<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/xhtml; charset=utf-8">
<style>
div.plaintext { white-space: normal; }
body { font-family: sans-serif; }
div.plaintext h1 { font-size: 1.4em; }
div.plaintext h2 { font-size: 1.2em; }
div.plaintext h3 { font-size: 1.1em; }
blockquote.embedded,div.plaintext blockquote { margin: 0 0 5px; padding-left: 5px; border-left: 2px solid #777777; color: #777777; }
blockquote.embedded blockquote.embedded,div.plaintext blockquote blockquote { border-left-color: #999999; color: #999999; }
blockquote.embedded blockquote.embedded blockquote.embedded,div.plaintext blockquote blockquote blockquote { border-left-color: #BBBBBB; color: #BBBBBB; }
div.plaintext a { color: #3983C4; }
blockquote.embedded,div.plaintext blockquote a { color: #777777; }
blockquote.embedded blockquote.embedded,div.plaintext blockquote blockquote a { color: #999999; }
blockquote.embedded blockquote.embedded blockquote.embedded,div.plaintext blockquote blockquote blockquote a { color: #BBBBBB; }
div.plaintext math[display="inline"] > mrow { padding:5px; }
div.plaintext div.footnotes li p { margin: 0.2em 0; }
</style>
</head>
<body>
<div class="plaintext"><p dir="auto">The code in OpenSSH is still getting exercised for it.</p>
<p dir="auto"><a href="https://blog.qualys.com/vulnerabilities-threat-research/2025/02/18/qualys-tru-discovers-two-vulnerabilities-in-openssh-cve-2025-26465-cve-2025-26466">https://blog.qualys.com/vulnerabilities-threat-research/2025/02/18/qualys-tru-discovers-two-vulnerabilities-in-openssh-cve-2025-26465-cve-2025-26466</a></p>
<p dir="auto">--Andrew</p>
<p dir="auto">On 27 Feb 2025, at 2:00, Phillip Hallam-Baker wrote:</p>
</div>
<blockquote class="embedded"><div dir="ltr"><div class="gmail_default" style="font-size:small">I am currently taking a hard look at mechanisms for using DNS Handles as a means for exchange of authenticated and non-authenticated contact information via JSContact.</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">As part of that, I wanted to know if there was any *existing* use of the SSHFP record for publishing SSH credentials and if so whether it was limited to the server. And yes, I can read the specs, what I am asking about is actual practice.</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">If there is existing use, it might be something to build on. Otherwise, I think it best to forget it and apply the same SRV/TXT framework used for everything else.</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">The basic idea of JSContacts in handles being that I can put @<a href="http://phill.hallambaker.com">phill.hallambaker.com</a> on my business card or a publication, someone can pull the TXT record and get a uri that is a locator, decryptor and authenticator all in one:</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">_<a href="http://jscontact.phill.hallambaker.com">jscontact.phill.hallambaker.com</a>. IN TXT "uri=jscontact://mplace2.social/egm3-lbnd-upo4-yxha-fy7p-hiim-y4kq"</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">That egm3-lbnd-upo4-yxha-fy7p-hiim-y4kq bit is a truncated SHA-3 digest of the contact data. So if my SSH key is in the contact and the TXT record is DNSSEC signed, we have at least some authentication of the contact.</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">Alternatively, I might put the jscontact link on my business card as a QR code. So now, you can scan the link and get direct verification.</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">mplace2.social is just a resolution hint, a domain that currently has the contact information. If that is going to be in a paper publication, the resolution site might have changed but not the contact itself.</div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">jscontact: @<a href="http://phill.hallambaker.com/egm3-lbnd-upo4-yxha-fy7p-hiim-y4kq">phill.hallambaker.com/egm3-lbnd-upo4-yxha-fy7p-hiim-y4kq</a></div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small"><br></div><div class="gmail_default" style="font-size:small">Since my publication engine has to populate the TXT records, it can do SSHFP in theory. But I see no reason to do that if it hasn't already established a user base.</div></div></blockquote>
<div class="plaintext"><blockquote>
</blockquote><blockquote><p dir="auto">_______________________________________________<br>
dns-operations mailing list<br>
dns-operations@lists.dns-oarc.net<br>
<a href="https://lists.dns-oarc.net/mailman/listinfo/dns-operations">https://lists.dns-oarc.net/mailman/listinfo/dns-operations</a></p>
</blockquote></div>
</body>
</html>