{"id":112854,"date":"2024-01-12T15:10:27","date_gmt":"2024-01-12T13:10:27","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/proekt-openssh-opublikoval-plan-prekrashheniya-podderzhki-dsa"},"modified":"2024-01-12T15:10:27","modified_gmt":"2024-01-12T13:10:27","slug":"proekt-openssh-opublikoval-plan-prekrashheniya-podderzhki-dsa","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/proekt-openssh-opublikoval-plan-prekrashheniya-podderzhki-dsa","title":{"rendered":"The OpenSSH project has announced plans to discontinue support for DSA.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
The developers of the OpenSSH project have announced a plan to discontinue support for keys based on the DSA algorithm. In modern terms, DSA keys do not provide an adequate level of security, as they utilize a private key size of only 160 bits and SHA1 hashing, which corresponds to the security level of approximately an 80-bit symmetric key. <\/p>\n
By default, the use of DSA keys was discontinued in 2015, but support for DSA remained as an option since this algorithm is the only one mandated in the SSHv2 protocol. This requirement was added because, at the time of the creation and approval of the SSHv2 protocol, all alternative algorithms were subject to patent restrictions. Since then, the situation has changed, patents related to RSA have expired, the ECDSA algorithm has been introduced, which significantly outperforms DSA in terms of efficiency and security, as well as EdDSA, which is safer and faster than ECDSA. The only factor for continuing DSA support was to maintain compatibility with legacy devices. <\/p>\n
Evaluating the current situation, the OpenSSH developers concluded that the costs of continuing to support the insecure DSA algorithm are not justified, and its removal will encourage the discontinuation of DSA support in other SSH implementations and cryptographic libraries. In the upcoming April release of OpenSSH, a build with DSA will be retained, but the option to disable DSA at the compilation stage will be provided. In the June release of OpenSSH, DSA will be disabled by default during the build process, and in early 2025, the DSA implementation will be removed from the codebase. <\/p>\n