Use of RSA Keys with SHA-256 and SHA-512 in the Secure Shell (SSH) Protocol
updates
Extracted elements (18)
RSASSA-PKCS1-v1_5 was chosen over RSASSA-PSS because PSS is not universally available, PKCS#1 v1.5 is widely supported in existing SSH implementations, and PKCS#1 v1.5 is not known to be insecure for this use case.
The document distinguishes 'public key format' (keypair generation and key encoding) from 'public key algorithm' (format plus signature procedures). This separation allows the same 'ssh-rsa' key format to be reused with new hash algorithms without re-encoding keys or changing trusted key fingerprints.
The new algorithms reuse the existing 'ssh-rsa' public key format rather than defining new key formats, so existing RSA keys can be used immediately without re-encoding and without invalidating already-trusted key fingerprints.
OpenSSH 7.2 (but not 7.2p2) incorrectly encodes the signature algorithm as 'ssh-rsa' even when the request specifies 'rsa-sha2-256' or 'rsa-sha2-512'; the actual hash used is still SHA-256 or SHA-512. A server MAY accept this variant as a good-faith implementation.
A verifier MAY accept shorter encodings of rsa_signature_blob where one or more leading zeros are omitted from S, because some signers send such shortened encodings.
If a client includes a signature in SSH_MSG_USERAUTH_REQUEST, it MUST encode the same algorithm name in the signature field as in the outer request — either 'rsa-sha2-256' or 'rsa-sha2-512'.
If a server receives a client authentication request where the algorithm name in the signature mismatches that in SSH_MSG_USERAUTH_REQUEST, it MAY apply arbitrary authentication penalties including authentication failure or disconnect.
Servers that accept rsa-sha2-* signatures for client authentication SHOULD implement the extension negotiation mechanism defined in RFC 8308, including the 'server-sig-algs' extension, to advertise supported algorithms.
To negotiate rsa-sha2-256 or rsa-sha2-512 for server authentication, the client or server includes the algorithm name(s) in the 'server_host_key_algorithms' name-list in SSH_MSG_KEXINIT; the server then sends an 'ssh-rsa' public key and signs with the negotiated algorithm name.
When authenticating with an RSA key against a server that does not implement 'server-sig-algs', clients MAY default to 'ssh-rsa' to avoid authentication penalties; once rsa-sha2-* is widely adopted, clients MAY instead default to one of the new algorithms.
Two new RSA public key algorithms are defined: 'rsa-sha2-256' (RECOMMENDED) using SHA-256, and 'rsa-sha2-512' (OPTIONAL) using SHA-512. Both use RSASSA-PKCS1-v1_5 signing and are suitable for both server and client authentication.
IANA updated the 'Public Key Algorithm Names' table in the SSH Protocol Parameters registry to add a new 'Public Key Format' column and two new entries: 'rsa-sha2-256' and 'rsa-sha2-512', both with Public Key Format 'ssh-rsa', referencing RFC 8332 Section 3.
Implementations SHOULD start to disable 'ssh-rsa' (SHA-1) in their default configurations as soon as the new RSA signature algorithms have been widely adopted, while using SSH_MSG_EXT_INFO and 'server-sig-algs' to allow coexistence with legacy deployments during transition.
NIST SP 800-131A disallows RSA and DSA keys shorter than 2048 bits and disallows SHA-1 for digital signature generation. This document advises following these recommendations outside US government use as well.
Verifiers MUST NOT check an RSASSA-PKCS1-v1_5 signature by applying the RSA key and then parsing the output to extract the hash, as this may be exploitable. Instead, verifiers MUST apply RSASSA-PKCS1-v1_5 padding to the expected hash and compare the encoded bytes with the RSA operation output.
For client authentication, SSH_MSG_USERAUTH_REQUEST encodes the 'publickey' method with the string field 'public key algorithm name' set to 'rsa-sha2-256' or 'rsa-sha2-512', and 'public key blob' encoded using the 'ssh-rsa' public key format (string 'ssh-rsa', mpint e, mpint n).
Signatures are encoded as two string fields: the algorithm name ('rsa-sha2-256' or 'rsa-sha2-512') followed by rsa_signature_blob, which is an octet string S (RSASSA-PKCS1-v1_5 output) of the same length in octets as the RSA modulus.
The 'ssh-rsa' public key format is reused unchanged for both new algorithms: a string 'ssh-rsa', followed by mpint e and mpint n. The encoded string 'ssh-rsa' is retained even when the algorithm name is 'rsa-sha2-256' or 'rsa-sha2-512'.