/User:Gmaxwell/visual_fingerprint_...
I'd really want to see that technique studied on actual users before trusting it. I'm not convinced that users do anything more than glance at one or two characters in hex passwords and even SSH's visual fingerprints are probably insufficiently studied (but not totally unstudied[0]) to allow telling users that glancing is enough. And if glancing isn't enough, using visual indicators at all is probably actively harmful.
[0]: http://dirk-loss.de/sshvis/drunken_bishop.pdf
[0]: http://dirk-loss.de/sshvis/drunken_bishop.pdf
In fact, I declined to post the implementation for that reason.
I'm not sure if you read my writeup but I attempted to address that "users only glance at one or two characters" by suggesting the client show the users which characters to compare. It's a little kludgy with a text UI, however.
The idea is that the field of characters is large enough that comparing only a few is fine-- so long as they're selected in a way which isn't predictable to the attacker.
I'm not sure if you read my writeup but I attempted to address that "users only glance at one or two characters" by suggesting the client show the users which characters to compare. It's a little kludgy with a text UI, however.
The idea is that the field of characters is large enough that comparing only a few is fine-- so long as they're selected in a way which isn't predictable to the attacker.
I've used rfc1751[0] which is word-based rather than sentence-based, but it's pretty convenient. I use it for my password sharing tool[1] which creates prompts that look like
where "mnemonic" is the rfc1751 mnemonic of the sha256 of the other fields and is designed to be shouted across a room.
I'd definitely be interested in a standardised sentence-based fingerprinting system akin to rfc1751
[0]: https://tools.ietf.org/html/rfc1751
[1]: https://github.com/ketralnis/secrets