# Why does Openssh use only SHA1 for signing and verifying of digital signatures?

I am learning SSH protocol. With my current understanding of SSH protocol, I think that message digest algorithms for using in digital signature should be derived from Key Exchange. But Openssh implementation uses only SHA1 for signing and verifying of digital signatures. SHA1 is hard coded in these two functions, ssh_dss_sign() and ssh_dss_verify().

I am wondering, does all the implementations of use SHA1 as hash algorithm for signing and verifying digital signatures. And why don't we use SHA-256 as it's better than SHA1?

Is there any specific reason for doing so..? If yes, could someone please provide some references.

-
I suppose that most of the SSH protocol is older than SHA-2, and nobody bothered to add new key exchange algorithms with SHA-2 to it. –  Paŭlo Ebermann Mar 17 at 21:56
There is a MAC algorithm spec for SHA-2 in RFC 6668. –  Paŭlo Ebermann Mar 17 at 21:59
Actually, the list of registered key exchange method names contains some with SHA-256. –  Paŭlo Ebermann Mar 17 at 22:06
@PaŭloEbermann : OpenSSH already supports diffie-hellman-group-exhchage-sha256. So I expected it to use SHA256 in digital signatures. –  Rakesh Gupta Mar 18 at 7:08
I don't know SSH well, but I'd bet that Paŭlo Ebermann's first comment is right. Notice that it also uses SHA-1 for RSA, but it uses SHA-2 for ECDSA, with a comment pointing to the RFC that mandates it. (See ssh_ecdsa_sign in ssh-ecdsa.c and key_ec_nid_to_hash_alg in key.c.) –  Matt Nordhoff Mar 19 at 3:54

Because the RFC says so.

Signing and verifying using this key format is done according to the Digital Signature Standard [FIPS-186-2] using the SHA-1 hash [FIPS-180-2].

It says the same for RSA half a page down.

Apparently the signature algorithm is a defined part of the public key method's specification, rather than being negotiated separately like the MAC algorithm is.

At a guess, SHA-1 was considered good enough at the time SSH 2 was being written almost a decade ago (the RFCs were published in 2006), and no one wants to bother changing it now.

Notice that ECDSA keys, published in RFC 5656 in 2009, use SHA-2:

Signing and verifying is done using the Elliptic Curve Digital
Signature Algorithm (ECDSA). ECDSA is specified in [SEC1]. The
message hashing algorithm MUST be from the SHA2 family of hash
functions [FIPS-180-3] and is chosen according to the curve size as
specified in Section 6.2.1.

You can see it in action in ssh_ecdsa_sign() in ssh-ecdsa.c and key_ec_nid_to_hash_alg() in key.c.

(I'm not an expert on SSH, so please take this answer with a grain of salt.)

-
Thanks a lot. This is what I wanted to know. It was really very helpful. –  Rakesh Gupta Mar 19 at 6:54