Visualizing SSH fingerprints

A recent OpenBSD hackathon development: Alexander von Gernler (grunk@) just committed code so that we can visualize SSH fingerprints. What does that mean? Usually, when you use SSH to connect to a new host for the first time, SSH will prompt you to confirm the RSA key. For example:

$ export CVSROOT=anoncvs@anoncvs2.usa.openbsd.org:/cvs
$ cvs co ports
The authenticity of host 'anoncvs2.usa.openbsd.org (141.211.133.9)' can't be established.
RSA key fingerprint is b9:4c:29:97:d1:cd:8f:6c:97:06:48:b8:d8:e9:b9:a3.
Are you sure you want to continue connecting (yes/no)?

So you're supposed to just know that b9:4c:29:97:d1:cd:8f:6c:97:06:48:b8:d8:e9:b9:a3 is the correct fingerprint for the RSA key belonging to anoncvs@anoncvs2.usa.openbsd.org. Of course mere mortals like us would have difficulty remembering even one string of hex numbers like that, not to mention those for a dozen different servers.

Alexander's new code allows you to visualize that fingerprint in plain ol' ASCII form. In theory the human brain can recognize graphical patterns better than a string of hex numbers. So, just for fun, I grabbed the latest snapshot Of OpenBSD-current to check out the visual representation of two OpenBSD CVS hosts:

$ dmesg | head -2
OpenBSD 4.3-current (GENERIC) #930: Sat Jun 14 06:27:59 MDT 2008
    deraadt@i386.openbsd.org:/usr/src/sys/arch/i386/compile/GENERIC
$ export CVSROOT=anoncvs@anoncvs.usa.openbsd.org:/cvs
$ cvs co ports
The authenticity of host 'anoncvs.usa.openbsd.org (204.152.184.203)' can't be established.
RSA key fingerprint is 49:67:9a:46:62:8a:3f:4e:b3:63:ca:d6:41:29:2a:2f.
+--[ RSA]---------+
|                 |
|                 |
|     .o o o      |
|  ..oo + *       |
| ..o.   S        |
|o  ..  .         |
|.. .=.           |
|E.oo++           |
| oooo.           |
+-----------------+
Are you sure you want to continue connecting (yes/no)?

What is that? An owl with bruised eyes? An uneven flight of stairs? :)

$ export CVSROOT=anoncvs@anoncvs2.usa.openbsd.org:/cvs
$ cvs co ports                                        
The authenticity of host 'anoncvs2.usa.openbsd.org (141.211.133.9)' can't be established.
RSA key fingerprint is b9:4c:29:97:d1:cd:8f:6c:97:06:48:b8:d8:e9:b9:a3.
+--[ RSA]---------+
|         ..      |
|        .o +     |
|       o.oo +    |
|      . += . + . |
|      ..S.  + =  |
|       =o. . o   |
|        o.       |
|        o        |
|      E. .       |
+-----------------+
Are you sure you want to continue connecting (yes/no)?

How about this? A tree of some sort? A tent with a trail leading to its entrance? :)

For more details (and some funny comments) about this new visualization technique, check out Alexander's blog post on Undeadly.org.