出于安全原因，OpenSSH 决定弃用 SHA-1 验证算法
OpenSSH SHA-1

> 
> 破坏一个 SHA-1 生成的 SSH 验证密钥，现在的成本大约为 5 万美元，使得重要的远程服务器面临着被攻击的风险。
> 
> 
> 


![OpenSSH SSH](/data/attachment/album/202005/28/175710huryrfkqfzfbufrk.png)


最受欢迎的连接和管理远程服务器的实用工具 OpenSSH 今天宣布，计划放弃对其 SHA-1 验证方案的支持。在这个宣布当中，OpenSSH 团队列举了 SHA-1 散列算法的安全问题，该算法目前被认为是不安全的。


SHA-1 算法在 2017 年 2 月的一次实际的、真实世界的攻击中被破解，当时谷歌密码学家披露的 [SHAttered](https://shattered.it/) 技术可以使两个不同的文件拥有相同的 SHA-1 文件签名（这称之为“碰撞”）。


在当时，创建一个 SHA-1 碰撞被认为需要非常昂贵的计算成本，谷歌的专家认为 SHA-1 在实际应用中至少还能用上五年，直到成本下降。


然而，随后在 2019 年 5 月和 2020 年 1 月发布的研究报告中，详细介绍了一种更新的方法，将 SHA-1 选择-前缀碰撞攻击chosen-prefix collision attack的成本分别降低到 [11 万美元](https://www.zdnet.com/article/sha-1-collision-attacks-are-now-actually-practical-and-a-looming-danger/)和 [5 万美元](https://eprint.iacr.org/2020/014.pdf)以下。


对于高级威胁攻击者，例如国家黑客和高端网络犯罪集团，如果他们能够生成一个 SSH 认证密钥，使他们能够远程不被发现地访问关键服务器，那么 5 万美元是一个很小的代价。


### OpenSSH 关闭 ssh-rsa 模式


“由于这个原因，我们将在不久的未来版本中默认禁用 ssh-rsa 公钥签名算法。”OpenSSH 开发者今天表示。


OpenSSH 应用程序使用 ssh-rsa 模式来[生成 SSH 验证密钥](https://www.ssh.com/ssh/public-key-authentication)。这些密钥中的一个存储在用户要登录的服务器上，另一个存储在用户的本地 OpenSSH 客户端中，这样用户就可以在每次登录时不需要输入密码就可以访问服务器，而是以本地认证密钥来代替。


在默认情况下，OpenSSH ssh-rsa 模式通过使用 SHA-1 哈希函数生成这些密钥，这意味着这些密钥容易受到 SHAterred 攻击，使攻击者能够生成重复的密钥。


“遗憾的是，尽管有更好的替代方案存在，但这种算法仍然被广泛使用，它是原始的 SSH RFC 规定的唯一剩下的公钥签名算法”，OpenSSH 的开发人员今天表示。


OpenSSH 团队现在要求服务器所有者检查他们的密钥是否已经使用默认的 ssh-rsa 模式生成，并使用不同的模式生成新的密钥。


OpenSSH 团队表示，推荐的模式是 rsa-sha2-256/512（从 OpenSSH 7.2 开始支持）、ssh-ed25519（从 OpenSSH 6.5 开始支持）或 ecdsa-sha2-nistp256/384/521（从 OpenSSH 5.7 开始支持）。



> 
> 这里是最近公告中的最好的消息。让我们为所有的嵌入式系统和设备永远不会看到 OpenSSH 中废弃的 ssh-rsa SHA-1 密钥的升级而默哀一分钟。
> 
> 
> - Julio (@juliocesarfort) 2020 年 5 月 27 日
> 
> 
> 


OpenSSH 项目将在未来（目前还未确定）的版本中默认禁用 ssh-rsa 模式，但是在此之前，他们还计划默认启用 UpdateHostKeys 功能，让服务器所有者可以轻松自动地从旧的 ssh-rsa 模式迁移到更好的验证算法。


依赖 OpenSSH 管理远程系统的服务器管理员可以在 [OpenSSH 8.3 的变更日志](http://www.openssh.com/txt/release-8.3)中找到更多关于如何测试他们的服务器是否有基于弱 SHA-1 的密钥的详细信息。


在之前的一个版本中，在 8.2 版本中，OpenSSH 团队还增加了对[基于 FIDO/U2F 的硬件安全密钥的支持](https://www.zdnet.com/article/openssh-adds-support-for-fidou2f-security-keys/)，这也可以用来更安全地登录远程服务器。




