# Bug in crypto-policies re ssh key exchange algorithms: should I report upstream?

**URL:** <https://forums.rockylinux.org/t/bug-in-crypto-policies-re-ssh-key-exchange-algorithms-should-i-report-upstream/8453>\
**Category:** Rocky Linux Help & Support\
**Created:** [January 6, 2023, 2:32pm UTC](https://forums.rockylinux.org/t/bug-in-crypto-policies-re-ssh-key-exchange-algorithms-should-i-report-upstream/8453 "2023-01-06T14:32:19Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![aaminoff](https://avatars.discourse-cdn.com/v4/letter/a/ac8455/32.png) [@aaminoff](https://forums.rockylinux.org/u/aaminoff)\
**Post date:** [January 6, 2023, 2:32pm UTC](https://forums.rockylinux.org/t/bug-in-crypto-policies-re-ssh-key-exchange-algorithms-should-i-report-upstream/8453/1 "2023-01-06T14:32:19Z")

</div>

The crypto-policy man page says that SHA-1 is disallowed in the FUTURE policy, which implies that it is allowed in the DEFAULT policy. And in fact it is explicitly mentioned in the bullet point about MACs.

But, for ssh server KexAlgorithms, the DEFAULT policy disallows sha1. In order to allow sha1, one would have to use LEGACY, or explicitly add those algorithms:

[aminoff@perlw2 /etc]$ diff /usr/share/crypto-policies/LEGACY/opensshserver.txt /usr/share/crypto-policies/DEFAULT/opensshserver.txt | grep ‘[\<\>] KexAlgorithms’  
\< KexAlgorithms [curve25519-sha256,curve25519-sha256@libssh.org](mailto:curve25519-sha256,curve25519-sha256@libssh.org),ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1

> KexAlgorithms [curve25519-sha256,curve25519-sha256@libssh.org](mailto:curve25519-sha256,curve25519-sha256@libssh.org),ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512

My question is, is this something that can be fixed in Rocky Linux, or should I report it as a bug upstream?

---

<div class="post-metadata">

**Author:** ![Ritov](https://avatars.discourse-cdn.com/v4/letter/r/3ec8ea/32.png) [@Ritov](https://forums.rockylinux.org/u/Ritov)\
**Post date:** [January 6, 2023, 2:47pm UTC](https://forums.rockylinux.org/t/bug-in-crypto-policies-re-ssh-key-exchange-algorithms-should-i-report-upstream/8453/2 "2023-01-06T14:47:36Z")

</div>

For EL9:  
`update-crypto-policies --set DEFAULT:SHA1`

---

<div class="post-metadata">

**Author:** ![brian](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/brian/32/5777_2.png) [@brian](https://forums.rockylinux.org/u/brian)\
**Post date:** [August 25, 2023, 3:29am UTC](https://forums.rockylinux.org/t/bug-in-crypto-policies-re-ssh-key-exchange-algorithms-should-i-report-upstream/8453/3 "2023-08-25T03:29:11Z")

</div>