upstream: finally remove DSA signature support from OpenSSH.

feedback/ok tb@, ok deraadt@

OpenBSD-Commit-ID: bfe6ee73c1b676c81a2901030c791f8ec888228f

diff --git a/.depend b/.depend
index 975d4427a2fbae2671e74d27e95d3a118e1fd91d..3e64eb84a6a59acf3bbb8d9e8c51144f4401a593 100644 (file)
--- a/.depend
+++ b/.depend
@@ -79,7 +79,7 @@ loginrec.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-comp
 logintest.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h loginrec.h
 mac.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h digest.h hmac.h umac.h mac.h misc.h ssherr.h sshbuf.h openbsd-compat/openssl-compat.h
 match.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h xmalloc.h match.h misc.h
-misc-agent.o: digest.h log.h ssherr.h misc.h pathnames.h ssh.h xmalloc.h
+misc-agent.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h digest.h log.h ssherr.h misc.h pathnames.h ssh.h xmalloc.h
 misc.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h xmalloc.h misc.h log.h ssherr.h ssh.h sshbuf.h
 moduli.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h
 monitor.o: chacha.h poly1305.h cipher-aesctr.h rijndael.h kex.h mac.h crypto_api.h dh.h packet.h dispatch.h auth-options.h sshpty.h channels.h session.h sshlogin.h canohost.h log.h ssherr.h misc.h servconf.h monitor.h monitor_wrap.h monitor_fdpass.h compat.h ssh2.h authfd.h match.h sk-api.h srclimit.h
@@ -129,7 +129,6 @@ sntrup761.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-com
 srclimit.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h ./openbsd-compat/sys-tree.h addr.h canohost.h log.h ssherr.h misc.h srclimit.h xmalloc.h servconf.h openbsd-compat/sys-queue.h match.h
 ssh-add.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h xmalloc.h ssh.h log.h ssherr.h sshkey.h sshbuf.h authfd.h authfile.h pathnames.h misc.h digest.h ssh-sk.h sk-api.h hostfile.h
 ssh-agent.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h openbsd-compat/sys-queue.h xmalloc.h ssh.h ssh2.h sshbuf.h sshkey.h authfd.h log.h ssherr.h misc.h digest.h match.h msg.h pathnames.h ssh-pkcs11.h sk-api.h myproposal.h
-ssh-dss.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h
 ssh-ecdsa-sk.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h openbsd-compat/openssl-compat.h sshbuf.h ssherr.h digest.h sshkey.h
 ssh-ecdsa.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h
 ssh-ed25519-sk.o: includes.h config.h defines.h platform.h openbsd-compat/openbsd-compat.h openbsd-compat/base64.h openbsd-compat/sigact.h openbsd-compat/readpassphrase.h openbsd-compat/vis.h openbsd-compat/getrrsetbyname.h openbsd-compat/sha1.h openbsd-compat/sha2.h openbsd-compat/md5.h openbsd-compat/blf.h openbsd-compat/fnmatch.h openbsd-compat/getopt.h openbsd-compat/bsd-signal.h openbsd-compat/bsd-misc.h openbsd-compat/bsd-setres_id.h openbsd-compat/bsd-statvfs.h openbsd-compat/bsd-waitpid.h openbsd-compat/bsd-poll.h openbsd-compat/fake-rfc2553.h openbsd-compat/bsd-cygwin_util.h openbsd-compat/port-aix.h openbsd-compat/port-irix.h openbsd-compat/port-linux.h openbsd-compat/port-solaris.h openbsd-compat/port-net.h openbsd-compat/port-uw.h openbsd-compat/bsd-nextstep.h entropy.h crypto_api.h log.h ssherr.h sshbuf.h sshkey.h ssh.h digest.h

diff --git a/Makefile.in b/Makefile.in
index 4550e17951f4a6fb274d2573884cb8236b28fa9e..ae86a712b17ba2c0512e3424d9b9eef643165ac4 100644 (file)
--- a/Makefile.in
+++ b/Makefile.in
@@ -105,7 +105,7 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
        log.o match.o moduli.o nchan.o packet.o \
        readpass.o ttymodes.o xmalloc.o addr.o addrmatch.o \
        atomicio.o dispatch.o mac.o misc.o utf8.o \
-       monitor_fdpass.o rijndael.o ssh-dss.o ssh-ecdsa.o ssh-ecdsa-sk.o \
+       monitor_fdpass.o rijndael.o ssh-ecdsa.o ssh-ecdsa-sk.o \
        ssh-ed25519-sk.o ssh-rsa.o dh.o \
        msg.o progressmeter.o dns.o entropy.o gss-genr.o umac.o umac128.o \
        ssh-pkcs11.o smult_curve25519_ref.o \

diff --git a/PROTOCOL b/PROTOCOL
index a0a9837efe3eaeee26bdbad6ccbb6ae394273edd..f99173c527b7154ef825658edcc93b142ce3c398 100644 (file)
--- a/PROTOCOL
+++ b/PROTOCOL
@@ -34,7 +34,6 @@ The method is documented in:
 https://www.openssh.com/txt/draft-miller-secsh-compression-delayed-00.txt
 
 1.3. transport: New public key algorithms "ssh-rsa-cert-v01@openssh.com",
-     "ssh-dsa-cert-v01@openssh.com",
      "ecdsa-sha2-nistp256-cert-v01@openssh.com",
      "ecdsa-sha2-nistp384-cert-v01@openssh.com" and
      "ecdsa-sha2-nistp521-cert-v01@openssh.com"
@@ -765,15 +764,15 @@ authorized_keys files, are formatted as a single line of text consisting
 of the public key algorithm name followed by a base64-encoded key blob.
 The public key blob (before base64 encoding) is the same format used for
 the encoding of public keys sent on the wire: as described in RFC4253
-section 6.6 for RSA and DSA keys, RFC5656 section 3.1 for ECDSA keys
-and the "New public key formats" section of PROTOCOL.certkeys for the
-OpenSSH certificate formats.
+section 6.6 for RSA keys, RFC5656 section 3.1 for ECDSA keys and
+https://datatracker.ietf.org/doc/draft-miller-ssh-cert/
+for the OpenSSH certificate formats.
 
 5.2 Private key format
 
 OpenSSH private keys, as generated by ssh-keygen(1) use the format
 described in PROTOCOL.key by default. As a legacy option, PEM format
-(RFC7468) private keys are also supported for RSA, DSA and ECDSA keys
+(RFC7468) private keys are also supported for RSA and ECDSA keys
 and were the default format before OpenSSH 7.8.
 
 5.3 KRL format
@@ -792,4 +791,4 @@ master instance and later clients.
 OpenSSH extends the usual agent protocol. These changes are documented
 in the PROTOCOL.agent file.
 
-$OpenBSD: PROTOCOL,v 1.56 2025/05/05 05:51:11 djm Exp $
+$OpenBSD: PROTOCOL,v 1.57 2025/05/06 05:40:56 djm Exp $

diff --git a/TODO b/TODO
index b76529c960a07a504b1791bf51c11a580684f1ef..e9e2d96e6e1df0e2c68b8c5c400d4a278c0266e1 100644 (file)
--- a/TODO
+++ b/TODO
@@ -7,7 +7,7 @@ Documentation:
 
 - Install FAQ?
 
-- General FAQ on S/Key, TIS, RSA, RSA2, DSA, etc and suggestions on when it
+- General FAQ on S/Key, TIS, RSA, RSA2, etc and suggestions on when it
   would be best to use them.
 
 - Create a Documentation/ directory?

diff --git a/authfd.c b/authfd.c
index e04ad0cf2d0292d8b62de877038e39c4bae5044d..66797880af84e57dc4e3ad28e30281f1cd933fdd 100644 (file)
--- a/authfd.c
+++ b/authfd.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: authfd.c,v 1.134 2023/12/18 14:46:56 djm Exp $ */
+/* $OpenBSD: authfd.c,v 1.135 2025/05/06 05:40:56 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -601,8 +601,6 @@ ssh_add_identity_constrained(int sock, struct sshkey *key,
 #ifdef WITH_OPENSSL
        case KEY_RSA:
        case KEY_RSA_CERT:
-       case KEY_DSA:
-       case KEY_DSA_CERT:
        case KEY_ECDSA:
        case KEY_ECDSA_CERT:
        case KEY_ECDSA_SK:

diff --git a/authfile.c b/authfile.c
index 4a2f21eb7f6d56281aba5be91f8c8b5b8e820085..bf485baf237ab2e2fbd41805d0f89683de1ea550 100644 (file)
--- a/authfile.c
+++ b/authfile.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: authfile.c,v 1.145 2024/09/22 12:56:21 jsg Exp $ */
+/* $OpenBSD: authfile.c,v 1.146 2025/05/06 05:40:56 djm Exp $ */
 /*
  * Copyright (c) 2000, 2013 Markus Friedl.  All rights reserved.
  *
@@ -328,7 +328,6 @@ sshkey_load_private_cert(int type, const char *filename, const char *passphrase,
        switch (type) {
 #ifdef WITH_OPENSSL
        case KEY_RSA:
-       case KEY_DSA:
        case KEY_ECDSA:
 #endif /* WITH_OPENSSL */
        case KEY_ED25519:

diff --git a/configure.ac b/configure.ac
index b19f790cdd5401866368ffb40209f702e7e10a1f..221d5f5618bff4475a8fe4b04431d889f2f1c5ba 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -3078,7 +3078,6 @@ if test "x$openssl" = "xyes" ; then
        AC_CHECK_FUNCS([ \
                BN_is_prime_ex \
                DES_crypt \
-               DSA_generate_parameters_ex \
                EVP_DigestSign \
                EVP_DigestVerify \
                EVP_DigestFinal_ex \

diff --git a/contrib/cygwin/ssh-user-config b/contrib/cygwin/ssh-user-config
index 3858722f646db1b6d8cc57febd3a926adf69f3b7..35802d06ecbaa125f4740c4820a5a9491fb8c9a0 100644 (file)
--- a/contrib/cygwin/ssh-user-config
+++ b/contrib/cygwin/ssh-user-config
@@ -246,9 +246,8 @@ done
 check_user_homedir
 check_user_dot_ssh_dir
 create_identity id_rsa rsa "SSH2 RSA"
-create_identity id_dsa dsa "SSH2 DSA"
+create_identity id_ed25519 ed25519 "SSH2 Ed25519"
 create_identity id_ecdsa ecdsa "SSH2 ECDSA"
-create_identity identity rsa1 "(deprecated) SSH1 RSA"
 fix_authorized_keys_perms
 
 echo

diff --git a/dns.c b/dns.c
index 939241440777100233790cc5fa3409a06f85cbc8..c01c7bebee1830c0a8621e037d4dfbf44d04d6a0 100644 (file)
--- a/dns.c
+++ b/dns.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: dns.c,v 1.44 2023/03/10 04:06:21 dtucker Exp $ */
+/* $OpenBSD: dns.c,v 1.45 2025/05/06 05:40:56 djm Exp $ */
 
 /*
  * Copyright (c) 2003 Wesley Griffin. All rights reserved.
@@ -88,9 +88,6 @@ dns_read_key(u_int8_t *algorithm, u_int8_t *digest_type,
        case KEY_RSA:
                *algorithm = SSHFP_KEY_RSA;
                break;
-       case KEY_DSA:
-               *algorithm = SSHFP_KEY_DSA;
-               break;
        case KEY_ECDSA:
                *algorithm = SSHFP_KEY_ECDSA;
                break;

diff --git a/hostfile.c b/hostfile.c
index 4b4a0e31ef384fc0f4a10bc17517779f018807bd..4cec57da50c6427aa1971ef07635490fc72dde35 100644 (file)
--- a/hostfile.c
+++ b/hostfile.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: hostfile.c,v 1.98 2025/05/05 02:48:07 djm Exp $ */
+/* $OpenBSD: hostfile.c,v 1.99 2025/05/06 05:40:56 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -150,8 +150,8 @@ host_hash(const char *host, const char *name_from_hostfile, u_int src_len)
 }
 
 /*
- * Parses an RSA (number of bits, e, n) or DSA key from a string.  Moves the
- * pointer over the key.  Skips any whitespace at the beginning and at end.
+ * Parses an RSA key from a string. Moves the pointer over the key.
+ * Skips any whitespace at the beginning and at end.
  */
 
 int

diff --git a/openbsd-compat/openssl-compat.h b/openbsd-compat/openssl-compat.h
index 6b8fff4129516971c02c5e7aefc3b9d5c400b77e..a7c41c235b5c6621eea0874324fe58ec5a22f4cc 100644 (file)
--- a/openbsd-compat/openssl-compat.h
+++ b/openbsd-compat/openssl-compat.h
@@ -45,9 +45,6 @@ void ssh_libcrypto_init(void);
 #ifndef OPENSSL_RSA_MAX_MODULUS_BITS
 # define OPENSSL_RSA_MAX_MODULUS_BITS  16384
 #endif
-#ifndef OPENSSL_DSA_MAX_MODULUS_BITS
-# define OPENSSL_DSA_MAX_MODULUS_BITS  10000
-#endif
 
 #ifdef LIBRESSL_VERSION_NUMBER
 # if LIBRESSL_VERSION_NUMBER < 0x3010000fL

diff --git a/pathnames.h b/pathnames.h
index e07395cb6f265a28aaf895872e60d2bcc52c7e4b..9e76dbba841f08acda9f8951ade6c1f2ec292c6d 100644 (file)
--- a/pathnames.h
+++ b/pathnames.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: pathnames.h,v 1.34 2025/05/05 02:48:06 djm Exp $ */
+/* $OpenBSD: pathnames.h,v 1.35 2025/05/06 05:40:56 djm Exp $ */
 
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -36,7 +36,6 @@
  */
 #define _PATH_SERVER_CONFIG_FILE       SSHDIR "/sshd_config"
 #define _PATH_HOST_CONFIG_FILE         SSHDIR "/ssh_config"
-#define _PATH_HOST_DSA_KEY_FILE                SSHDIR "/ssh_host_dsa_key"
 #define _PATH_HOST_ECDSA_KEY_FILE      SSHDIR "/ssh_host_ecdsa_key"
 #define _PATH_HOST_ED25519_KEY_FILE    SSHDIR "/ssh_host_ed25519_key"
 #define _PATH_HOST_XMSS_KEY_FILE       SSHDIR "/ssh_host_xmss_key"
@@ -87,7 +86,6 @@
  * Name of the default file containing client-side authentication key. This
  * file should only be readable by the user him/herself.
  */
-#define _PATH_SSH_CLIENT_ID_DSA                _PATH_SSH_USER_DIR "/id_dsa"
 #define _PATH_SSH_CLIENT_ID_ECDSA      _PATH_SSH_USER_DIR "/id_ecdsa"
 #define _PATH_SSH_CLIENT_ID_RSA                _PATH_SSH_USER_DIR "/id_rsa"
 #define _PATH_SSH_CLIENT_ID_ED25519    _PATH_SSH_USER_DIR "/id_ed25519"

