# Which hash function is used for signatures ssh-rsa and ssh-dss?

I'm building a fuse client for ssh/sftp. I write the required ssh and sftp functions myself. Now I read in RFC4253 that before signing the data to sign is default hashed. In RFC4253 8. "Diffie-Hellman Key Exchange" SHA1 is mentioned as the default for ssh-dss. What is it for ssh-rsa?

In section 6 of RFC 4253 it says on page 15:

The "ssh-rsa" key format has the following specific encoding:

  string    "ssh-rsa"
mpint     e
mpint     n


Here the 'e' and 'n' parameters form the signature key blob.

Signing and verifying using this key format is performed according to the RSASSA-PKCS1-v1_5 scheme in [RFC3447] using the SHA-1 hash.

So the answer is "SHA-1" as well.

It is using always SHA-1, unless it does not. There are two new drafts to use SHA-2 functions family:

The usage is negotiated using the protocol extension:

So basically, the other answers are correct for now and the past, but for now and close future, we don't want to use SHA-1 for cryptographic signatures and possibly deprecate SHA-1 in this area. So if you will use any decently recent version of SSH, it will use SHA-2.

• FWIW these were published as RFC 8332 and 8308 in 2018-03 -- although OpenSSH had implemented them since 7.2 in 2016-08. – dave_thompson_085 Nov 22 '19 at 6:10
• @dave_thompson_085 yes, you are right. Thank you for reminder. I will update the answer. – Jakuje Nov 22 '19 at 8:39