upstream commit

refuse to generate or accept RSA keys smaller than 1024
 bits; feedback and ok dtucker@

Upstream-ID: 7ea3d31271366ba264f06e34a3539bf1ac30f0ba

1 files changed, 3 insertions, 3 deletions

diff --git a/ssh-keygen.c b/ssh-keygen.c
index b546366f1..ea5f1e49e 100644
--- a/ssh-keygen.c
+++ b/ssh-keygen.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-keygen.c,v 1.275 2015/07/03 03:43:18 djm Exp $ */
+/* $OpenBSD: ssh-keygen.c,v 1.276 2015/07/03 03:49:45 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1994 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -217,8 +217,8 @@ type_bits_valid(int type, const char *name, u_int32_t *bitsp)
                 fatal("key bits exceeds maximum %d", maxbits);
         if (type == KEY_DSA && *bitsp != 1024)
                 fatal("DSA keys must be 1024 bits");
-        else if (type != KEY_ECDSA && type != KEY_ED25519 && *bitsp < 768)
-                fatal("Key must at least be 768 bits");
+        else if (type != KEY_ECDSA && type != KEY_ED25519 && *bitsp < 1024)
+                fatal("Key must at least be 1024 bits");
         else if (type == KEY_ECDSA && sshkey_ecdsa_bits_to_nid(*bitsp) == -1)
                 fatal("Invalid ECDSA key length - valid lengths are "
                     "256, 384 or 521 bits");