diff --git a/auth-rsa.c b/auth-rsa.c

index e9f4ede..ff7a132 100644

--- a/auth-rsa.c

+++ b/auth-rsa.c

@@ -1,4 +1,4 @@

-/* $OpenBSD: auth-rsa.c,v 1.88 2014/07/15 15:54:14 millert Exp $ */

+/* $OpenBSD: auth-rsa.c,v 1.89 2014/12/21 22:27:56 djm Exp $ */

 /*

  * Author: Tatu Ylonen <ylo@cs.hut.fi>

  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland

@@ -236,7 +236,8 @@ rsa_key_allowed_in_file(struct passwd *pw, char *file,

 			    "actual %d vs. announced %d.",

 			    file, linenum, BN_num_bits(key->rsa->n), bits);

-		fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);

+		fp = key_fingerprint(key, options.fingerprint_hash,

+		    SSH_FP_DEFAULT);

 		debug("matching key found: file %s, line %lu %s %s",

 		    file, linenum, key_type(key), fp);

 		free(fp);

diff --git a/auth.c b/auth.c

index 5e60682..5a9acd3 100644

--- a/auth.c

+++ b/auth.c

@@ -702,7 +702,7 @@ auth_key_is_revoked(Key *key)

 	case 1:

  revoked:

 		/* Key revoked */

-		key_fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);

+		key_fp = key_fingerprint(key, options.fingerprint_hash, SSH_FP_DEFAULT);

 		error("WARNING: authentication attempt with a revoked "

 		    "%s key %s ", key_type(key), key_fp);

 		free(key_fp);

diff --git a/auth2-hostbased.c b/auth2-hostbased.c

index 6787e4c..b7ae353 100644

--- a/auth2-hostbased.c

+++ b/auth2-hostbased.c

@@ -1,4 +1,4 @@

-/* $OpenBSD: auth2-hostbased.c,v 1.18 2014/07/15 15:54:14 millert Exp $ */

+/* $OpenBSD: auth2-hostbased.c,v 1.19 2014/12/21 22:27:56 djm Exp $ */

 /*

  * Copyright (c) 2000 Markus Friedl.  All rights reserved.

  *

@@ -208,13 +208,14 @@ hostbased_key_allowed(struct passwd *pw, const char *cuser, char *chost,

 	if (host_status == HOST_OK) {

 		if (key_is_cert(key)) {

 			fp = key_fingerprint(key->cert->signature_key,

-			    SSH_FP_MD5, SSH_FP_HEX);

+			    options.fingerprint_hash, SSH_FP_DEFAULT);

 			verbose("Accepted certificate ID \"%s\" signed by "

 			    "%s CA %s from %s@%s", key->cert->key_id,

 			    key_type(key->cert->signature_key), fp,

 			    cuser, lookup);

 		} else {

-			fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);

+			fp = key_fingerprint(key, options.fingerprint_hash,

+			    SSH_FP_DEFAULT);

 			verbose("Accepted %s public key %s from %s@%s",

 			    key_type(key), fp, cuser, lookup);

 		}

diff --git a/auth2-pubkey.c b/auth2-pubkey.c

index f3ca965..3f4f789 100644

--- a/auth2-pubkey.c

+++ b/auth2-pubkey.c

@@ -213,7 +213,7 @@ pubkey_auth_info(Authctxt *authctxt, const Key *key, const char *fmt, ...)

 	if (key_is_cert(key)) {

 		fp = key_fingerprint(key->cert->signature_key,

-		    SSH_FP_MD5, SSH_FP_HEX);

+		    options.fingerprint_hash, SSH_FP_DEFAULT);

 		auth_info(authctxt, "%s ID %s (serial %llu) CA %s %s%s%s", 

 		    key_type(key), key->cert->key_id,

 		    (unsigned long long)key->cert->serial,

@@ -221,7 +221,8 @@ pubkey_auth_info(Authctxt *authctxt, const Key *key, const char *fmt, ...)

 		    extra == NULL ? "" : ", ", extra == NULL ? "" : extra);

 		free(fp);

 	} else {

-		fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);

+		fp = key_fingerprint(key, options.fingerprint_hash,

+		    SSH_FP_DEFAULT);

 		auth_info(authctxt, "%s %s%s%s", key_type(key), fp,

 		    extra == NULL ? "" : ", ", extra == NULL ? "" : extra);

 		free(fp);

@@ -365,8 +366,8 @@ check_authkeys_file(FILE *f, char *file, Key* key, struct passwd *pw)

 				continue;

 			if (!key_is_cert_authority)

 				continue;

-			fp = key_fingerprint(found, SSH_FP_MD5,

-			    SSH_FP_HEX);

+			fp = key_fingerprint(found, options.fingerprint_hash,

+			    SSH_FP_DEFAULT);

 			debug("matching CA found: file %s, line %lu, %s %s",

 			    file, linenum, key_type(found), fp);

 			/*

@@ -406,7 +407,8 @@ check_authkeys_file(FILE *f, char *file, Key* key, struct passwd *pw)

 			if (key_is_cert_authority)

 				continue;

 			found_key = 1;

-			fp = key_fingerprint(found, SSH_FP_MD5, SSH_FP_HEX);

+			fp = key_fingerprint(found, options.fingerprint_hash,

+			    SSH_FP_DEFAULT);

 			debug("matching key found: file %s, line %lu %s %s",

 			    file, linenum, key_type(found), fp);

 			free(fp);

@@ -432,7 +434,7 @@ user_cert_trusted_ca(struct passwd *pw, Key *key)

 		return 0;

 	ca_fp = key_fingerprint(key->cert->signature_key,

-	    SSH_FP_MD5, SSH_FP_HEX);

+	    options.fingerprint_hash, SSH_FP_DEFAULT);

 	if (key_in_file(key->cert->signature_key,

 	    options.trusted_user_ca_keys, 1) != 1) {

diff --git a/digest-libc.c b/digest-libc.c

index 1b4423a..169ded0 100644

--- a/digest-libc.c

+++ b/digest-libc.c

@@ -1,4 +1,4 @@

-/* $OpenBSD: digest-libc.c,v 1.3 2014/06/24 01:13:21 djm Exp $ */

+/* $OpenBSD: digest-libc.c,v 1.4 2014/12/21 22:27:56 djm Exp $ */

 /*

  * Copyright (c) 2013 Damien Miller <djm@mindrot.org>

  * Copyright (c) 2014 Markus Friedl.  All rights reserved.

@@ -126,6 +126,26 @@ ssh_digest_by_alg(int alg)

 	return &(digests[alg]);

 }

+int

+ssh_digest_alg_by_name(const char *name)

+{

+	int alg;

+

+	for (alg = 0; alg < SSH_DIGEST_MAX; alg++) {

+		if (strcasecmp(name, digests[alg].name) == 0)

+			return digests[alg].id;

+	}

+	return -1;

+}

+

+const char *

+ssh_digest_alg_name(int alg)

+{

+	const struct ssh_digest *digest = ssh_digest_by_alg(alg);

+

+	return digest == NULL ? NULL : digest->name;

+}

+

 size_t

 ssh_digest_bytes(int alg)

 {

diff --git a/digest-openssl.c b/digest-openssl.c

index 02b1703..bb58ff2 100644

--- a/digest-openssl.c

+++ b/digest-openssl.c

@@ -1,4 +1,4 @@

-/* $OpenBSD: digest-openssl.c,v 1.4 2014/07/03 03:26:43 djm Exp $ */

+/* $OpenBSD: digest-openssl.c,v 1.5 2014/12/21 22:27:56 djm Exp $ */

 /*

  * Copyright (c) 2013 Damien Miller <djm@mindrot.org>

  *

@@ -74,6 +74,26 @@ ssh_digest_by_alg(int alg)

 	return &(digests[alg]);

 }

+int

+ssh_digest_alg_by_name(const char *name)

+{

+	int alg;

+

+	for (alg = 0; digests[alg].id != -1; alg++) {

+		if (strcasecmp(name, digests[alg].name) == 0)

+			return digests[alg].id;

+	}

+	return -1;

+}

+

+const char *

+ssh_digest_alg_name(int alg)

+{

+	const struct ssh_digest *digest = ssh_digest_by_alg(alg);

+

+	return digest == NULL ? NULL : digest->name;

+}

+

 size_t

 ssh_digest_bytes(int alg)

 {

diff --git a/digest.h b/digest.h

index 6afb197..3fe0734 100644

--- a/digest.h

+++ b/digest.h

@@ -1,4 +1,4 @@

-/* $OpenBSD: digest.h,v 1.6 2014/07/03 04:36:45 djm Exp $ */

+/* $OpenBSD: digest.h,v 1.7 2014/12/21 22:27:56 djm Exp $ */

 /*

  * Copyright (c) 2013 Damien Miller <djm@mindrot.org>

  *

@@ -33,6 +33,12 @@

 struct sshbuf;

 struct ssh_digest_ctx;

+/* Looks up a digest algorithm by name */

+int ssh_digest_alg_by_name(const char *name);

+

+/* Returns the algorithm name for a digest identifier */

+const char *ssh_digest_alg_name(int alg);

+

 /* Returns the algorithm's digest length in bytes or 0 for invalid algorithm */

 size_t ssh_digest_bytes(int alg);

diff --git a/dns.c b/dns.c

index c4d073c..4b8ae44 100644

--- a/dns.c

+++ b/dns.c

@@ -1,4 +1,4 @@

-/* $OpenBSD: dns.c,v 1.31 2014/06/24 01:13:21 djm Exp $ */

+/* $OpenBSD: dns.c,v 1.32 2014/12/21 22:27:56 djm Exp $ */

 /*

  * Copyright (c) 2003 Wesley Griffin. All rights reserved.

@@ -41,6 +41,7 @@

 #include "key.h"

 #include "dns.h"

 #include "log.h"

+#include "digest.h"

 static const char *errset_text[] = {

 	"success",		/* 0 ERRSET_SUCCESS */

@@ -80,7 +81,7 @@ dns_read_key(u_int8_t *algorithm, u_int8_t *digest_type,

     u_char **digest, u_int *digest_len, Key *key)

 {

 	int success = 0;

-	enum fp_type fp_type = 0;

+	int fp_alg = -1;

 	switch (key->type) {

 	case KEY_RSA:

@@ -110,17 +111,17 @@ dns_read_key(u_int8_t *algorithm, u_int8_t *digest_type,

 	switch (*digest_type) {

 	case SSHFP_HASH_SHA1:

-		fp_type = SSH_FP_SHA1;

+		fp_alg = SSH_DIGEST_SHA1;

 		break;

 	case SSHFP_HASH_SHA256:

-		fp_type = SSH_FP_SHA256;

+		fp_alg = SSH_DIGEST_SHA256;

 		break;

 	default:

 		*digest_type = SSHFP_HASH_RESERVED; /* 0 */

 	}

 	if (*algorithm && *digest_type) {

-		*digest = key_fingerprint_raw(key, fp_type, digest_len);

+		*digest = key_fingerprint_raw(key, fp_alg, digest_len);

 		if (*digest == NULL)

 			fatal("dns_read_key: null from key_fingerprint_raw()");

 		success = 1;

diff --git a/key.c b/key.c

index 2060761..780be1c 100644

--- a/key.c

+++ b/key.c

@@ -40,8 +40,7 @@ key_new_private(int type)

 }

 u_char*

-key_fingerprint_raw(const Key *k, enum fp_type dgst_type,

-    u_int *dgst_raw_length)

