From 67cbe8ab2f54c24ccf79d0d44abf92849cf6e5f3 Mon Sep 17 00:00:00 2001
From: Johannes Thyssen Tishman
 <131173056+thyssentishman@users.noreply.github.com>
Date: Mon, 18 May 2026 09:56:22 +0000
Subject: [PATCH] Use SHA256 instead of MD5 for fingerprints

---
 lib/src/ssh_transport.dart | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/src/ssh_transport.dart b/lib/src/ssh_transport.dart
index d66a245..0ce524f 100644
--- a/lib/src/ssh_transport.dart
+++ b/lib/src/ssh_transport.dart
@@ -31,7 +31,7 @@ typedef SSHPrintHandler = void Function(String?);
 
 /// Function called when host key is received.
 /// [type] is the type of the host key, For example 'ssh-rsa',
-/// [fingerprint] md5 fingerprint of the host key.
+/// [fingerprint] SHA256 fingerprint of the host key.
 typedef SSHHostkeyVerifyHandler = FutureOr<bool> Function(
   String type,
   Uint8List fingerprint,
@@ -1180,7 +1180,7 @@ class SSHTransport {
     _sessionId ??= exchangeHash;
     _sharedSecret = sharedSecret;
 
-    final fingerprint = MD5Digest().process(hostkey);
+    final fingerprint = SHA256Digest().process(hostkey);
 
     if (_hostkeyVerified) {
       _sendNewKeys();