Got $50k spare? Then you can crack SHA-1 – so OpenSSH is deprecating flawed hashing algo in a 'near-future release'

The price will only go down

Updated The maintainers of OpenSSH, the widely used toolkit for connecting securely to servers and devices over networks, have warned that the SHA-1 algorithm will be disabled in a "near-future release".

SHA stands for Secure Hash Algorithm. The SHA-1 implementation has been known to be vulnerable since 2005 though still requiring reassuringly non-trivial amounts of computation to break. More powerful attacks have been developed since, and compute resources have become cheaper, so the vulnerability gradually increases.

The OpenSSH decision references a recent paper [PDF] by Gaëtan Leurent and Thomas Peyrin, titled "SHA-1 is a Shambles," showing that a "chosen-prefix collision" can be achieved for $45,000 – more than a casual amount, but "within the means of academic researchers."

A chosen-prefix collision means it's possible to modify data – be it a file or information in transit – in such a way that both the previous and tampered versions have the same SHA-1 hash value. Thus, security checks relying on verifying data integrity from SHA-1 hashes can be fooled.

"It is now possible to perform chosen-prefix attacks against the SHA-1 algorithm for less than USD$50K. For this reason, we will be disabling the 'ssh-rsa' public key signature algorithm by default in a near-future release," said OpenSSH maintainer Damien Miller in the release notes for OpenSSH 8.3, echoing similar comments from the 8.2 release notes back in February.

Someone upset about a hashtag

Hash snag: Security shamans shame SHA-1 standard, confirm crucial collisions citing circa $45k chip cost


The OpenSSH team suggest users and administrators use alternative, more secure hashing algorithms including SHA-2 (supported since OpenSSH 7.2 four years ago) or the even older ssh-ed25519 or ECDSA (Elliptic Curve Digital Signature Algorithm) as proposed in 2009. Another suggestion is to use the UpdateHostKeys setting in OpenSSH clients, which automatically updates the client's knowledge of the keys identifying the server and the algorithm used, as explained by Miller here in 2015.

These statements have caused some confusion concerning matters such as whether keys will have to be regenerated, and what will happen with hardware tokens or network devices with out-of-date firmware. It is important to distinguish between keys and hash algorithms.

"OpenSSH's advisory was worded very confusingly, but the way it works is that ssh-rsa *keys* can be used with both the ssh-rsa *algorithm* and the rsa-sha2-256 *algorithm*. If both sides support the latter then there is no SHA-1 in use," said security consultant Hector Martin on Twitter.

Removal of SHA-1 support in OpenSSH will still be significant. "This algorithm is unfortunately still used widely despite the existence of better alternatives," said Miller, and it seems that actually removing support is the only way to prevent its use.

Essentially, if a device or client can support something better than SHA-1 that's also supported by OpenSSH, all will be well; if it's hardwired to SHA-1, action is needed to connect to an OpenSSH server that no longer supports the algorithm.

Alan Woodward, professor of cybersecurity at the University of Surrey in England, told The Register that "SHA-1 is no longer secure but actually it is still fairly difficult to crack," which is true, but equally the fact that it has been known to be flawed for over a decade and remains in wide use shows how slow the industry is to move.

The cost of cracking SHA-1 will continue to fall, so now is the time to stop using it. ®

Updated to add

We asked Miller for clarification of the impact of removing SHA-1 support.

“A ssh-rsa key does not need to be regenerated to be useful with the updated signature algorithms," he told us. "Specifically, an existing ssh-rsa key is perfectly usable with the rsa-sha2-256 or rsa-sha2-512 algorithms.”

What about old devices that use SHA-1? “We're talking about changing the default set of enabled algorithms and not removing ssh-rsa support entirely (at least not yet). So no devices will be completely unusable, at worst they will require an extra command-line argument or a couple of lines of configuration. There are some examples of this at

"Devices that do not support the RFC8332 RSA/SHA-2 signature methods, and do not support any of the other, more modern key types, will need that extra step. Otherwise ssh will refuse to connect. These more-modern key types that I mentioned include the ECDSA keys defined in RFC5656 that was published over ten years ago. If users' devices are newer than this then I think it's quite legitimate for them to ask their vendors why they weren't shipping modern cryptography in their products.”

Similar topics

Broader topics

Other stories you might like

  • D-Wave deploys first US-based Advantage quantum system
    For those that want to keep their data in the homeland

    Quantum computing outfit D-Wave Systems has announced availability of an Advantage quantum computer accessible via the cloud but physically located in the US, a key move for selling quantum services to American customers.

    D-Wave reported that the newly deployed system is the first of its Advantage line of quantum computers available via its Leap quantum cloud service that is physically located in the US, rather than operating out of D-Wave’s facilities in British Columbia.

    The new system is based at the University of Southern California, as part of the USC-Lockheed Martin Quantum Computing Center hosted at USC’s Information Sciences Institute, a factor that may encourage US organizations interested in evaluating quantum computing that are likely to want the assurance of accessing facilities based in the same country.

    Continue reading
  • Bosses using AI to hire candidates risk discriminating against disabled applicants
    US publishes technical guide to help organizations avoid violating Americans with Disabilities Act

    The Biden administration and Department of Justice have warned employers using AI software for recruitment purposes to take extra steps to support disabled job applicants or they risk violating the Americans with Disabilities Act (ADA).