+key_fingerprint_raw(const Key *k, int dgst_alg, u_int *dgst_raw_length)

 {

 	u_char *ret = NULL;

 	size_t dlen;

@@ -49,7 +48,7 @@ key_fingerprint_raw(const Key *k, enum fp_type dgst_type,

 	if (dgst_raw_length != NULL)

 		*dgst_raw_length = 0;

-	if ((r = sshkey_fingerprint_raw(k, dgst_type, &ret, &dlen)) != 0)

+	if ((r = sshkey_fingerprint_raw(k, dgst_alg, &ret, &dlen)) != 0)

 		fatal("%s: %s", __func__, ssh_err(r));

 	if (dlen > INT_MAX)

 		fatal("%s: giant len %zu", __func__, dlen);

diff --git a/key.h b/key.h

index c6401a5..e1a3625 100644

--- a/key.h

+++ b/key.h

@@ -67,7 +67,7 @@ void	 key_add_private(Key *);

 Key	*key_new_private(int);

 void	 key_free(Key *);

 Key	*key_demote(const Key *);

-u_char	*key_fingerprint_raw(const Key *, enum fp_type, u_int *);

+u_char	*key_fingerprint_raw(const Key *, int, u_int *);

 int	 key_write(const Key *, FILE *);

 int	 key_read(Key *, char **);

diff --git a/krl.c b/krl.c

index eb31df9..4abed7e 100644

--- a/krl.c

+++ b/krl.c

@@ -36,6 +36,7 @@

 #include "misc.h"

 #include "log.h"

 #include "xmalloc.h"

+#include "digest.h"

 #include "krl.h"

@@ -406,7 +407,7 @@ ssh_krl_revoke_key_sha1(struct ssh_krl *krl, const Key *key)

 	u_int len;

 	debug3("%s: revoke type %s by sha1", __func__, key_type(key));

-	if ((blob = key_fingerprint_raw(key, SSH_FP_SHA1, &len)) == NULL)

+	if ((blob = key_fingerprint_raw(key, SSH_DIGEST_SHA1, &len)) == NULL)

 		return -1;

 	return revoke_blob(&krl->revoked_sha1s, blob, len);

 }

@@ -1119,7 +1120,7 @@ is_key_revoked(struct ssh_krl *krl, const Key *key)

 	/* Check explicitly revoked hashes first */

 	memset(&rb, 0, sizeof(rb));

-	if ((rb.blob = key_fingerprint_raw(key, SSH_FP_SHA1, &rb.len)) == NULL)

+	if ((rb.blob = key_fingerprint_raw(key, SSH_DIGEST_SHA1, &rb.len)) == NULL)

 		return -1;

 	erb = RB_FIND(revoked_blob_tree, &krl->revoked_sha1s, &rb);

 	free(rb.blob);

diff --git a/readconf.c b/readconf.c

index 7948ce1..3f5c58b 100644

--- a/readconf.c

+++ b/readconf.c

@@ -56,6 +56,7 @@

 #include "kex.h"

 #include "mac.h"

 #include "uidswap.h"

+#include "digest.h"

 /* Format of the configuration file:

@@ -151,6 +152,7 @@ typedef enum {

 	oCanonicalDomains, oCanonicalizeHostname, oCanonicalizeMaxDots,

 	oCanonicalizeFallbackLocal, oCanonicalizePermittedCNAMEs,

 	oStreamLocalBindMask, oStreamLocalBindUnlink,

+	oFingerprintHash,

 	oIgnoredUnknownOption, oDeprecated, oUnsupported

 } OpCodes;

@@ -265,6 +267,7 @@ static struct {

 	{ "canonicalizepermittedcnames", oCanonicalizePermittedCNAMEs },

 	{ "streamlocalbindmask", oStreamLocalBindMask },

 	{ "streamlocalbindunlink", oStreamLocalBindUnlink },

+	{ "fingerprinthash", oFingerprintHash },

 	{ "ignoreunknown", oIgnoreUnknown },

 	{ NULL, oBadOption }

@@ -1433,6 +1436,18 @@ parse_int:

 		intptr = &options->fwd_opts.streamlocal_bind_unlink;

 		goto parse_flag;

+	case oFingerprintHash:

+		arg = strdelim(&s);

+		if (!arg || *arg == '\0')

+			fatal("%.200s line %d: Missing argument.",

+			    filename, linenum);

+		if ((value = ssh_digest_alg_by_name(arg)) == -1)

+			fatal("%.200s line %d: Invalid hash algorithm \"%s\".",

+			    filename, linenum, arg);

+		if (*activep)

+			options->fingerprint_hash = value;

+		break;

+

 	case oDeprecated:

 		debug("%s line %d: Deprecated option \"%s\"",

 		    filename, linenum, keyword);

@@ -1609,6 +1624,7 @@ initialize_options(Options * options)

 	options->canonicalize_max_dots = -1;

 	options->canonicalize_fallback_local = -1;

 	options->canonicalize_hostname = -1;

+	options->fingerprint_hash = -1;

 }

 /*

@@ -1786,6 +1802,9 @@ fill_default_options(Options * options)

 		options->canonicalize_fallback_local = 1;

 	if (options->canonicalize_hostname == -1)

 		options->canonicalize_hostname = SSH_CANONICALISE_NO;

+	if (options->fingerprint_hash == -1)

+		options->fingerprint_hash = SSH_FP_HASH_DEFAULT;

+

 #define CLEAR_ON_NONE(v) \

 	do { \

 		if (option_clear_or_none(v)) { \

diff --git a/readconf.h b/readconf.h

index 0b9cb77..a028306 100644

--- a/readconf.h

+++ b/readconf.h

@@ -144,6 +144,8 @@ typedef struct {

 	int	num_permitted_cnames;

 	struct allowed_cname permitted_cnames[MAX_CANON_DOMAINS];

