Host keys identify the server
02The client needs a trustworthy binding between a server name and its host key.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 4.1 ↗
RFC 4251 · § 4.1EXAMPLE
3 / 3
03
Changed key
A mismatch demands investigation; silently accepting it defeats the check.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
Read the updated RFC section ↗
A host-key signature alone does not establish the intended server name.
- A host-key signature alone does not establish the intended server name.
- A local host-key database or a trusted certification system can provide the binding.
- First-use acceptance without independent verification leaves an active-attack risk.
The illustration is schematic. Example values are illustrative; profiles and later security guidance can add requirements.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy