Developer Briefing — February 14, 2020

Executive briefing: OpenBSD released OpenSSH 8.2 on 14 February 2020, adding first-class support for FIDO/U2F security keys via the new sk-* key types and signaling removal of ssh-rsa signatures that rely on SHA-1. The update also fixes memory safety issues in the sftp server and clarifies default configuration behaviors.

Why it matters: Hardware-backed FIDO keys raise phishing resistance for administrative access, while SHA-1 signature deprecation will break legacy automation if host and user keys are not rotated. Organizations need to validate client and server compatibility and plan key transitions.

• Adopt FIDO: Pilot ecdsa-sk and ed25519-sk keys for administrator accounts and document yubikey/security key provisioning workflows.
• Plan ssh-rsa sunset: Inventory hosts and automation using RSA/SHA-1 keys and schedule regeneration with rsa-sha2-256 or Ed25519 algorithms before the announced removal.
• Update packages: Deploy OpenSSH 8.2 or vendor backports on servers and developer workstations, confirming ssh_config and sshd_config align with organization ciphers and MAC policies.
• Monitor sftp services: Review logs for anomalous sftp access and validate chroot and subsystem directives after upgrading.