Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Is it safe to publicly post the randomart visualization of keys like this?


Yes, Not only is it a visualisation of a SHA256 hash of the public key, but it's hard to turn the visualisation back into a SHA256 hash itself.


I think you should treat it as posting the key itself. In other words, it's probably possible to transform from the randart back to the key (else it wouldn't be unique per key, right?). So for a public key that is intended to be public, yes, it should be fine. For keys which you do not want public, it's probably not a good idea to post it publicly.


It's not even a representation of the public key itself; it's the SHA256 fingerprint of the key. There's no practical way to transform that back into the key -- and, in any case, the server will send that key to any client that connects, so it's not like recovering it from a screenshot accomplishes anything.


I suppose the argument would be that the key search space is reduced. Statistically speaking, you know the weights of certain binary pairs if the image is not evenly distributed. But I'm guessing that it'd only drop the average search space by... two or three powers of two for most keys?


Again: the randomart image is based on a hash of the public key. If you want to know what that key is, all you have to do is ask the server. You don't need to launch a sophisticated, expensive cryptographic attack to obtain it.


Good question. I would assume that with the visualization being defined by the public-key of the server, this cannot be use to reverse-engineer the private key. Also, the linked paper (I just read the summary) does try to attempt this and partially succeeds and talks more about the implication.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: