diff options
author | djm@openbsd.org <djm@openbsd.org> | 2019-05-20 00:20:35 +0000 |
---|---|---|
committer | Damien Miller <djm@mindrot.org> | 2019-05-20 10:21:58 +1000 |
commit | 476e3551b2952ef73acc43d995e832539bf9bc4d (patch) | |
tree | 326f23ca0f27d7fd4242ce88892d0af9a2da2c3c /sshkey.c | |
parent | 606077ee1e77af5908431d003fb28461ef7be092 (diff) |
upstream: When signing certificates with an RSA key, default to
using the rsa-sha2-512 signature algorithm. Certificates signed by RSA keys
will therefore be incompatible with OpenSSH < 7.2 unless the default is
overridden.
Document the ability of the ssh-keygen -t flag to override the
signature algorithm when signing certificates, and the new default.
ok deraadt@
OpenBSD-Commit-ID: 400c9c15013978204c2cb80f294b03ae4cfc8b95
Diffstat (limited to 'sshkey.c')
-rw-r--r-- | sshkey.c | 9 |
1 files changed, 8 insertions, 1 deletions
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: sshkey.c,v 1.74 2019/05/03 03:25:18 dtucker Exp $ */ | 1 | /* $OpenBSD: sshkey.c,v 1.75 2019/05/20 00:20:35 djm Exp $ */ |
2 | /* | 2 | /* |
3 | * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved. | 3 | * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved. |
4 | * Copyright (c) 2008 Alexander von Gernler. All rights reserved. | 4 | * Copyright (c) 2008 Alexander von Gernler. All rights reserved. |
@@ -2528,6 +2528,13 @@ sshkey_certify_custom(struct sshkey *k, struct sshkey *ca, const char *alg, | |||
2528 | strcmp(alg, k->cert->signature_type) != 0) | 2528 | strcmp(alg, k->cert->signature_type) != 0) |
2529 | return SSH_ERR_INVALID_ARGUMENT; | 2529 | return SSH_ERR_INVALID_ARGUMENT; |
2530 | 2530 | ||
2531 | /* | ||
2532 | * If no signing algorithm or signature_type was specified and we're | ||
2533 | * using a RSA key, then default to a good signature algorithm. | ||
2534 | */ | ||
2535 | if (alg == NULL && ca->type == KEY_RSA) | ||
2536 | alg = "rsa-sha2-512"; | ||
2537 | |||
2531 | if ((ret = sshkey_to_blob(ca, &ca_blob, &ca_len)) != 0) | 2538 | if ((ret = sshkey_to_blob(ca, &ca_blob, &ca_len)) != 0) |
2532 | return SSH_ERR_KEY_CERT_INVALID_SIGN_KEY; | 2539 | return SSH_ERR_KEY_CERT_INVALID_SIGN_KEY; |
2533 | 2540 | ||