Changes between Version 2 and Version 3 of fingerprint

Timestamp:

07/14/06 13:00:42 (20 years ago)

Author:

dkg@…

Comment:

--

fingerprint

@@ -1 +1 @@
 = Checking fingerprints of public keys =
 
-Most public key infrastructure schemes offer ways to check the "fingerprint" of a key.  a fingerprint is a short, easily transmittable string that is long enough and random enough that it should uniquely identify the key.  Different PKI schemes have different ways of displaying a fingerprint once they have a copy of the key.
+A fingerprint is a short, easily transmittable string that uniquely identifies a key or certificate.  People often verify that they have a valid, untampered copy of a given key by comparing fingerprints with someone who has a known-good copy of the key.
+
+Different PKI schemes have different ways of displaying a fingerprint.  Once you get the fingerprint, you can compare it against 
 
 == X509 ==
 
-X509 certificates can be easily fingerprinted with `openssl`.  for a cert you have downloaded to a file `foo.pem`, you can fingerprint it like this:
+X509 certificates can be easily fingerprinted with `openssl`.  For a cert you have downloaded to a file `foo.pem`, you can fingerprint it like this:
 {{{
 openssl x509 -noout -fingerprint foo.pem
@@ -20 +22 @@
 ssh-keygen -l -f ~/.ssh/id_rsa.pub
 }}}
-
+If you've already visited host `qux.example.com` via ssh, its key is probably stored in your `~/.ssh/known_hosts` file. You can retrieve its fingerprint with the following (note: this will not work if you use the `HashKnownHosts` feature of `openssh`):
+{{{
+ssh-keygen -l -f ~/.ssh/known_hosts | grep qux.example.com
+}}}
 
 == OpenPGP ==