With the 8.2 release of OpenSSH, they have declared that
ssh-rsa for SHA-1 will soon be removed from the defaults:
Future deprecation notice
It is now possible to perform chosen-prefix attacks against the SHA-1 hash algorithm for less than USD$50K. For this reason, we will be disabling the
ssh-rsapublic key signature algorithm that depends on SHA-1 by default in a near-future release.
This algorithm is unfortunately still used widely despite the existence of better alternatives, being the only remaining public key signature algorithm specified by the original SSH RFCs.
If I have (and might use, but not sure where) an
ssh-rsa key, what are the next steps for me? Pretend I don't have another key yet.
- Generate new key(s?).
- Add new keys to known services.
- Rename old key so it does not get picked up automatically?
- This is to nudge me when I try a server that used to work, so I add the new key.