+	int	fingerprint_hash;

+

 	char	*ignored_unknown; /* Pattern list of unknown tokens to ignore */

 }       Options;

diff --git a/regress/Makefile b/regress/Makefile

index 3feb7a9..2905a0d 100644

--- a/regress/Makefile

+++ b/regress/Makefile

@@ -1,6 +1,6 @@

-#	$OpenBSD: Makefile,v 1.70 2014/06/24 01:14:17 djm Exp $

+#	$OpenBSD: Makefile,v 1.71 2014/12/22 02:15:52 djm Exp $

-REGRESS_TARGETS=	unit t1 t2 t3 t4 t5 t6 t7 t8 t9 t10 t-exec

+REGRESS_TARGETS=	unit t1 t2 t3 t4 t5 t6 t7 t8 t9 t10 t11 t-exec

 tests:		$(REGRESS_TARGETS)

 # Interop tests are not run by default

@@ -119,7 +119,7 @@ t3:

 	${TEST_SSH_SSHKEYGEN} -if $(OBJ)/t3.out | diff - ${.CURDIR}/rsa_openssh.pub

 t4:

-	${TEST_SSH_SSHKEYGEN} -lf ${.CURDIR}/rsa_openssh.pub |\

+	${TEST_SSH_SSHKEYGEN} -E md5 -lf ${.CURDIR}/rsa_openssh.pub |\

 		awk '{print $$2}' | diff - ${.CURDIR}/t4.ok

 t5:

@@ -164,6 +164,10 @@ t10: $(OBJ)/t10.out

 	${TEST_SSH_SSHKEYGEN} -lf $(OBJ)/t10.out > /dev/null

 	${TEST_SSH_SSHKEYGEN} -Bf $(OBJ)/t10.out > /dev/null

+t11:

+	${TEST_SSH_SSHKEYGEN} -E sha256 -lf ${.CURDIR}/rsa_openssh.pub |\

+		awk '{print $$2}' | diff - ${.CURDIR}/t11.ok

+

 t-exec:	${LTESTS:=.sh}

 	@if [ "x$?" = "x" ]; then exit 0; fi; \

 	for TEST in ""$?; do \

diff --git a/regress/t11.ok b/regress/t11.ok

new file mode 100644

index 0000000..1925bb4

--- /dev/null

+++ b/regress/t11.ok

@@ -0,0 +1 @@

+SHA256:4w1rnrek3klTJOTVhwuCIFd5k+pq9Bfo5KTxxb8BqbY

diff --git a/regress/t4.ok b/regress/t4.ok

index 8c4942b..4631ea8 100644

--- a/regress/t4.ok

+++ b/regress/t4.ok

@@ -1 +1 @@

-3b:dd:44:e9:49:18:84:95:f1:e7:33:6b:9d:93:b1:36

+MD5:3b:dd:44:e9:49:18:84:95:f1:e7:33:6b:9d:93:b1:36

diff --git a/regress/unittests/sshkey/test_file.c b/regress/unittests/sshkey/test_file.c

index 764f7fb..9c38a7c 100644

--- a/regress/unittests/sshkey/test_file.c

+++ b/regress/unittests/sshkey/test_file.c

@@ -1,4 +1,4 @@

-/* 	$OpenBSD: test_file.c,v 1.1 2014/06/24 01:14:18 djm Exp $ */

+/* 	$OpenBSD: test_file.c,v 1.2 2014/12/22 02:15:52 djm Exp $ */

 /*

  * Regress test for sshkey.h key management API

  *

@@ -33,6 +33,7 @@

 #include "authfile.h"

 #include "sshkey.h"

 #include "sshbuf.h"

+#include "digest.h"

 #include "common.h"

@@ -81,7 +82,7 @@ sshkey_file_tests(void)

 	TEST_START("RSA1 key hex fingerprint");

 	buf = load_text_file("rsa1_1.fp");

-	cp = sshkey_fingerprint(k1, SSH_FP_MD5, SSH_FP_HEX);

+	cp = sshkey_fingerprint(k1, SSH_DIGEST_MD5, SSH_FP_HEX);

 	ASSERT_PTR_NE(cp, NULL);

 	ASSERT_STRING_EQ(cp, (const char *)sshbuf_ptr(buf));

 	sshbuf_free(buf);

@@ -90,7 +91,7 @@ sshkey_file_tests(void)

 	TEST_START("RSA1 key bubblebabble fingerprint");

 	buf = load_text_file("rsa1_1.fp.bb");

-	cp = sshkey_fingerprint(k1, SSH_FP_SHA1, SSH_FP_BUBBLEBABBLE);

+	cp = sshkey_fingerprint(k1, SSH_DIGEST_SHA1, SSH_FP_BUBBLEBABBLE);

 	ASSERT_PTR_NE(cp, NULL);

 	ASSERT_STRING_EQ(cp, (const char *)sshbuf_ptr(buf));

 	sshbuf_free(buf);

@@ -164,7 +165,7 @@ sshkey_file_tests(void)

 	TEST_START("RSA key hex fingerprint");

 	buf = load_text_file("rsa_1.fp");

-	cp = sshkey_fingerprint(k1, SSH_FP_MD5, SSH_FP_HEX);

+	cp = sshkey_fingerprint(k1, SSH_DIGEST_MD5, SSH_FP_HEX);

 	ASSERT_PTR_NE(cp, NULL);

 	ASSERT_STRING_EQ(cp, (const char *)sshbuf_ptr(buf));

 	sshbuf_free(buf);

@@ -173,7 +174,7 @@ sshkey_file_tests(void)

 	TEST_START("RSA cert hex fingerprint");

 	buf = load_text_file("rsa_1-cert.fp");

-	cp = sshkey_fingerprint(k2, SSH_FP_MD5, SSH_FP_HEX);

