Bug#788783: openssh-client: uses MD5 for key fingerprints

2015-06-17 Thread Mark Wooding
"brian m. carlson" writes: > > The remaining possibility is that the adversary has managed to come up > > with a new public key (and matching private key) with the same > > fingerprint as the target key, which was generated by an honest party. > > But that's finding a second preimage, and it's /w

Bug#788783: openssh-client: uses MD5 for key fingerprints

2015-06-16 Thread Mark Wooding
"brian m. carlson" writes: > MD5 is not suitable for any application requiring collision resistance, > such as a key fingerprint. Please switch to one of the SHA-2 values > instead, or upgrade to OpenSSH 6.8, which fixes this problem. Fortunately, your premise is incorrect. Key fingerprints do