Why does Openssh use only SHA1 for signing and verifying of digital signatures?

I am learning SSH protocol. With my current understanding of SSH protocol, I think that message digest algorithms for using in digital signature should be derived from Key Exchange. But Openssh implementation uses only SHA1 for signing and verifying of digital signatures. SHA1 is hard coded in these two functions, ssh_dss_sign() and ssh_dss_verify().

I am wondering, does all the implementations of use SHA1 as hash algorithm for signing and verifying digital signatures. And why don't we use SHA-256 as it's better than SHA1?

Is there any specific reason for doing so..? If yes, could someone please provide some references.

• I suppose that most of the SSH protocol is older than SHA-2, and nobody bothered to add new key exchange algorithms with SHA-2 to it. – Paŭlo Ebermann Mar 17 '14 at 21:56
• There is a MAC algorithm spec for SHA-2 in RFC 6668. – Paŭlo Ebermann Mar 17 '14 at 21:59
• Actually, the list of registered key exchange method names contains some with SHA-256. – Paŭlo Ebermann Mar 17 '14 at 22:06
• @PaŭloEbermann : OpenSSH already supports diffie-hellman-group-exhchage-sha256. So I expected it to use SHA256 in digital signatures. – Rakesh Gupta Mar 18 '14 at 7:08
• I don't know SSH well, but I'd bet that Paŭlo Ebermann's first comment is right. Notice that it also uses SHA-1 for RSA, but it uses SHA-2 for ECDSA, with a comment pointing to the RFC that mandates it. (See ssh_ecdsa_sign in ssh-ecdsa.c and key_ec_nid_to_hash_alg in key.c.) – Matt Nordhoff Mar 19 '14 at 3:54

Because the RFC says so.

Signing and verifying using this key format is done according to the Digital Signature Standard [FIPS-186-2] using the SHA-1 hash [FIPS-180-2].

It says the same for RSA half a page down.

Apparently the signature algorithm is a defined part of the public key method's specification, rather than being negotiated separately like the MAC algorithm is.

At a guess, SHA-1 was considered good enough at the time SSH 2 was being written almost a decade ago (the RFCs were published in 2006), and no one wants to bother changing it now.

Notice that ECDSA keys, published in RFC 5656 in 2009, use SHA-2:

Signing and verifying is done using the Elliptic Curve Digital
Signature Algorithm (ECDSA). ECDSA is specified in [SEC1]. The
message hashing algorithm MUST be from the SHA2 family of hash
functions [FIPS-180-3] and is chosen according to the curve size as
specified in Section 6.2.1.

You can see it in action in ssh_ecdsa_sign() in ssh-ecdsa.c and key_ec_nid_to_hash_alg() in key.c.

(I'm not an expert on SSH, so please take this answer with a grain of salt.)

• Thanks a lot. This is what I wanted to know. It was really very helpful. – Rakesh Gupta Mar 19 '14 at 6:54

The latest version of openssh supports sha256/512 for digital signature. OpenSSH 7.2 have support for sha256/512withRSA as signature algorithm. Please refer https://www.openssh.com/txt/release-7.2

• We shouldn't have to follow the link to get further details. Maybe also providing a quote from the reference would be a nice addition to your answer. – Biv Nov 4 '16 at 12:36

Even though the ciphers have -sha1, these are actually HMAC which are keyed hashing. HMAC-SHA1 is fine and accepted even in FIPS, even though SHA-1 is no longer accepted in FIPS.

• SSH doesn't have ciphers as such, it has encryption algorithms none of which involve any sha1 or even sha and separate MAC algorithms and those which use HMAC say so explicitly. But this Q is about signature aka authentication algorithms and none of them ever involve HMAC. You may be confusing SSH with SSL-now-TlS where the ciphersuite, sometimes abbreviated cipher, combines KX/auth, encryption, and MAC in a single string and trailing _SHA _SHA256 _SHA384 (but not _SHA1) is used for HMAC except AEAD ciphers, and in 1.2 PRF, but NOT signature hash. – dave_thompson_085 Sep 21 '16 at 8:14