+	cp = sshkey_fingerprint(k2, SSH_DIGEST_MD5, SSH_FP_HEX);

 	ASSERT_PTR_NE(cp, NULL);

 	ASSERT_STRING_EQ(cp, (const char *)sshbuf_ptr(buf));

 	sshbuf_free(buf);

@@ -183,7 +184,7 @@ sshkey_file_tests(void)

 	TEST_START("RSA key bubblebabble fingerprint");

 	buf = load_text_file("rsa_1.fp.bb");

-	cp = sshkey_fingerprint(k1, SSH_FP_SHA1, SSH_FP_BUBBLEBABBLE);

+	cp = sshkey_fingerprint(k1, SSH_DIGEST_SHA1, SSH_FP_BUBBLEBABBLE);

 	ASSERT_PTR_NE(cp, NULL);

 	ASSERT_STRING_EQ(cp, (const char *)sshbuf_ptr(buf));

 	sshbuf_free(buf);

@@ -257,7 +258,7 @@ sshkey_file_tests(void)

 	TEST_START("DSA key hex fingerprint");

 	buf = load_text_file("dsa_1.fp");

-	cp = sshkey_fingerprint(k1, SSH_FP_MD5, SSH_FP_HEX);

+	cp = sshkey_fingerprint(k1, SSH_DIGEST_MD5, SSH_FP_HEX);

 	ASSERT_PTR_NE(cp, NULL);

 	ASSERT_STRING_EQ(cp, (const char *)sshbuf_ptr(buf));

 	sshbuf_free(buf);

@@ -266,7 +267,7 @@ sshkey_file_tests(void)

 	TEST_START("DSA cert hex fingerprint");

 	buf = load_text_file("dsa_1-cert.fp");

-	cp = sshkey_fingerprint(k2, SSH_FP_MD5, SSH_FP_HEX);

+	cp = sshkey_fingerprint(k2, SSH_DIGEST_MD5, SSH_FP_HEX);

 	ASSERT_PTR_NE(cp, NULL);

 	ASSERT_STRING_EQ(cp, (const char *)sshbuf_ptr(buf));

 	sshbuf_free(buf);

@@ -276,7 +277,7 @@ sshkey_file_tests(void)

 	TEST_START("DSA key bubblebabble fingerprint");

 	buf = load_text_file("dsa_1.fp.bb");

-	cp = sshkey_fingerprint(k1, SSH_FP_SHA1, SSH_FP_BUBBLEBABBLE);

+	cp = sshkey_fingerprint(k1, SSH_DIGEST_SHA1, SSH_FP_BUBBLEBABBLE);

 	ASSERT_PTR_NE(cp, NULL);

 	ASSERT_STRING_EQ(cp, (const char *)sshbuf_ptr(buf));

 	sshbuf_free(buf);

@@ -357,7 +358,7 @@ sshkey_file_tests(void)

 	TEST_START("ECDSA key hex fingerprint");

 	buf = load_text_file("ecdsa_1.fp");

-	cp = sshkey_fingerprint(k1, SSH_FP_MD5, SSH_FP_HEX);

+	cp = sshkey_fingerprint(k1, SSH_DIGEST_MD5, SSH_FP_HEX);

 	ASSERT_PTR_NE(cp, NULL);

 	ASSERT_STRING_EQ(cp, (const char *)sshbuf_ptr(buf));

 	sshbuf_free(buf);

@@ -366,7 +367,7 @@ sshkey_file_tests(void)

 	TEST_START("ECDSA cert hex fingerprint");

 	buf = load_text_file("ecdsa_1-cert.fp");

-	cp = sshkey_fingerprint(k2, SSH_FP_MD5, SSH_FP_HEX);

+	cp = sshkey_fingerprint(k2, SSH_DIGEST_MD5, SSH_FP_HEX);

 	ASSERT_PTR_NE(cp, NULL);

 	ASSERT_STRING_EQ(cp, (const char *)sshbuf_ptr(buf));

 	sshbuf_free(buf);

@@ -376,7 +377,7 @@ sshkey_file_tests(void)

 	TEST_START("ECDSA key bubblebabble fingerprint");

 	buf = load_text_file("ecdsa_1.fp.bb");

-	cp = sshkey_fingerprint(k1, SSH_FP_SHA1, SSH_FP_BUBBLEBABBLE);

+	cp = sshkey_fingerprint(k1, SSH_DIGEST_SHA1, SSH_FP_BUBBLEBABBLE);

 	ASSERT_PTR_NE(cp, NULL);

 	ASSERT_STRING_EQ(cp, (const char *)sshbuf_ptr(buf));

 	sshbuf_free(buf);

@@ -424,7 +425,7 @@ sshkey_file_tests(void)

 	TEST_START("Ed25519 key hex fingerprint");

 	buf = load_text_file("ed25519_1.fp");

-	cp = sshkey_fingerprint(k1, SSH_FP_MD5, SSH_FP_HEX);

+	cp = sshkey_fingerprint(k1, SSH_DIGEST_MD5, SSH_FP_HEX);

 	ASSERT_PTR_NE(cp, NULL);

 	ASSERT_STRING_EQ(cp, (const char *)sshbuf_ptr(buf));

 	sshbuf_free(buf);

@@ -433,7 +434,7 @@ sshkey_file_tests(void)

 	TEST_START("Ed25519 cert hex fingerprint");

 	buf = load_text_file("ed25519_1-cert.fp");

-	cp = sshkey_fingerprint(k2, SSH_FP_MD5, SSH_FP_HEX);

+	cp = sshkey_fingerprint(k2, SSH_DIGEST_MD5, SSH_FP_HEX);

 	ASSERT_PTR_NE(cp, NULL);

 	ASSERT_STRING_EQ(cp, (const char *)sshbuf_ptr(buf));

 	sshbuf_free(buf);

