Details
-
Improvement
-
Status: Resolved
-
Major
-
Resolution: Fixed
-
None
-
None
Description
In the recently released OpenSSH 8.8 for RSA keys the public key signature algorithm that depends on SHA-1 has been disabled by default:
This release disables RSA signatures using the SHA-1 hash algorithm 2by default. This change has been made as the SHA-1 hash algorithm is cryptographically broken, and it is possible to create chosen-prefix 4hash collisions for <USD$50K [1]
As a result OpenSSH 8.8 clients are unable to authenticate with Mina SSHD servers with RSA based keys (it is however possible to reenable ssh-rsa). OpenSSH since 7.2 does however support RFC 8332 RSA/SHA-256/512 signatures, indeed the release notes go on to say:
For most users, this change should be invisible and there is no need to replace ssh-rsa keys. OpenSSH has supported RFC8332 RSA/SHA-256/512 signatures since release 7.2 and existing ssh-rsa keys will automatically use the stronger algorithm where possible.
It appears Mina SSHD partly implements support for RFC 8332, indeed the client code appears to support it (see SSHD-1141). However the server appears to lack full support because it doesn't full implement the"server-sig-algs" extension.
The basic framework for supporting this seems to be present, specifically AbstractKexFactoryManager.setKexExtensionHandler() could perhaps permit such a "server-sig-algs" extension.
