Deprecate use of ssh-rsa keys?
Closed, DuplicatePublicSecurity
Actions

Assigned To

Authored By

	Reedy
	Jun 26 2022, 9:05 PM

Description

Noticed that I was having issues with an ssh-rsa key...

The RSA SHA-1 hash algorithm is being quickly deprecated across operating systems and SSH clients because of various security vulnerabilities, with many of these technologies now outright denying the use of this algorithm.
It seems this has happened for the ssh client in Ubuntu 22.04. The RSA public-private key pair is considered not safe any more.

I regenerated a new ssh-ed25519 for gerrit (and cloud stuff), and it works.

Pondering if we should more proactively be getting people to update use of old keys across the board

Details

Risk Rating: Medium
Author Affiliation: Wikimedia Deutschland

Related Objects

Mentioned Here: T253824: planned upstream deprecation of the ssh-rsa signing algorithm (RSA with SHA-1)

Event Timeline

Reedy created this task.Jun 26 2022, 9:05 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJun 26 2022, 9:05 PM

A quick look in the puppet repo in modules/admin/data/data.yaml shows 158 matches for ssh-rsa.

The ssh-rsa key exchange is deprecated, because it uses SHA-1. ssh-rsa keys are fine as long as they use a different key exchange algorithm, such as rsa-sha2-256 from RFC 8332, supported since OpenSSH 7.2. Also, I don’t think if YubiKeys support non-RSA keys; at least, I believe that’s why my own key is an RSA key.