diff --git a/readconf.c b/readconf.c
index 7cbe7d2c2dc5d3599e4cbef8e9e74485ad0a681d..a56cbe0da7d04925d34099274acb88499bcf25fa 100644 (file)
--- a/readconf.c
+++ b/readconf.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: readconf.c,v 1.398 2025/03/18 04:53:14 djm Exp $ */
+/* $OpenBSD: readconf.c,v 1.399 2025/05/06 05:40:56 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -2869,9 +2869,6 @@ fill_default_options(Options * options)
                add_identity_file(options, "~/",
                    _PATH_SSH_CLIENT_ID_ED25519_SK, 0);
                add_identity_file(options, "~/", _PATH_SSH_CLIENT_ID_XMSS, 0);
-#ifdef WITH_DSA
-               add_identity_file(options, "~/", _PATH_SSH_CLIENT_ID_DSA, 0);
-#endif
        }
        if (options->escape_char == -1)
                options->escape_char = '~';

diff --git a/ssh-add.c b/ssh-add.c
index 0035cb84a0c1101400008d0b7b91c283cda306af..18897a0a834d0099f125843f5eac2a7746656b08 100644 (file)
--- a/ssh-add.c
+++ b/ssh-add.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-add.c,v 1.173 2024/09/06 02:30:44 djm Exp $ */
+/* $OpenBSD: ssh-add.c,v 1.174 2025/05/06 05:40:56 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -85,9 +85,6 @@ static char *default_files[] = {
        _PATH_SSH_CLIENT_ID_ED25519,
        _PATH_SSH_CLIENT_ID_ED25519_SK,
        _PATH_SSH_CLIENT_ID_XMSS,
-#ifdef WITH_DSA
-       _PATH_SSH_CLIENT_ID_DSA,
-#endif
        NULL
 };
 