@@ -443,7 +444,7 @@ sshkey_file_tests(void)

 	TEST_START("Ed25519 key bubblebabble fingerprint");

 	buf = load_text_file("ed25519_1.fp.bb");

-	cp = sshkey_fingerprint(k1, SSH_FP_SHA1, SSH_FP_BUBBLEBABBLE);

+	cp = sshkey_fingerprint(k1, SSH_DIGEST_SHA1, SSH_FP_BUBBLEBABBLE);

 	ASSERT_PTR_NE(cp, NULL);

 	ASSERT_STRING_EQ(cp, (const char *)sshbuf_ptr(buf));

 	sshbuf_free(buf);

diff --git a/regress/unittests/sshkey/testdata/dsa_1-cert.fp b/regress/unittests/sshkey/testdata/dsa_1-cert.fp

index 56ee1f8..b26145b 100644

--- a/regress/unittests/sshkey/testdata/dsa_1-cert.fp

+++ b/regress/unittests/sshkey/testdata/dsa_1-cert.fp

@@ -1 +1 @@

-5a:4a:41:8c:4e:fa:4c:52:19:f9:39:49:31:fb:fd:74

+MD5:5a:4a:41:8c:4e:fa:4c:52:19:f9:39:49:31:fb:fd:74

diff --git a/regress/unittests/sshkey/testdata/dsa_1.fp b/regress/unittests/sshkey/testdata/dsa_1.fp

index 56ee1f8..b26145b 100644

--- a/regress/unittests/sshkey/testdata/dsa_1.fp

+++ b/regress/unittests/sshkey/testdata/dsa_1.fp

@@ -1 +1 @@

-5a:4a:41:8c:4e:fa:4c:52:19:f9:39:49:31:fb:fd:74

+MD5:5a:4a:41:8c:4e:fa:4c:52:19:f9:39:49:31:fb:fd:74

diff --git a/regress/unittests/sshkey/testdata/dsa_2.fp b/regress/unittests/sshkey/testdata/dsa_2.fp

index ba9de82..8226574 100644

--- a/regress/unittests/sshkey/testdata/dsa_2.fp

+++ b/regress/unittests/sshkey/testdata/dsa_2.fp

@@ -1 +1 @@

-72:5f:50:6b:e5:64:c5:62:21:92:3f:8b:10:9b:9f:1a

+MD5:72:5f:50:6b:e5:64:c5:62:21:92:3f:8b:10:9b:9f:1a

diff --git a/regress/unittests/sshkey/testdata/ecdsa_1-cert.fp b/regress/unittests/sshkey/testdata/ecdsa_1-cert.fp

index a56dbc8..c3d747a 100644

--- a/regress/unittests/sshkey/testdata/ecdsa_1-cert.fp

+++ b/regress/unittests/sshkey/testdata/ecdsa_1-cert.fp

@@ -1 +1 @@

-f7:be:4c:02:65:ed:4c:11:af:ab:a8:dd:0a:92:e7:44

+MD5:f7:be:4c:02:65:ed:4c:11:af:ab:a8:dd:0a:92:e7:44

diff --git a/regress/unittests/sshkey/testdata/ecdsa_1.fp b/regress/unittests/sshkey/testdata/ecdsa_1.fp

index a56dbc8..c3d747a 100644

--- a/regress/unittests/sshkey/testdata/ecdsa_1.fp

+++ b/regress/unittests/sshkey/testdata/ecdsa_1.fp

@@ -1 +1 @@

-f7:be:4c:02:65:ed:4c:11:af:ab:a8:dd:0a:92:e7:44

+MD5:f7:be:4c:02:65:ed:4c:11:af:ab:a8:dd:0a:92:e7:44

diff --git a/regress/unittests/sshkey/testdata/ecdsa_2.fp b/regress/unittests/sshkey/testdata/ecdsa_2.fp

index eb4bbdf..fe7526b 100644

--- a/regress/unittests/sshkey/testdata/ecdsa_2.fp

+++ b/regress/unittests/sshkey/testdata/ecdsa_2.fp

@@ -1 +1 @@

-51:bd:ff:2b:6d:26:9b:90:f9:e1:4a:ca:a0:29:8e:70

+MD5:51:bd:ff:2b:6d:26:9b:90:f9:e1:4a:ca:a0:29:8e:70

diff --git a/regress/unittests/sshkey/testdata/ed25519_1-cert.fp b/regress/unittests/sshkey/testdata/ed25519_1-cert.fp

index e6d23d0..fbde87a 100644

--- a/regress/unittests/sshkey/testdata/ed25519_1-cert.fp

+++ b/regress/unittests/sshkey/testdata/ed25519_1-cert.fp

@@ -1 +1 @@

-19:08:8e:7e:4d:e5:de:86:2a:09:47:65:eb:0a:51:2f

+MD5:19:08:8e:7e:4d:e5:de:86:2a:09:47:65:eb:0a:51:2f

diff --git a/regress/unittests/sshkey/testdata/ed25519_1.fp b/regress/unittests/sshkey/testdata/ed25519_1.fp

index e6d23d0..fbde87a 100644

--- a/regress/unittests/sshkey/testdata/ed25519_1.fp

+++ b/regress/unittests/sshkey/testdata/ed25519_1.fp

@@ -1 +1 @@

-19:08:8e:7e:4d:e5:de:86:2a:09:47:65:eb:0a:51:2f

+MD5:19:08:8e:7e:4d:e5:de:86:2a:09:47:65:eb:0a:51:2f

diff --git a/regress/unittests/sshkey/testdata/ed25519_2.fp b/regress/unittests/sshkey/testdata/ed25519_2.fp

