8
$\begingroup$

I am learning SSH protocol. With my current understanding of SSH protocol, I think that message digest algorithms for using in digital signature should be derived from Key Exchange. But Openssh implementation uses only SHA1 for signing and verifying of digital signatures. SHA1 is hard coded in these two functions, ssh_dss_sign() and ssh_dss_verify().

I am wondering, does all the implementations of use SHA1 as hash algorithm for signing and verifying digital signatures. And why don't we use SHA-256 as it's better than SHA1?

Is there any specific reason for doing so..? If yes, could someone please provide some references.

Thanks in advance.

Improve this question
$\endgroup$
5
  • 2
    $\begingroup$ I suppose that most of the SSH protocol is older than SHA-2, and nobody bothered to add new key exchange algorithms with SHA-2 to it. $\endgroup$
    – Paŭlo Ebermann
    Mar 17, 2014 at 21:56
  • 1
    $\begingroup$ There is a MAC algorithm spec for SHA-2 in RFC 6668. $\endgroup$
    – Paŭlo Ebermann
    Mar 17, 2014 at 21:59
  • 1
    $\begingroup$ Actually, the list of registered key exchange method names contains some with SHA-256. $\endgroup$
    – Paŭlo Ebermann
    Mar 17, 2014 at 22:06
  • $\begingroup$ @PaŭloEbermann : OpenSSH already supports diffie-hellman-group-exhchage-sha256. So I expected it to use SHA256 in digital signatures. $\endgroup$
    – Rakesh Gupta
    Mar 18, 2014 at 7:08
  • $\begingroup$ I don't know SSH well, but I'd bet that Paŭlo Ebermann's first comment is right. Notice that it also uses SHA-1 for RSA, but it uses SHA-2 for ECDSA, with a comment pointing to the RFC that mandates it. (See ssh_ecdsa_sign in ssh-ecdsa.c and key_ec_nid_to_hash_alg in key.c.) $\endgroup$
    – Matt Nordhoff
    Mar 19, 2014 at 3:54

3 Answers 3

Reset to default
12
$\begingroup$

Because the RFC says so.

Signing and verifying using this key format is done according to the Digital Signature Standard [FIPS-186-2] using the SHA-1 hash [FIPS-180-2].

It says the same for RSA half a page down.

Apparently the signature algorithm is a defined part of the public key method's specification, rather than being negotiated separately like the MAC algorithm is.

At a guess, SHA-1 was considered good enough at the time SSH 2 was being written almost a decade ago (the RFCs were published in 2006), and no one wants to bother changing it now.

Notice that ECDSA keys, published in RFC 5656 in 2009, use SHA-2:

Signing and verifying is done using the Elliptic Curve Digital
Signature Algorithm (ECDSA). ECDSA is specified in [SEC1]. The
message hashing algorithm MUST be from the SHA2 family of hash
functions [FIPS-180-3] and is chosen according to the curve size as
specified in Section 6.2.1.

You can see it in action in ssh_ecdsa_sign() in ssh-ecdsa.c and key_ec_nid_to_hash_alg() in key.c.

(I'm not an expert on SSH, so please take this answer with a grain of salt.)

Improve this answer
$\endgroup$
1
  • $\begingroup$ Thanks a lot. This is what I wanted to know. It was really very helpful. $\endgroup$
    – Rakesh Gupta
    Mar 19, 2014 at 6:54
2
$\begingroup$

The latest version of openssh supports sha256/512 for digital signature. OpenSSH 7.2 have support for sha256/512withRSA as signature algorithm. Please refer https://www.openssh.com/txt/release-7.2

Improve this answer
$\endgroup$
2
  • 1
    $\begingroup$ We shouldn't have to follow the link to get further details. Maybe also providing a quote from the reference would be a nice addition to your answer. $\endgroup$
    – Biv
    Nov 4, 2016 at 12:36
  • $\begingroup$ But only RSA, not DSA-aka-DSS which was the Question. And which was proposed, as per the draft name quoted in the release notes, but not adopted or implemented. In fact OpenSSH since 7.0 in 2015-08 by default doesn't use DSS=DSA at all, though you can re-enable it; see superuser.com/questions/1016989/… and unix.stackexchange.com/questions/247612/… $\endgroup$
    – dave_thompson_085
    Sep 16, 2020 at 1:12
-1
$\begingroup$

Even though the ciphers have -sha1, these are actually HMAC which are keyed hashing. HMAC-SHA1 is fine and accepted even in FIPS, even though SHA-1 is no longer accepted in FIPS.

Improve this answer
$\endgroup$
1
  • $\begingroup$ SSH doesn't have ciphers as such, it has encryption algorithms none of which involve any sha1 or even sha and separate MAC algorithms and those which use HMAC say so explicitly. But this Q is about signature aka authentication algorithms and none of them ever involve HMAC. You may be confusing SSH with SSL-now-TlS where the ciphersuite, sometimes abbreviated cipher, combines KX/auth, encryption, and MAC in a single string and trailing _SHA _SHA256 _SHA384 (but not _SHA1) is used for HMAC except AEAD ciphers, and in 1.2 PRF, but NOT signature hash. $\endgroup$
    – dave_thompson_085
    Sep 21, 2016 at 8:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.