OpenSSH 10.0 drops DSA, CBC, and SHA-1 HMAC. About damn time.

OpenSSH 10.0 shipped. The version number is round. The changelog is not boring.

Three things are gone. Not deprecated-with-a-stern-warning-on-connect. Gone. The code no longer exists in the source tree. You cannot re-enable them with an option. This is the correct outcome for all three.

DSA is dead

ssh-dss — DSA host keys and user keys — is removed. If you still have id_dsa in your ~/.ssh/, it will not authenticate you to anything running OpenSSH 10.0. If your server has ssh_host_dsa_key, it will no longer be presented to clients.

DSA should have died in 2013. The specific reasons have been well-documented for over a decade: fixed 1024-bit key size (computationally marginal by the early 2000s, embarrassing by 2010), and the k-reuse vulnerability. That last one deserves a sentence: if your DSA implementation ever uses the same random nonce k twice during signing, an observer can reconstruct your private key from two signatures. This is not a theoretical concern. Sony’s PlayStation 3 was broken by exactly this in 2010 — their firmware used a static k instead of generating it randomly, and George Hotz recovered the private key from two signatures off a game disc.

DSA and ECDSA share the same underlying vulnerability class. ECDSA survived the cut because it operates on 256-bit curves that are still viable, not because the design is better. DSA has no modern variant worth keeping. The OpenSSH team agreed. Eleven years ago. OpenSSH 7.0 deprecated it in 2015. If you didn’t migrate in eleven years, I cannot help you.

Check right now:

find /etc/ssh -name 'ssh_host_dsa_key' 2>/dev/null
find ~/.ssh -name 'id_dsa' 2>/dev/null

If either of those finds something, fix it before you roll out 10.0. Generate Ed25519 keys. They’re faster, shorter, immune to k-reuse (the signing algorithm doesn’t use a random nonce), and they’ve been the right answer since OpenSSH 6.5 in 2014.

ssh-keygen -t ed25519 -C "$(hostname)-$(date +%Y%m%d)"

CBC mode is dead

aes128-cbc, aes192-cbc, aes256-cbc, 3des-cbc — removed. CTR and GCM modes remain.

CBC in SSH has been known-bad since the BEAST attack class was demonstrated against TLS/SSL in 2011, and the SSH-specific CBC attack was published even earlier — Martin et al. had a practical plaintext recovery attack against SSH CBC in 2009. OpenSSH disabled CBC by default around 2012. But disabled-by-default is not removed, and some configurations explicitly re-enabled it via the Ciphers option in sshd_config to support legacy clients.

That option now silently drops CBC entries (the parser ignores unknown ciphers on some paths; on others it hard-errors — check your sshd startup logs after the upgrade). Either way, you cannot bring CBC back. That’s fine.

The things you need to care about here are not your Linux servers. They’re your network equipment. Cisco IOS versions from 2015-2020 commonly advertise CBC as their only available cipher. Same for embedded IPMI controllers, older HP iLO firmware, and any Java application still running JSch versions prior to 0.2.0. These will fail to negotiate a session with an OpenSSH 10.0 server.

The correct stopgap — not the permanent solution, the stopgap — is a jump host running OpenSSH 9.x on a management VLAN with legacy negotiation preserved for those specific clients. Not exposed to the internet. Sunset-dated. The permanent solution is updating the firmware on your Cisco gear or migrating off JSch.

SHA-1 HMAC is dead

hmac-sha1 and hmac-sha1-96 are removed. hmac-sha2-256 and hmac-sha2-512 have been the defaults since OpenSSH 7.x. SHA-1 collision resistance has been broken in practice since 2017 (the SHAttered attack). Its continued presence in SSH HMAC configurations past 2020 was inertia, not necessity.

This one will bite the fewest people. Most modern software hasn’t advertised SHA-1 MACs as a preference in years. Check your ~/.ssh/config and your sshd_config for any explicit MACs lines that reference hmac-sha1. Remove them.

What stayed

ssh-rsa is still in the tree. RSA SHA-1 (ssh-rsa) has been disabled since 8.8, and RSA SHA-2 (rsa-sha2-256, rsa-sha2-512) has been the default since 9.0. The key format and code path remain because RSA SHA-2 is still cryptographically viable — there’s no compelling reason to remove it, unlike DSA which has no valid modern variant. If you’re using RSA keys, you’re fine as long as you’re on SHA-2 signatures, which you have been by default for years.

Ed25519 and ECDSA on P-256 and P-384 are obviously still in. If you’re generating new keys and not using Ed25519, stop reading this and go fix that first.

The broader point

I’ve been watching OpenSSH’s deprecation-to-removal pipeline since before most of the people currently deploying SSH clients were in the workforce. The project’s pattern is consistent: announce deprecation loudly, disable by default, leave the option available for years, then remove. DSA was deprecated in 2015, disabled by default in 2021, removed now in 2026. That’s eleven years from first warning to removal.

If you have systems that are still negotiating DSA or CBC today, the problem is not OpenSSH 10.0. The problem is eleven years of configuration drift and deferred maintenance accumulating quietly until a package upgrade forces the audit.

This is the same dynamic as the 1024-bit FD limit that bit someone at 2am in 2003 and was still biting people two decades later — scar tissue in your config from decisions made when the threat model was different, preserved through every migration because nobody wanted to touch it. The crypto cases are worse because the threat model didn’t just change: the algorithms are actually broken, not just inconvenient.

Run the audit now. ssh -Q key and ssh -Q cipher show you what your client advertises. sshd -T | grep -E '^(ciphers|macs|hostkeyalgorithms)' shows you what your server is currently negotiating. If you see DSA, CBC, or SHA-1 in either output, you know what to do.

The post-quantum key exchange landed in OpenSSH 9.x and is now default. That’s a separate thread worth reading if you haven’t — the key exchange story and the bulk cipher story are different problems with different timelines, and 10.0 touches both.

Ten major versions. Fifteen years since I ran 5.x on a production box that’s now in a landfill somewhere. The project is still making the right calls. That’s rarer than it should be.