May 1 2018

Making art with SSH key randomart

SSH is everywhere in the development or operations world now. For development it’s what allows you to push to GitHub. For operations it’s what allows you to reasonably securely log into Linux servers.

SSH is best used with public/private key pairs, It means that even if a connection is MITM’d and not noticed ( aka, the attacking fingerprint is erroneously accepted ) the server does not get the password to the system, it “only” gets a single connection.

It also prevents malicious bots from attempting to brute force a user account password on a server, assuming you disable password logins on the server.

To start with, you have to generate a key on your local system, this produces two files, a private and a public key. But also some ascii art:

$ time ssh-keygen -f test
Generating public/private rsa key pair.
Your identification has been saved in test.
Your public key has been saved in test.pub.
The key fingerprint is:
SHA256:s6N0OwlTDKjDez98kZRwUGZbTYaQUArv+EYC6sigFwA ben@eshwil
The key's randomart image is:
+---[RSA 2048]----+
|E   ..o=*o.+o    |
|.   .oo+oo...    |
|....  o=..       |
| o+. o  =        |
|o .oo ooS.       |
|* ...+o oo       |
|oo.. o+o+o       |
| .   o+o+o       |
|      .o..       |
+----[SHA256]-----+

real        0m0.058s
user        0m0.053s
sys        0m0.005s

This is part of the validation sequence, the idea is that it is easier to verify a picture than a long string of letters, however it is not helped by the fact that it isn’t enabled by default. Meaning you have to either tweak your SSH client a bit or manually check keys with ssh-keygen

How is ssh randomart generated?

All SSH keys have a fingerprint, the fingerprint is almost always a MD5 or a SHA256 hash of base64 blob of the resulting public key line:

SSH randomart images use the fingerprint hash output, and interpret it as a set of instructions.

It splits the hash output into 2 bits chunks, and uses them as follows:

Or roughly plotted out like so:

This does lead to a slight bias on where lines can go. Below is heatmap of where pixels are most likely to be draw, the corners are rarely reached.

With that in mind though, we can brute force similar keys

Art with RandomArt

The first thing I went for is to generate keys that seemed pretty close to each other, this produces almost a “game of life” feel to it

Or you could try and brute force some letters/symbols!

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILghofIsB5WCW03vqsma6J3dVPHwyYK9KIlkq5dvCn7X

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBl9i2e3BcHiNTdFgaTV8H+n0aTBuZJq8797tqeN/j5T

Anyway, in case you are curious or want to repeat this, the code to do this is here:

https://github.com/benjojo/art-with-randomart

And if you want to read more into how randomart works, I highly recommend this paper for more info: http://www.dirk-loss.de/sshvis/drunken_bishop.pdf

Until next time! ( and if you want to know about next time, follow my Twitter / RSS )