diff --git a/ssh-dss.c b/ssh-dss.c
deleted file mode 100644 (file)
index aea6613..0000000
--- a/ssh-dss.c
+++ /dev/null
@@ -1,457 +0,0 @@
-/* $OpenBSD: ssh-dss.c,v 1.50 2024/01/11 01:45:36 djm Exp $ */
-/*
- * Copyright (c) 2000 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-
-#if defined(WITH_OPENSSL) && defined(WITH_DSA)
-
-#include <sys/types.h>
-
-#include <openssl/bn.h>
-#include <openssl/dsa.h>
-#include <openssl/evp.h>
-
-#include <stdarg.h>
-#include <string.h>
-
-#include "sshbuf.h"
-#include "ssherr.h"
-#include "digest.h"
-#define SSHKEY_INTERNAL
-#include "sshkey.h"
-
-#include "openbsd-compat/openssl-compat.h"
-
-#define INTBLOB_LEN    20
-#define SIGBLOB_LEN    (2*INTBLOB_LEN)
-
-static u_int
-ssh_dss_size(const struct sshkey *key)
-{
-       const BIGNUM *dsa_p;
-
-       if (key->dsa == NULL)
-               return 0;
-       DSA_get0_pqg(key->dsa, &dsa_p, NULL, NULL);
-       return BN_num_bits(dsa_p);
-}
-
-static int
-ssh_dss_alloc(struct sshkey *k)
-{
-       if ((k->dsa = DSA_new()) == NULL)
-               return SSH_ERR_ALLOC_FAIL;
-       return 0;
-}
-
-static void
-ssh_dss_cleanup(struct sshkey *k)
-{
-       DSA_free(k->dsa);
-       k->dsa = NULL;
-}
-
-static int
-ssh_dss_equal(const struct sshkey *a, const struct sshkey *b)
-{
-       const BIGNUM *dsa_p_a, *dsa_q_a, *dsa_g_a, *dsa_pub_key_a;
-       const BIGNUM *dsa_p_b, *dsa_q_b, *dsa_g_b, *dsa_pub_key_b;
-
-       if (a->dsa == NULL || b->dsa == NULL)
-               return 0;
-       DSA_get0_pqg(a->dsa, &dsa_p_a, &dsa_q_a, &dsa_g_a);
-       DSA_get0_pqg(b->dsa, &dsa_p_b, &dsa_q_b, &dsa_g_b);
-       DSA_get0_key(a->dsa, &dsa_pub_key_a, NULL);
-       DSA_get0_key(b->dsa, &dsa_pub_key_b, NULL);
-       if (dsa_p_a == NULL || dsa_p_b == NULL ||
-           dsa_q_a == NULL || dsa_q_b == NULL ||
-           dsa_g_a == NULL || dsa_g_b == NULL ||
-           dsa_pub_key_a == NULL || dsa_pub_key_b == NULL)
-               return 0;
-       if (BN_cmp(dsa_p_a, dsa_p_b) != 0)
-               return 0;
-       if (BN_cmp(dsa_q_a, dsa_q_b) != 0)
-               return 0;
-       if (BN_cmp(dsa_g_a, dsa_g_b) != 0)
-               return 0;
-       if (BN_cmp(dsa_pub_key_a, dsa_pub_key_b) != 0)
-               return 0;
-       return 1;
-}
-
-static int
-ssh_dss_serialize_public(const struct sshkey *key, struct sshbuf *b,
-    enum sshkey_serialize_rep opts)
-{
-       int r;
-       const BIGNUM *dsa_p, *dsa_q, *dsa_g, *dsa_pub_key;
-
-       if (key->dsa == NULL)
-               return SSH_ERR_INVALID_ARGUMENT;
-       DSA_get0_pqg(key->dsa, &dsa_p, &dsa_q, &dsa_g);
-       DSA_get0_key(key->dsa, &dsa_pub_key, NULL);
-       if (dsa_p == NULL || dsa_q == NULL ||
-           dsa_g == NULL || dsa_pub_key == NULL)
-               return SSH_ERR_INTERNAL_ERROR;
-       if ((r = sshbuf_put_bignum2(b, dsa_p)) != 0 ||
-           (r = sshbuf_put_bignum2(b, dsa_q)) != 0 ||
-           (r = sshbuf_put_bignum2(b, dsa_g)) != 0 ||
-           (r = sshbuf_put_bignum2(b, dsa_pub_key)) != 0)
-               return r;
-
-       return 0;
-}
-
-static int
-ssh_dss_serialize_private(const struct sshkey *key, struct sshbuf *b,
-    enum sshkey_serialize_rep opts)
-{
-       int r;
-       const BIGNUM *dsa_priv_key;
-
-       DSA_get0_key(key->dsa, NULL, &dsa_priv_key);
-       if (!sshkey_is_cert(key)) {
-               if ((r = ssh_dss_serialize_public(key, b, opts)) != 0)
-                       return r;
-       }
-       if ((r = sshbuf_put_bignum2(b, dsa_priv_key)) != 0)
