Trust on first use (TOFU) accepts a key during the first connection, then treats later changes as suspicious unless someone explicitly overrides the warning. The first exchange may be vulnerable to an active man-in-the-middle attacker, but later verification can expose impersonation. section 10.4 section 10.4.1
A TOFU interaction typically follows these steps:
- Accept or record the public key shown during the initial connection. section 10.4.1
- Reject or flag a subsequent connection when its public key differs. section 10.4.1
- Compare fingerprints or safety numbers through a separate channel, such as a QR-code exchange. section 10.4.1
SSH and Signal
An SSH client can trust a server’s public key on the first connection and block later connections when that key changes. Signal lets users compare safety numbers, more easily through QR codes, to verify the connection after initial trust. section 10.4.1
Figure 10.7 Trust on first use (TOFU) allows Alice to trust her first connection but not subsequent connections if they don’t exhibit the same public key. TOFU is an easy mechanism to build trust when the chances that the first connection is actively MITM’d are low. The association between a public key and the identity (here Bob) can also be verified after the fact in a different channel.
The diagram contrasts the trusted first connection with rejected later keys and shows how identity can be checked afterward through another channel. section 10.4.1
