When you initiate a connection to an OpenSSH server, the server presents you with its public key, which is hashed with MD5, and the result displayed. You _shoul

When you initiate a connection to an OpenSSH server, the server presents you with its public key, which is hashed with MD5, and the result displayed. You _should_ verify this with the server administrator that the fingerprints matched, and you are indeed connected to the server you intended, rather than a hijacked connection. MD5 is resistant to 2nd preimage attacks, however. So technically, OpenSSH is fine using MD5 to display the fingerprint to you. With that said, I also don't see the problem moving to a stronger algorithm.