-               return r;
-
-       return 0;
-}
-
-static int
-ssh_dss_generate(struct sshkey *k, int bits)
-{
-       DSA *private;
-
-       if (bits != 1024)
-               return SSH_ERR_KEY_LENGTH;
-       if ((private = DSA_new()) == NULL)
-               return SSH_ERR_ALLOC_FAIL;
-       if (!DSA_generate_parameters_ex(private, bits, NULL, 0, NULL,
-           NULL, NULL) || !DSA_generate_key(private)) {
-               DSA_free(private);
-               return SSH_ERR_LIBCRYPTO_ERROR;
-       }
-       k->dsa = private;
-       return 0;
-}
-
-static int
-ssh_dss_copy_public(const struct sshkey *from, struct sshkey *to)
-{
-       const BIGNUM *dsa_p, *dsa_q, *dsa_g, *dsa_pub_key;
-       BIGNUM *dsa_p_dup = NULL, *dsa_q_dup = NULL, *dsa_g_dup = NULL;
-       BIGNUM *dsa_pub_key_dup = NULL;
-       int r = SSH_ERR_INTERNAL_ERROR;
-
-       DSA_get0_pqg(from->dsa, &dsa_p, &dsa_q, &dsa_g);
-       DSA_get0_key(from->dsa, &dsa_pub_key, NULL);
-       if ((dsa_p_dup = BN_dup(dsa_p)) == NULL ||
-           (dsa_q_dup = BN_dup(dsa_q)) == NULL ||
-           (dsa_g_dup = BN_dup(dsa_g)) == NULL ||
-           (dsa_pub_key_dup = BN_dup(dsa_pub_key)) == NULL) {
-               r = SSH_ERR_ALLOC_FAIL;
-               goto out;
-       }
-       if (!DSA_set0_pqg(to->dsa, dsa_p_dup, dsa_q_dup, dsa_g_dup)) {
-               r = SSH_ERR_LIBCRYPTO_ERROR;
-               goto out;
-       }
-       dsa_p_dup = dsa_q_dup = dsa_g_dup = NULL; /* transferred */
-       if (!DSA_set0_key(to->dsa, dsa_pub_key_dup, NULL)) {
-               r = SSH_ERR_LIBCRYPTO_ERROR;
-               goto out;
-       }
-       dsa_pub_key_dup = NULL; /* transferred */
-       /* success */
-       r = 0;
- out:
-       BN_clear_free(dsa_p_dup);
-       BN_clear_free(dsa_q_dup);
-       BN_clear_free(dsa_g_dup);
-       BN_clear_free(dsa_pub_key_dup);
-       return r;
-}
-
-static int
-ssh_dss_deserialize_public(const char *ktype, struct sshbuf *b,
-    struct sshkey *key)
-{
-       int ret = SSH_ERR_INTERNAL_ERROR;
-       BIGNUM *dsa_p = NULL, *dsa_q = NULL, *dsa_g = NULL, *dsa_pub_key = NULL;
-
-       if (sshbuf_get_bignum2(b, &dsa_p) != 0 ||
-           sshbuf_get_bignum2(b, &dsa_q) != 0 ||
-           sshbuf_get_bignum2(b, &dsa_g) != 0 ||
-           sshbuf_get_bignum2(b, &dsa_pub_key) != 0) {
-               ret = SSH_ERR_INVALID_FORMAT;
-               goto out;
-       }
-       if (!DSA_set0_pqg(key->dsa, dsa_p, dsa_q, dsa_g)) {
-               ret = SSH_ERR_LIBCRYPTO_ERROR;
-               goto out;
-       }
-       dsa_p = dsa_q = dsa_g = NULL; /* transferred */
-       if (!DSA_set0_key(key->dsa, dsa_pub_key, NULL)) {
-               ret = SSH_ERR_LIBCRYPTO_ERROR;
-               goto out;
-       }
-       dsa_pub_key = NULL; /* transferred */
-#ifdef DEBUG_PK
-       DSA_print_fp(stderr, key->dsa, 8);
-#endif
-       /* success */
-       ret = 0;
- out:
-       BN_clear_free(dsa_p);
-       BN_clear_free(dsa_q);
-       BN_clear_free(dsa_g);
-       BN_clear_free(dsa_pub_key);
-       return ret;
-}
-
-static int
-ssh_dss_deserialize_private(const char *ktype, struct sshbuf *b,
-    struct sshkey *key)
-{
-       int r;
-       BIGNUM *dsa_priv_key = NULL;
-
-       if (!sshkey_is_cert(key)) {
-               if ((r = ssh_dss_deserialize_public(ktype, b, key)) != 0)
-                       return r;
-       }
-
-       if ((r = sshbuf_get_bignum2(b, &dsa_priv_key)) != 0)
-               return r;
