Re: Feedback from uri list

[nisse%lysator.liu.se@localhost (Niels Möller)]

"Joseph Salowey (jsalowey)" <jsalowey%cisco.com@localhost> writes:

> In addition to the one you raised its not
> clear that we could move to a hash other than MD5.  This is hard coded
> in RFC 4716.  While this probably isn't a problem know it could be a
> weakness in the future.  I'm pretty sure I've run into SSH
> implementations that display SHA-1 fingerprints as well.   I suppose we
> could have an encoding that was something like
> host-key-alg-hash-alg-fingerprint.

To upgrade from md5, I think the simplest way is to use a new
parameter name, like

  ssh://user%host.example.com@localhost?fingerprint-sha1=ssh-dss-xxxx...xx

or

  ssh://user%host.example.com@localhost?fingerprint-hash-of-the-day=ssh-dss-xxxx...xx

whenever there's a proper spec for non-md5 fingerprints.

/Niels