An unchecked key enables a middleman
03An attacker can create two encrypted connections when the client accepts the wrong host key.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 9.3.4 ↗
RFC 4251 · § 9.3.4EXAMPLE
3 / 3
03
Trust gate
A trusted host-key comparison stops the client at the wrong-key boundary.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
Read the updated RFC section ↗
Encryption to an attacker does not authenticate the intended server.
- Encryption to an attacker does not authenticate the intended server.
- A known host-key mismatch can expose the substitution.
- Verify the server-name-to-key association before relying on authentication.
The illustration is schematic. Example values are illustrative; profiles and later security guidance can add requirements.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy