SSHFPRecordValidator

SSHFP (SSH Fingerprint) record validator

Validates SSHFP records according to:

• RFC 4255: Using DNS to Securely Publish Secure Shell (SSH) Key Fingerprints
• RFC 6594: Use of the SHA-256 Algorithm with RSA, DSA, and ECDSA in SSHFP Resource Records
• RFC 7479: Using Ed25519 in SSHFP Resource Records
• RFC 8709: Ed25519 and Ed448 Public Key Algorithms for the Secure Shell (SSH) Protocol

SSHFP records store SSH host key fingerprints in DNS, enabling SSH clients to verify host keys without manual verification by the user.

Format:

Example: 4 2 a87f1b687ac0e57d2a081a2f2826723234d90ed316d2b818ca9580ea384d92401

Where:

• algorithm: SSH key algorithm type

  • 1 = RSA
  • 2 = DSA
  • 3 = ECDSA
  • 4 = Ed25519
  • 6 = Ed448

• fp-type: Fingerprint hash algorithm

  • 1 = SHA-1 (Less secure, 40 hex chars)
  • 2 = SHA-256 (Recommended, 64 hex chars)

• fingerprint: Hexadecimal representation of the fingerprint

Security considerations:

• SSHFP records REQUIRE DNSSEC for any security benefit
• Without DNSSEC validation, SSHFP offers no security advantage
• SHA-256 fingerprints (fp-type 2) are strongly preferred over SHA-1
• If both SHA-1 and SHA-256 exist for a host, SSH should prefer SHA-256
• If SHA-256 verification fails, SSH should reject the key rather than fall back to SHA-1