    Under the ADA, employers must provide adequate accommodations to all qualified disabled job seekers so they can fairly take part in the application process. But the increasing rollout of machine learning algorithms by companies in their hiring processes opens new possibilities that can disadvantage candidates with disabilities. 

    The Equal Employment Opportunity Commission (EEOC) and the DoJ published a new document this week, providing technical guidance to ensure companies don't violate ADA when using AI technology for recruitment purposes.

    Continue reading
  • How ICE became a $2.8b domestic surveillance agency
    Your US tax dollars at work

    The US Immigration and Customs Enforcement (ICE) agency has spent about $2.8 billion over the past 14 years on a massive surveillance "dragnet" that uses big data and facial-recognition technology to secretly spy on most Americans, according to a report from Georgetown Law's Center on Privacy and Technology.

    The research took two years and included "hundreds" of Freedom of Information Act requests, along with reviews of ICE's contracting and procurement records. It details how ICE surveillance spending jumped from about $71 million annually in 2008 to about $388 million per year as of 2021. The network it has purchased with this $2.8 billion means that "ICE now operates as a domestic surveillance agency" and its methods cross "legal and ethical lines," the report concludes.

    ICE did not respond to The Register's request for comment.

    Continue reading
  • Fully automated AI networks less than 5 years away, reckons Juniper CEO
    You robot kids, get off my LAN

    AI will completely automate the network within five years, Juniper CEO Rami Rahim boasted during the company’s Global Summit this week.

    “I truly believe that just as there is this need today for a self-driving automobile, the future is around a self-driving network where humans literally have to do nothing,” he said. “It's probably weird for people to hear the CEO of a networking company say that… but that's exactly what we should be wishing for.”

    Rahim believes AI-driven automation is the latest phase in computer networking’s evolution, which began with the rise of TCP/IP and the internet, was accelerated by faster and more efficient silicon, and then made manageable by advances in software.

    Continue reading
  • Pictured: Sagittarius A*, the supermassive black hole at the center of the Milky Way
    We speak to scientists involved in historic first snap – and no, this isn't the M87*

    Astronomers have captured a clear image of the gigantic supermassive black hole at the center of our galaxy for the first time.

    Sagittarius A*, or Sgr A* for short, is 27,000 light-years from Earth. Scientists knew for a while there was a mysterious object in the constellation of Sagittarius emitting strong radio waves, though it wasn't really discovered until the 1970s. Although astronomers managed to characterize some of the object's properties, experts weren't quite sure what exactly they were looking at.

    Years later, in 2020, the Nobel Prize in physics was awarded to a pair of scientists, who mathematically proved the object must be a supermassive black hole. Now, their work has been experimentally verified in the form of the first-ever snap of Sgr A*, captured by more than 300 researchers working across 80 institutions in the Event Horizon Telescope Collaboration. 

    Continue reading
  • Shopping for malware: $260 gets you a password stealer. $90 for a crypto-miner...
    We take a look at low, low subscription prices – not that we want to give anyone any ideas

    A Tor-hidden website dubbed the Eternity Project is offering a toolkit of malware, including ransomware, worms, and – coming soon – distributed denial-of-service programs, at low prices.

    According to researchers at cyber-intelligence outfit Cyble, the Eternity site's operators also have a channel on Telegram, where they provide videos detailing features and functions of the Windows malware. Once bought, it's up to the buyer how victims' computers are infected; we'll leave that to your imagination.

    The Telegram channel has about 500 subscribers, Team Cyble documented this week. Once someone decides to purchase of one or more of Eternity's malware components, they have the option to customize the final binary executable for whatever crimes they want to commit.

    Continue reading
  • Ukrainian crook jailed in US for selling thousands of stolen login credentials
    Touting info on 6,700 compromised systems will get you four years behind bars

    A Ukrainian man has been sentenced to four years in a US federal prison for selling on a dark-web marketplace stolen login credentials for more than 6,700 compromised servers.

    Glib Oleksandr Ivanov-Tolpintsev, 28, was arrested by Polish authorities in Korczowa, Poland, on October 3, 2020, and extradited to America. He pleaded guilty on February 22, and was sentenced on Thursday in a Florida federal district court. The court also ordered Ivanov-Tolpintsev, of Chernivtsi, Ukraine, to forfeit his ill-gotten gains of $82,648 from the credential theft scheme.

    The prosecution's documents [PDF] detail an unnamed, dark-web marketplace on which usernames and passwords along with personal data, including more than 330,000 dates of birth and social security numbers belonging to US residents, were bought and sold illegally.

    Continue reading
  • Another ex-eBay exec admits cyberstalking web souk critics
    David Harville is seventh to cop to harassment campaign

    David Harville, eBay's former director of global resiliency, pleaded guilty this week to five felony counts of participating in a plan to harass and intimidate journalists who were critical of the online auction business.

    Harville is the last of seven former eBay employees/contractors charged by the US Justice Department to have admitted participating in a 2019 cyberstalking campaign to silence Ina and David Steiner, who publish the web newsletter and website EcommerceBytes.

    Former eBay employees/contractors Philip Cooke, Brian Gilbert, Stephanie Popp, Veronica Zea, and Stephanie Stockwell previously pleaded guilty. Cooke last July was sentenced to 18 months behind bars. Gilbert, Popp, Zea and Stockwell are currently awaiting sentencing.

    Continue reading

Biting the hand that feeds IT © 1998–2022