diff options
author | djm@openbsd.org <djm@openbsd.org> | 2017-05-16 16:54:05 +0000 |
---|---|---|
committer | Damien Miller <djm@mindrot.org> | 2017-05-17 11:25:22 +1000 |
commit | adb47ce839c977fa197e770c1be8f852508d65aa (patch) | |
tree | e09a8ffbfd0db1c997e267183c4e40dca746f921 | |
parent | 6bdf70f01e700348bb4d8c064c31a0ab90896df6 (diff) |
upstream commit
mention that Ed25519 keys are valid as CA keys; spotted
by Jakub Jelen
Upstream-ID: d3f6db58b30418cb1c3058211b893a1ffed3dfd4
-rw-r--r-- | PROTOCOL.certkeys | 15 |
1 files changed, 8 insertions, 7 deletions
diff --git a/PROTOCOL.certkeys b/PROTOCOL.certkeys index aa6f5ae4c..734b606bb 100644 --- a/PROTOCOL.certkeys +++ b/PROTOCOL.certkeys | |||
@@ -192,12 +192,13 @@ compatibility. | |||
192 | The reserved field is currently unused and is ignored in this version of | 192 | The reserved field is currently unused and is ignored in this version of |
193 | the protocol. | 193 | the protocol. |
194 | 194 | ||
195 | signature key contains the CA key used to sign the certificate. | 195 | The signature key field contains the CA key used to sign the |
196 | The valid key types for CA keys are ssh-rsa, ssh-dss and the ECDSA types | 196 | certificate. The valid key types for CA keys are ssh-rsa, |
197 | ecdsa-sha2-nistp256, ecdsa-sha2-nistp384, ecdsa-sha2-nistp521. "Chained" | 197 | ssh-dss, ssh-ed25519 and the ECDSA types ecdsa-sha2-nistp256, |
198 | certificates, where the signature key type is a certificate type itself | 198 | ecdsa-sha2-nistp384, ecdsa-sha2-nistp521. "Chained" certificates, where |
199 | are NOT supported. Note that it is possible for a RSA certificate key to | 199 | the signature key type is a certificate type itself are NOT supported. |
200 | be signed by a DSS or ECDSA CA key and vice-versa. | 200 | Note that it is possible for a RSA certificate key to be signed by a |
201 | Ed25519 or ECDSA CA key and vice-versa. | ||
201 | 202 | ||
202 | signature is computed over all preceding fields from the initial string | 203 | signature is computed over all preceding fields from the initial string |
203 | up to, and including the signature key. Signatures are computed and | 204 | up to, and including the signature key. Signatures are computed and |
@@ -284,4 +285,4 @@ permit-user-rc empty Flag indicating that execution of | |||
284 | of this script will not be permitted if | 285 | of this script will not be permitted if |
285 | this option is not present. | 286 | this option is not present. |
286 | 287 | ||
287 | $OpenBSD: PROTOCOL.certkeys,v 1.10 2016/05/03 10:27:59 djm Exp $ | 288 | $OpenBSD: PROTOCOL.certkeys,v 1.11 2017/05/16 16:54:05 djm Exp $ |