3 ms·

Doh, of course. Think-o on my part. Thanks. So in what sense is "ssh-rsa" going to be removed? Just as a protocol enum, with no user-visible impact for these p

• tialaramex 6y ago
  Both future clients and servers will refuse to do this algorithm, so it becomes user visible if your clients are not new enough to know anything acceptable to your servers or vice versa. The ssh-rsa algorithm is one of two authentication algorithms described in the first SecSH (IETF standardised SSH version 2) documents in 2006. The other (ssh-dsa) was never very popular and has been untrustworthy for a long time. So up until this point even a very old client or server could expect to interoperate with the latest software using ssh-rsa. Of course an individual setup might forbid this, but in general it could work. The announced change in OpenSSH means it will be necessary to give up on very old systems because they're incompatible, or else use a shim to restore compatibility if that's essential for you. This previously happened with SSH version 1 - once upon a time OpenSSH could interoperate with SSHv1, then it required a config override to allow that, and then they removed the compatibility from their source code entirely, but SSHv1 pre-dates the widespread modern popularity of SSH, so it probably had less impact than this will.