Search code examples
.netsshrsasftpssh.net

Are sftp fingerprints for rsa-sha2-512, rsa-sha2-256, ssh-rsa supposed to be the same?


I'm connecting to an sftp server and when any one of the host key algorithms from these three (rsa-sha2-512, rsa-sha2-256, ssh-rsa) are specified, the same fingerprint is returned. I expected the fingerprint to be different, as I'm specifying a different algorithm. Is this a configuration on the sftp server, or are the fingerprints for those three algorithms will always be the same?

Using library ssh.net (not sure if it matters).


Solution

  • Yes it's supposed to be the same. This is because the fingerprint of the server's host key is based on the key itself and not the hash algorithm used during the SSH handshake.

    To have different fingerprints for each algorithm, you have to generate separate RSA key pairs for each and configure SFTP server to use different keys with their respective algorithms.