up vote 46 down vote favorite
9
share [g+] share [fb]

When you generate a key, you get "randomart" from newer versions of OpenSSH. I am unable to find an explanation of why, and what I'm supposed to use it for.

Generating public/private rsa key pair.
The key fingerprint is:
05:1e:1e:c1:ac:b9:d1:1c:6a:60:ce:0f:77:6c:78:47 you@i
The key's randomart image is:
+--[ RSA 2048]----+
|       o=.       |
|    o  o++E      |
|   + . Ooo.      |
|    + O B..      |
|     = *S.       |
|      o          |
|                 |
|                 |
|                 |
+-----------------+

Generating public/private dsa key pair.
The key fingerprint is:
b6:dd:b7:1f:bc:25:31:d3:12:f4:92:1c:0b:93:5f:4b you@i
The key's randomart image is:
+--[ DSA 1024]----+
|            o.o  |
|            .= E.|
|             .B.o|
|              .= |
|        S     = .|
|       . o .  .= |
|        . . . oo.|
|             . o+|
|              .o.|
+-----------------+
link|improve this question
76% accept rate
feedback

3 Answers

up vote 34 down vote accepted

The randomart is meant to be an easier way for humans to validate keys.

Validation is normally done by a comparison of meaningless strings (i.e. the hexadecimal representation of the key fingerprint), which humans are pretty slow and inaccurate at comparing. Randomart replaces this with structured images that are faster and easier to compare.

This paper "Hash Visualization: a New Technique to improve Real-World Security", Perrig A. and Song D., 1999, International Workshop on Cryptographic Techniques and E-Commerce (CrypTEC '99)" explains some techniques and advantages.

link|improve this answer
2  
If you could just explain why humans validate keys, that could help, because frankly I tend to just put my public key in my authorized_keys file and be done with it. – dlamblin Sep 6 '09 at 5:10
9  
@dlamblin: You generally would not verify your own keys with this. It would, however, be useful for verifying the host key of a remote machine. One idea is that if you login to a particular machine from various locations (or you do not save its key into your known_hosts file), you will be able to recognize the “art” of the host's key. If that art suddenly changed you should be wary of typing in your password because it might mean that a man-in-the-middle attack is in progress on your connection (or it might mean that the host has just changed its keys for some other reason). – Chris Johnsen Oct 27 '09 at 5:43
Uhm, When could I see the hosts art? (I think I never did.) I only saw such an image after generating my key pair. And to what would I have to compare it to recognize 'sudden' change. – DerMike Feb 9 '11 at 10:15
I'd wager the randomart adheres to a similar principle as hashes for integrity checks, namely: a small difference in the input generates a wildly different output. That would mean you would just have to memorize the rough shape of the expected randomart to be able to notice something is amiss. Of course this doesn't work in practice when SSH et al don't show you the randomart of the host you're connecting to (they should do so even when the host is known). – Alan Feb 25 '11 at 16:22
feedback
up vote 10 down vote

Official announcement: OpenSSH 5.1 released

Introduce experimental SSH Fingerprint ASCII Visualisation to ssh(1) and ssh-keygen(1). Visual fingerprinnt display is controlled by a new ssh_config(5) option "VisualHostKey". The intent is to render SSH host keys in a visual form that is amenable to easy recall and rejection of changed host keys. This technique inspired by the graphical hash visualisation schemes known as "random art[*]", and by Dan Kaminsky's musings at 23C3 in Berlin.

Fingerprint visualisation in is currently disabled by default, as the algorithm used to generate the random art is still subject to change.

link|improve this answer
feedback
up vote 4 down vote

Add 

-o VisualHostKey=yes

to your command line, or put 

VisualHostKey=yes

in your ~/.ssh/config.

You'll see the randomart of the box you are logging onto. If you log on one day and the random art is different (your brain should go Hey! I don't recognise that!), then maybe someone is hacking, or something.

The idea is that you don't consciously need to do it. One of the keys for one of our machines kinda looks like a butterfly. Another one kinda looks like a dick (yes, our brains are primitive). If you log on every day, you get accustomed to the images without even trying.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown

Not the answer you're looking for? Browse other questions tagged or ask your own question.