Hacker News Reader

Comment by throw0101d | Hacker News Reader

About a one-year time frame for complete de-orbit:

    2024/01 - this announcement
    2024/03 (estimated) - DSA compile-time optional, enabled by default
    2024/06 (estimated) - DSA compile-time optional, *disabled* by default
    2025/01 (estimated) - DSA is removed from OpenSSH

View on HN

And then another 10 years until the last Linux distro LTS version has removed support for it :)

Missing from your timeline:

   2006-05-01 NIST SP 800-57 Part 1 Rev. 1 is published, which recommends to stop using 1024-bit DSA by 2010.
   2010 passes, but OpenSSH never added support for DSA with keylengths larger than 1024-bit.
   2015-08-11 OpenSSH 7 disables DSA at runtime.

The new announcement is just removing the config option to re-enable the algorithm. Hopefully most people stuck on DSA already starting migrating in 2015 (ideally: finished migration before 2010).

Reply on news.ycombinator.com