"Joseph Salowey (jsalowey)" <jsalowey at cisco.com> writes: > In addition to the one you raised its not > clear that we could move to a hash other than MD5. This is hard coded > in RFC 4716. While this probably isn't a problem know it could be a > weakness in the future. I'm pretty sure I've run into SSH > implementations that display SHA-1 fingerprints as well. I suppose we > could have an encoding that was something like > host-key-alg-hash-alg-fingerprint. To upgrade from md5, I think the simplest way is to use a new parameter name, like ssh://user at host.example.com?fingerprint-sha1=ssh-dss-xxxx...xx or ssh://user at host.example.com?fingerprint-hash-of-the-day=ssh-dss-xxxx...xx whenever there's a proper spec for non-md5 fingerprints. /Niels
Note Well: Messages sent to this mailing list are the opinions of the senders and do not imply endorsement by the IETF.