On Tue, 2 Sep 2025, kc-openbsd@chadwicks.me.uk wrote:

> 2 Sept 2025 00:51:51 Damien Miller <djm@mindrot.org>:
> 
> > IMO, at 64 characters, a hex-encoded SHA256 hash is too long for this.
> > It should be truncated and/or a modified b64 encoding use.
>
> Perhaps it doesn't matter but wouldn't b64 lengthen or weaken the hash
> bits. CMAC would be shorter?

Using base64 doesn't weaken the hash, it's just an encoding.

There's not much of a reason for this to be a cryptographic hash to
begin with; very few people run ssh multiplexing in situations where
the connection parameters are adversarial and available for collision.

-d