openssh unix dev - Aug 2003 - Re-using RSA1 keys as RSA

Is there a security issue with turning an RSA1 key into an RSA key?  One
might want to do this, e.g., to move to protocol 2 without having to
update authorized_keys files.

I thought there was a problem with this, but Google doesn't find anything.

thanks
/fc

Frank Cusack wrote:
>Is there a security issue with turning an RSA1 key into an RSA key?  One
>might want to do this, e.g., to move to protocol 2 without having to
>update authorized_keys files.
>
>I thought there was a problem with this, but Google doesn't find
anything.
>
>thanks
>/fc
>
>_______________________________________________
>openssh-unix-dev mailing list
>openssh-unix-dev at mindrot.org
>http://www.mindrot.org/mailman/listinfo/openssh-unix-dev
>
It's been a while since I went over this, but I believe the reason you 
can't do this is:

SSHv1 uses RSA keys for encryption -- I send you data encrypted with 
your pubkey, you send it back to me decrypted.
SSHv2 uses RSA keys for verification -- I send you data, you send it 
back to me signed, I test to see if the data was signed correctly.

There are potential attacks involving the use of one mode against the 
other.  They're not as simple as what I once thought they were; i.e. the 
private key for decrypting is the public key for verifying -- but I 
think it was a problem nonetheless.

That being said, there really needs to be a mode to check all known host 
key types for one that matches.  This is a _real_ security requirement, 
people!  If we checked the SSHv1 key before accepting a new SSHv2 key, 
we'd be _alot_ better off for the migrators.

--Dan

On Thu, Aug 21, 2003 at 09:10:13PM -0700, Frank Cusack
wrote:
> Is there a security issue with turning an RSA1 key into an RSA key?  One
> might want to do this, e.g., to move to protocol 2 without having to
> update authorized_keys files.
in protocol 1 rsa keys are used for encryption,
in protocol 2 they are used for signatures.