Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am learning SSH protocol. With my current understanding of SSH protocol, I think that message digest algorithms for using in digital signature should be derived from Key Exchange. But Openssh implementation uses only SHA1 for signing and verifying of digital signatures. SHA1 is hard coded in these two functions, ssh_dss_sign() and ssh_dss_verify().

I am wondering, does all the implementations of use SHA1 as hash algorithm for signing and verifying digital signatures. And why don't we use SHA-256 as it's better than SHA1?

Is there any specific reason for doing so..? If yes, could someone please provide some references.

Thanks in advance.

share|improve this question
I suppose that most of the SSH protocol is older than SHA-2, and nobody bothered to add new key exchange algorithms with SHA-2 to it. – Paŭlo Ebermann Mar 17 '14 at 21:56
There is a MAC algorithm spec for SHA-2 in RFC 6668. – Paŭlo Ebermann Mar 17 '14 at 21:59
Actually, the list of registered key exchange method names contains some with SHA-256. – Paŭlo Ebermann Mar 17 '14 at 22:06
@PaŭloEbermann : OpenSSH already supports diffie-hellman-group-exhchage-sha256. So I expected it to use SHA256 in digital signatures. – Rakesh Gupta Mar 18 '14 at 7:08
I don't know SSH well, but I'd bet that Paŭlo Ebermann's first comment is right. Notice that it also uses SHA-1 for RSA, but it uses SHA-2 for ECDSA, with a comment pointing to the RFC that mandates it. (See ssh_ecdsa_sign in ssh-ecdsa.c and key_ec_nid_to_hash_alg in key.c.) – Matt Nordhoff Mar 19 '14 at 3:54
up vote 8 down vote accepted

Because the RFC says so.

Signing and verifying using this key format is done according to the Digital Signature Standard [FIPS-186-2] using the SHA-1 hash [FIPS-180-2].

It says the same for RSA half a page down.

Apparently the signature algorithm is a defined part of the public key method's specification, rather than being negotiated separately like the MAC algorithm is.

At a guess, SHA-1 was considered good enough at the time SSH 2 was being written almost a decade ago (the RFCs were published in 2006), and no one wants to bother changing it now.

Notice that ECDSA keys, published in RFC 5656 in 2009, use SHA-2:

Signing and verifying is done using the Elliptic Curve Digital
Signature Algorithm (ECDSA). ECDSA is specified in [SEC1]. The
message hashing algorithm MUST be from the SHA2 family of hash
functions [FIPS-180-3] and is chosen according to the curve size as
specified in Section 6.2.1.

You can see it in action in ssh_ecdsa_sign() in ssh-ecdsa.c and key_ec_nid_to_hash_alg() in key.c.

(I'm not an expert on SSH, so please take this answer with a grain of salt.)

share|improve this answer
Thanks a lot. This is what I wanted to know. It was really very helpful. – Rakesh Gupta Mar 19 '14 at 6:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.