index 02c684f..ec1cdbb 100644

--- a/regress/unittests/sshkey/testdata/ed25519_2.fp

+++ b/regress/unittests/sshkey/testdata/ed25519_2.fp

@@ -1 +1 @@

-5c:c9:ae:a3:0c:aa:28:29:b8:fc:7c:64:ba:6e:e9:c9

+MD5:5c:c9:ae:a3:0c:aa:28:29:b8:fc:7c:64:ba:6e:e9:c9

diff --git a/regress/unittests/sshkey/testdata/rsa1_1.fp b/regress/unittests/sshkey/testdata/rsa1_1.fp

index 782ece0..2e1068c 100644

--- a/regress/unittests/sshkey/testdata/rsa1_1.fp

+++ b/regress/unittests/sshkey/testdata/rsa1_1.fp

@@ -1 +1 @@

-a8:82:9b:98:c5:e6:19:d6:83:39:9f:4d:3a:8f:7c:80

+MD5:a8:82:9b:98:c5:e6:19:d6:83:39:9f:4d:3a:8f:7c:80

diff --git a/regress/unittests/sshkey/testdata/rsa1_2.fp b/regress/unittests/sshkey/testdata/rsa1_2.fp

index c332537..cd00393 100644

--- a/regress/unittests/sshkey/testdata/rsa1_2.fp

+++ b/regress/unittests/sshkey/testdata/rsa1_2.fp

@@ -1 +1 @@

-c0:83:1c:97:5f:32:77:7e:e4:e3:e9:29:b9:eb:76:9c

+MD5:c0:83:1c:97:5f:32:77:7e:e4:e3:e9:29:b9:eb:76:9c

diff --git a/regress/unittests/sshkey/testdata/rsa_1-cert.fp b/regress/unittests/sshkey/testdata/rsa_1-cert.fp

index bf9c2e3..1cf780d 100644

--- a/regress/unittests/sshkey/testdata/rsa_1-cert.fp

+++ b/regress/unittests/sshkey/testdata/rsa_1-cert.fp

@@ -1 +1 @@

-be:27:4c:16:27:f5:04:03:62:a8:b7:91:df:a5:b1:3b

+MD5:be:27:4c:16:27:f5:04:03:62:a8:b7:91:df:a5:b1:3b

diff --git a/regress/unittests/sshkey/testdata/rsa_1.fp b/regress/unittests/sshkey/testdata/rsa_1.fp

index bf9c2e3..1cf780d 100644

--- a/regress/unittests/sshkey/testdata/rsa_1.fp

+++ b/regress/unittests/sshkey/testdata/rsa_1.fp

@@ -1 +1 @@

-be:27:4c:16:27:f5:04:03:62:a8:b7:91:df:a5:b1:3b

+MD5:be:27:4c:16:27:f5:04:03:62:a8:b7:91:df:a5:b1:3b

diff --git a/regress/unittests/sshkey/testdata/rsa_2.fp b/regress/unittests/sshkey/testdata/rsa_2.fp

index 53939f4..8d43676 100644

--- a/regress/unittests/sshkey/testdata/rsa_2.fp

+++ b/regress/unittests/sshkey/testdata/rsa_2.fp

@@ -1 +1 @@

-fb:8f:7b:26:3d:42:40:ef:ed:f1:ed:ee:66:9e:ba:b0

+MD5:fb:8f:7b:26:3d:42:40:ef:ed:f1:ed:ee:66:9e:ba:b0

diff --git a/servconf.c b/servconf.c

index b7f3294..e3ebaac 100644

--- a/servconf.c

+++ b/servconf.c

@@ -54,6 +54,7 @@

 #include "packet.h"

 #include "hostfile.h"

 #include "auth.h"

+#include "digest.h"

 static void add_listen_addr(ServerOptions *, char *, int);

 static void add_one_listen_addr(ServerOptions *, char *, int);

@@ -157,6 +158,7 @@ initialize_server_options(ServerOptions *options)

 	options->ip_qos_interactive = -1;

 	options->ip_qos_bulk = -1;

 	options->version_addendum = NULL;

+	options->fingerprint_hash = -1;

 }

 void

@@ -312,6 +314,8 @@ fill_default_server_options(ServerOptions *options)

 		options->fwd_opts.streamlocal_bind_mask = 0177;

 	if (options->fwd_opts.streamlocal_bind_unlink == -1)

 		options->fwd_opts.streamlocal_bind_unlink = 0;

+	if (options->fingerprint_hash == -1)

+		options->fingerprint_hash = SSH_FP_HASH_DEFAULT;

 	/* Turn privilege separation on by default */

 	if (use_privsep == -1)

 		use_privsep = PRIVSEP_NOSANDBOX;

@@ -361,7 +365,7 @@ typedef enum {

 	sAuthorizedKeysCommand, sAuthorizedKeysCommandUser,

 	sAuthenticationMethods, sHostKeyAgent, sPermitUserRC,

 	sStreamLocalBindMask, sStreamLocalBindUnlink,

-	sAllowStreamLocalForwarding,

+	sAllowStreamLocalForwarding, sFingerprintHash,

 	sDeprecated, sUnsupported

 } ServerOpCodes;

@@ -492,6 +496,7 @@ static struct {

 	{ "streamlocalbindmask", sStreamLocalBindMask, SSHCFG_ALL },

 	{ "streamlocalbindunlink", sStreamLocalBindUnlink, SSHCFG_ALL },

 	{ "allowstreamlocalforwarding", sAllowStreamLocalForwarding, SSHCFG_ALL },

+	{ "fingerprinthash", sFingerprintHash, SSHCFG_GLOBAL },

 	{ NULL, sBadOption, 0 }

 };

@@ -1663,6 +1668,18 @@ process_server_config_line(ServerOptions *options, char *line,

 		intptr = &options->fwd_opts.streamlocal_bind_unlink;

 		goto parse_flag;

+	case sFingerprintHash:

+		arg = strdelim(&cp;;

+		if (!arg || *arg == '\0')

+			fatal("%.200s line %d: Missing argument.",

+			    filename, linenum);