---


via: <https://www.zdnet.com/article/openssh-to-deprecate-sha-1-logins-due-to-security-risk/>


作者：[Catalin Cimpanu](https://www.zdnet.com/meet-the-team/us/catalin.cimpanu/) 选题：[wxy](https://github.com/wxy) 译者：[wxy](https://github.com/wxy) 校对：[wxy](https://github.com/wxy)


本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](/article-12257-1.html) 荣誉推出


OK
# OpenSSH to deprecate SHA-1 logins due to security risk

![catalin-cimpanu.jpg](https://www.zdnet.com/a/img/resize/cfe8bff3bdc8af3f2ab8d2a4252f39ca491137af/2018/08/21/a59867e9-8d75-40af-a87c-690638f8afa4/catalin-cimpanu.jpg?auto=webp&fit=crop&frame=1&height=192&width=192)

![OpenSSH SSH](https://www.zdnet.com/a/img/resize/666bdb648342005b9f1999391c51e4540adfa5e6/2020/02/14/c584fae7-68d7-49f9-8e85-6f0e46fd8aca/openssh.png?auto=webp&width=1280)

OpenSSH, the most popular utility for connecting to and managing remote servers, has announced today plans to drop support for its SHA-1 authentication scheme.

The OpenSSH team cited security concerns with the SHA-1 hashing algorithm, currently considered insecure.

The algorithm was broken in a practical, real-world attack in February 2017, when Google cryptographers disclosed [SHAttered](https://shattered.it/), a technique that could make two different files appear as they had the same SHA-1 file signature.

At the time, creating an SHA-1 collision was considered computationally expensive, and Google experts thought SHA-1 could still be used in practice for at least half a decade until the cost would go down.

However, subsequent research released in May 2019 and in January 2020, detailed an updated methodology to cut down the cost of an SHA-1 chosen-prefix collision attack to [under $110,000](https://www.zdnet.com/article/sha-1-collision-attacks-are-now-actually-practical-and-a-looming-danger/) and [under $50,000](https://eprint.iacr.org/2020/014.pdf), respectively.

For advanced threat actors, such as nation-state and high-end cybercrime groups, $50,000 is a small price to pay if they could generate an SSH authentication key that grants them remote and undetected access to critical servers.

### OpenSSH to disable "ssh-rsa" mode


"For this reason, we will be disabling the 'ssh-rsa' public key signature algorithm by default in a near-future release," OpenSSH developers said today.

The OpenSSH app uses the "ssh-rsa" mode to generate [SSH authentication keys](https://www.ssh.com/ssh/public-key-authentication). One of these keys is stored on the server a user wants to log in, and the other is stored in the user's local OpenSSH client, allowing users to access servers without having to enter their passwords on every login, presenting the local authentication key instead.

By default, the OpenSSH ssh-rsa mode generates these keys by using the SHA-1 hashing function, meaning these keys are susceptible to SHAterred attacks, allowing threat actors to generate duplicate keys.

"This algorithm is unfortunately still used widely despite the existence of better alternatives, being the only remaining public key signature algorithm specified by the original SSH RFCs," OpenSSH devs said today.

The OpenSSH team is now asking server owners to check if their keys have been generated with the default ssh-rsa mode, and generate new ones using a different mode.

Recommended modes are rsa-sha2-256/512 (supported since OpenSSH 7.2), ssh-ed25519 (supported since OpenSSH 6.5) or ecdsa-sha2-nistp256/384/521 (supported since OpenSSH 5.7), the OpenSSH team said.

here's the best piece of the recent announcement. RIP & one minute silence to all embedded systems and appliances that will never see an upgrade for deprecating ssh-rsa SHA-1 based keys in OpenSSH.

— Julio (@juliocesarfort)[pic.twitter.com/zf5VewugC6][May 27, 2020]

The OpenSSH project will by disabling the ssh-rsa mode by default in a future (currently unspecified) release, however, before that, they also plan to enable the *UpdateHostKeys *feature by default, to allow server owners to easily and automatically migrate from the old ssh-rsa mode to better authentication algorithms.

Server owners who rely on OpenSSH to manage remote systems can find additional details on how to test their server for weak SHA-1-based keys in the [OpenSSH 8.3 changelog](http://www.openssh.com/txt/release-8.3).

In a previous release, in version 8.2, the OpenSSH team also added [support for FIDO/U2F-based hardware security keys](https://www.zdnet.com/article/openssh-adds-support-for-fidou2f-security-keys/), which can also be used to log into remote servers in even a safer manner.

#### What's in a name? These DevOps tools come with strange backstories

[Editorial standards](/editorial-guidelines/)