Switch in April 2024 Patch: Default SSH Algorithm Now Uses ECDSA

Zyxel_Claudia

As part of our continued commitment to improving network security and compatibility, Zyxel Networks has updated the default SSH algorithm used by its switches. Starting with the latest firmware updates, the default SSH algorithm has been changed to ECDSA (Elliptic Curve Digital Signature Algorithm).

Why the Change?

The decision to switch from SSH-RSA to ECDSA is driven by evolving industry standards and tool compatibility:

• OpenSSH 8.0 and newer versions have begun deprecating support for SSH-RSA by default.
• As a result, systems using updated versions of OpenSSH may fail to connect to Zyxel switches that still default to SSH-RSA.
• To prevent connection issues and ensure seamless access, Zyxel has adopted ECDSA as the new default algorithm.

What Is ECDSA?

ECDSA is a modern cryptographic algorithm that:

• Offers stronger security with shorter key lengths.
• Provides faster performance during connection handshakes.
• Is widely supported by current SSH clients, including OpenSSH, PuTTY, and TeraTerm.

Summary

This update ensures that Zyxel switches remain secure, modern, and fully compatible with today's widely used SSH clients and platforms. We recommend all users keep their firmware up to date to benefit from this and other critical security improvements.