Why does Openssh use only SHA1 for signing and verifying of digital signatures? I am learning SSH protocol. With my current understanding of SSH protocol, I think that message digest algorithms for using in digital signature should be derived from Key Exchange. But Openssh implementation uses only SHA1 for signing and verifying of digital signatures. SHA1 is hard coded in these two functions, ssh_dss_sign() and ssh_dss_verify().

I am wondering, does all the implementations of use SHA1 as hash algorithm for signing and verifying digital signatures.  And why don't we use SHA-256 as it's better than SHA1?

Is there any specific reason for doing so..? If yes, could someone please provide some references.

Thanks in advance.
Because the RFC says so.


  Signing and verifying using this key format is done according to the
    Digital Signature Standard [FIPS-186-2] using the SHA-1 hash
    [FIPS-180-2].


It says the same for RSA half a page down.

Apparently the signature algorithm is a defined part of the public key method's specification, rather than being negotiated separately like the MAC algorithm is.

At a guess, SHA-1 was considered good enough at the time SSH 2 was being written almost a decade ago (the RFCs were published in 2006), and no one wants to bother changing it now.

Notice that ECDSA keys, published in RFC 5656 in 2009, use SHA-2:


  Signing and verifying is done using the Elliptic Curve Digital
     Signature Algorithm (ECDSA).  ECDSA is specified in [SEC1].  The
     message hashing algorithm MUST be from the SHA2 family of hash
     functions [FIPS-180-3] and is chosen according to the curve size as
     specified in Section 6.2.1.


You can see it in action in ssh_ecdsa_sign() in ssh-ecdsa.c and key_ec_nid_to_hash_alg() in key.c.

(I'm not an expert on SSH, so please take this answer with a grain of salt.)