HN Explorer

Ask HN: Why doesn't SSH implement a 'Perfect hash function' for known hosts

2 points by joantune ↗ HN
I know that this is a bit paranoid, but once/if you get access to someone's computer, you're pretty much left with a catalog of other systems that you might have access to in ~/.ssh/known_hosts My question is: why aren't those entries hashed in a way that there are no collisions? if someone wants to verify if the fingerprint is ok, there should be a command that given the domain would print the existing fingerprint (by calculating the hash meanwhile)

Ofcourse, the Hash would have to be salted (and/or peppered) by system.

*Perfect 'hash' function: https://en.wikipedia.org/wiki/Perfect_hash_function

4 comments

[ 0.24 ms ] story [ 17.7 ms ] thread
cjbprime
Huh? known_hosts files are hashed by default.

If yours aren't, it's probably because you have `HashKnownHosts no` in your config somewhere.

joantune
gosh, nevermind you're right, I just checked and on a 'recent' Linux VPS that I had spinned out and indeed they are. But they weren't on my Mac and I had never noticed that detail on new machines. All of the other ones where I looked into ~/.ssh/known_hosts had plain hosts there.

on a side note: it's great to know that it's supported :)

[deleted]
(comment deleted)
joantune
Well, they are now :)

(my ssh autocomplete ceased to work [ofcourse] though..)