An appliance uses a curious way of obtaining ssh-rsa host keys: There is a single configuration option "management certificate" that sets RSA private keys both for HTTPS and SSH management.

Concretely, the configured certificate+key is used as-is for HTTPS. For SSH the device extracts and reuses the raw RSA key from the certificate (modulus N, public exponent e, private exponent d)

My question is: Is this "only" bad practice or a potential vulnerability?

Follow-up question HERE: What arguments can be used when communicating with the vendor?

  • 4
    $\begingroup$ This is definitely at least bad practice, and the conservative approach is to consider it a vulnerability until proven otherwise. Such determination would require considering the details in the SSH variants and the HTTPS ciphersuites permitted, in order to check if the SSH server can be abused into a way of authenticating as an HTTPS host, and vice-versa. The "one usage, one key" rule of best practices is intended to make such difficult determination unnecessary. $\endgroup$
    – fgrieu
    Nov 26 '18 at 18:20
  • $\begingroup$ There is a SF question encouraging devs to do this! serverfault.com/questions/114301/… $\endgroup$
    – user185953
    Mar 6 '19 at 13:00
  • $\begingroup$ It seems sharing is much more widespread than I originally though. For example, key sharing is allegedly the only way how to get a 2048bit host key on a Cisco WLC. $\endgroup$
    – user185953
    Mar 29 '19 at 13:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.