4 ms·

You are conflating RSA (the algorithm) with "ssh-rsa" (the option of the SSH suite indicating authentication with RSA in combination with SHA-1). They deprecate

You are conflating RSA (the algorithm) with "ssh-rsa" (the option of the SSH suite indicating authentication with RSA in combination with SHA-1). They deprecate the latter. Other options also based on RSA such as "rsa-sha2-256/512" are fine and will remain supported. In other words, the security problem is not with RSA per se. Having said that, I have not checked whether the people you list have RSA keys bound to SHA-1...

deleted 7y ago
[deleted]
mkj 7y ago
The keys themselves are not bound to sha1 or sha256. The hash is just used for the ephemeral signatures during authentication (or certificates as mentioned in the release notes). "ssh-rsa" signature scheme at runtime (sha1) will be deprecated, but rsa keys themselves are fine (edit typo name)
- tialaramex 7y ago
  Indeed, and so to actually use this $50k attack on SSH you'd need to somehow arrange for your target to pick random numbers you expected so that your attack works. But for clarity, OpenSSH isn't saying this can be used against SSH today - the deprecation is because we should abandon broken hashes before they actually cause us harm, not wait until after. Don't Walk Past.
  - RL_Quine 7y ago
    People are still obviously using 1024 bit RSA keys which are more of a problem.
- xorcist 7y ago
  Right. Most SSH keys are just keys, not hashes. The hash used for key exchange during authentication is something that is enforced by the server (and client) and not a property of the key. The option in ssh-keygen for a signature algorithm is for signing keys in an SSH CA. This is not something Github supports.
  - pilif 7y ago
    > This is not something Github supports. actually, they do now[1], but only for enterprise accounts. Which is a shame - this is useful for "normal people" too. 1: https://help.github.com/en/github/setting-up-and-managing-organizations-and-teams/about-ssh-certificate-authorities https://help.github.com/en/github/setting-up-and-managing-or...
noodlesUK 7y ago
With this in mind, can gpg-agent be configured to use a better hash function with its RSA keys for use in SSH?

deleted 7y ago

[deleted]

mkj 7y ago

The keys themselves are not bound to sha1 or sha256. The hash is just used for the ephemeral signatures during authentication (or certificates as mentioned in the release notes). "ssh-rsa" signature scheme at runtime (sha1) will be deprecated, but rsa keys themselves are fine (edit typo name)

tialaramex 7y ago
Indeed, and so to actually use this $50k attack on SSH you'd need to somehow arrange for your target to pick random numbers you expected so that your attack works. But for clarity, OpenSSH isn't saying this can be used against SSH today - the deprecation is because we should abandon broken hashes before they actually cause us harm, not wait until after. Don't Walk Past.
- RL_Quine 7y ago
  People are still obviously using 1024 bit RSA keys which are more of a problem.
xorcist 7y ago
Right. Most SSH keys are just keys, not hashes. The hash used for key exchange during authentication is something that is enforced by the server (and client) and not a property of the key. The option in ssh-keygen for a signature algorithm is for signing keys in an SSH CA. This is not something Github supports.
- pilif 7y ago
  > This is not something Github supports. actually, they do now[1], but only for enterprise accounts. Which is a shame - this is useful for "normal people" too. 1: https://help.github.com/en/github/setting-up-and-managing-organizations-and-teams/about-ssh-certificate-authorities https://help.github.com/en/github/setting-up-and-managing-or...

noodlesUK 7y ago

With this in mind, can gpg-agent be configured to use a better hash function with its RSA keys for use in SSH?