+		if ((value = ssh_digest_alg_by_name(arg)) == -1)

+			fatal("%.200s line %d: Invalid hash algorithm \"%s\".",

+			    filename, linenum, arg);

+		if (*activep)

+			options->fingerprint_hash = value;

+		break;

+

 	case sDeprecated:

 		logit("%s line %d: Deprecated option %s",

 		    filename, linenum, arg);

@@ -1905,6 +1922,8 @@ fmt_intarg(ServerOpCodes code, int val)

 		return fmt_multistate_int(val, multistate_tcpfwd);

 	case sAllowStreamLocalForwarding:

 		return fmt_multistate_int(val, multistate_tcpfwd);

+	case sFingerprintHash:

+		return ssh_digest_alg_name(val);

 	case sProtocol:

 		switch (val) {

 		case SSH_PROTO_1:

@@ -2066,6 +2085,7 @@ dump_config(ServerOptions *o)

 	dump_cfg_fmtint(sAllowTcpForwarding, o->allow_tcp_forwarding);

 	dump_cfg_fmtint(sAllowStreamLocalForwarding, o->allow_streamlocal_forwarding);

 	dump_cfg_fmtint(sUsePrivilegeSeparation, use_privsep);

+	dump_cfg_fmtint(sFingerprintHash, o->fingerprint_hash);

 	/* string arguments */

 	dump_cfg_string(sPidFile, o->pid_file);

diff --git a/servconf.h b/servconf.h

index 766db3a..49b228b 100644

--- a/servconf.h

+++ b/servconf.h

@@ -1,4 +1,4 @@

-/* $OpenBSD: servconf.h,v 1.114 2014/07/15 15:54:14 millert Exp $ */

+/* $OpenBSD: servconf.h,v 1.115 2014/12/21 22:27:56 djm Exp $ */

 /*

  * Author: Tatu Ylonen <ylo@cs.hut.fi>

@@ -185,6 +185,8 @@ typedef struct {

 	u_int	num_auth_methods;

 	char   *auth_methods[MAX_AUTH_METHODS];

+

+	int	fingerprint_hash;

 }       ServerOptions;

 /* Information about the incoming connection as used by Match */

diff --git a/ssh-add.1 b/ssh-add.1

index 4812448..04d1840 100644

--- a/ssh-add.1

+++ b/ssh-add.1

@@ -44,6 +44,7 @@

 .Sh SYNOPSIS

 .Nm ssh-add

 .Op Fl cDdkLlXx

+.Op Fl E Ar fingerprint_hash

 .Op Fl t Ar life

 .Op Ar

 .Nm ssh-add

@@ -108,6 +109,14 @@ If no public key is found at a given path,

 will append

 .Pa .pub

 and retry.

+.It Fl E Ar fingerprint_hash

+Specifies the hash algorithm used when displaying key fingerprints.

+Valid options are:

+.Dq md5

+and

+.Dq sha256 .

+The default is

+.Dq sha256 .

 .It Fl e Ar pkcs11

 Remove keys provided by the PKCS#11 shared library

 .Ar pkcs11 .

diff --git a/ssh-add.c b/ssh-add.c

index 78a3359..5d6a5f4 100644

--- a/ssh-add.c

+++ b/ssh-add.c

@@ -63,6 +63,7 @@

 #include "pathnames.h"

 #include "misc.h"

 #include "ssherr.h"

+#include "digest.h"

 /* argv0 */

 extern char *__progname;

@@ -79,6 +80,8 @@ static char *default_files[] = {

 	NULL

 };

+static int fingerprint_hash = SSH_FP_HASH_DEFAULT;

+

 /* Default lifetime (0 == forever) */

 static int lifetime = 0;

@@ -340,8 +343,8 @@ list_identities(AuthenticationConnection *ac, int do_fp)

 		    key = ssh_get_next_identity(ac, &comment, version)) {

 			had_identities = 1;

 			if (do_fp) {

-				fp = key_fingerprint(key, SSH_FP_MD5,

-				    SSH_FP_HEX);

+				fp = key_fingerprint(key, fingerprint_hash,

+				    SSH_FP_DEFAULT);

 				printf("%d %s %s (%s)\n",

 				    key_size(key), fp, comment, key_type(key));

 				free(fp);

@@ -408,6 +411,7 @@ usage(void)

 	fprintf(stderr, "usage: %s [options] [file ...]\n", __progname);

 	fprintf(stderr, "Options:\n");

 	fprintf(stderr, "  -l          List fingerprints of all identities.\n");

+	fprintf(stderr, "  -E hash     Specify hash algorithm used for fingerprints.\n");

 	fprintf(stderr, "  -L          List public key parameters of all identities.\n");

 	fprintf(stderr, "  -k          Load only keys and not certificates.\n");

 	fprintf(stderr, "  -c          Require confirmation to sign using identities\n");

@@ -428,6 +432,7 @@ main(int argc, char **argv)

 	AuthenticationConnection *ac = NULL;

 	char *pkcs11provider = NULL;

 	int i, ch, deleting = 0, ret = 0, key_only = 0;

+	int xflag = 0, lflag = 0, Dflag = 0;

 	/* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */

 	sanitise_stdfd();

@@ -446,21 +451,28 @@ main(int argc, char **argv)

 		    "Could not open a connection to your authentication agent.\n");

 		exit(2);

 	}

-	while ((ch = getopt(argc, argv, "klLcdDxXe:s:t:")) != -1) {

+	while ((ch = getopt(argc, argv, "klLcdDxXE:e:s:t:")) != -1) {

 		switch (ch) {

+		case 'E':

+			fingerprint_hash = ssh_digest_alg_by_name(optarg);

+			if (fingerprint_hash == -1)

+				fatal("Invalid hash algorithm \"%s\"", optarg);

+			break;