-       if (!DSA_set0_key(key->dsa, NULL, dsa_priv_key)) {
-               BN_clear_free(dsa_priv_key);
-               return SSH_ERR_LIBCRYPTO_ERROR;
-       }
-       return 0;
-}
-
-static int
-ssh_dss_sign(struct sshkey *key,
-    u_char **sigp, size_t *lenp,
-    const u_char *data, size_t datalen,
-    const char *alg, const char *sk_provider, const char *sk_pin, u_int compat)
-{
-       DSA_SIG *sig = NULL;
-       const BIGNUM *sig_r, *sig_s;
-       u_char digest[SSH_DIGEST_MAX_LENGTH], sigblob[SIGBLOB_LEN];
-       size_t rlen, slen, len, dlen = ssh_digest_bytes(SSH_DIGEST_SHA1);
-       struct sshbuf *b = NULL;
-       int ret = SSH_ERR_INVALID_ARGUMENT;
-
-       if (lenp != NULL)
-               *lenp = 0;
-       if (sigp != NULL)
-               *sigp = NULL;
-
-       if (key == NULL || key->dsa == NULL ||
-           sshkey_type_plain(key->type) != KEY_DSA)
-               return SSH_ERR_INVALID_ARGUMENT;
-       if (dlen == 0)
-               return SSH_ERR_INTERNAL_ERROR;
-
-       if ((ret = ssh_digest_memory(SSH_DIGEST_SHA1, data, datalen,
-           digest, sizeof(digest))) != 0)
-               goto out;
-
-       if ((sig = DSA_do_sign(digest, dlen, key->dsa)) == NULL) {
-               ret = SSH_ERR_LIBCRYPTO_ERROR;
-               goto out;
-       }
-
-       DSA_SIG_get0(sig, &sig_r, &sig_s);
-       rlen = BN_num_bytes(sig_r);
-       slen = BN_num_bytes(sig_s);
-       if (rlen > INTBLOB_LEN || slen > INTBLOB_LEN) {
-               ret = SSH_ERR_INTERNAL_ERROR;
-               goto out;
-       }
-       explicit_bzero(sigblob, SIGBLOB_LEN);
-       BN_bn2bin(sig_r, sigblob + SIGBLOB_LEN - INTBLOB_LEN - rlen);
-       BN_bn2bin(sig_s, sigblob + SIGBLOB_LEN - slen);
-
-       if ((b = sshbuf_new()) == NULL) {
-               ret = SSH_ERR_ALLOC_FAIL;
-               goto out;
-       }
-       if ((ret = sshbuf_put_cstring(b, "ssh-dss")) != 0 ||
-           (ret = sshbuf_put_string(b, sigblob, SIGBLOB_LEN)) != 0)
-               goto out;
-
-       len = sshbuf_len(b);
-       if (sigp != NULL) {
-               if ((*sigp = malloc(len)) == NULL) {
-                       ret = SSH_ERR_ALLOC_FAIL;
-                       goto out;
-               }
-               memcpy(*sigp, sshbuf_ptr(b), len);
-       }
-       if (lenp != NULL)
-               *lenp = len;
-       ret = 0;
- out:
-       explicit_bzero(digest, sizeof(digest));
-       DSA_SIG_free(sig);
-       sshbuf_free(b);
-       return ret;
-}
-
-static int
-ssh_dss_verify(const struct sshkey *key,
-    const u_char *sig, size_t siglen,
-    const u_char *data, size_t dlen, const char *alg, u_int compat,
-    struct sshkey_sig_details **detailsp)
-{
-       DSA_SIG *dsig = NULL;
-       BIGNUM *sig_r = NULL, *sig_s = NULL;
-       u_char digest[SSH_DIGEST_MAX_LENGTH], *sigblob = NULL;
-       size_t len, hlen = ssh_digest_bytes(SSH_DIGEST_SHA1);
-       int ret = SSH_ERR_INTERNAL_ERROR;
-       struct sshbuf *b = NULL;
-       char *ktype = NULL;
-
-       if (key == NULL || key->dsa == NULL ||
-           sshkey_type_plain(key->type) != KEY_DSA ||
-           sig == NULL || siglen == 0)
-               return SSH_ERR_INVALID_ARGUMENT;
-       if (hlen == 0)
-               return SSH_ERR_INTERNAL_ERROR;
-
-       /* fetch signature */
-       if ((b = sshbuf_from(sig, siglen)) == NULL)
-               return SSH_ERR_ALLOC_FAIL;
-       if (sshbuf_get_cstring(b, &ktype, NULL) != 0 ||
-           sshbuf_get_string(b, &sigblob, &len) != 0) {
-               ret = SSH_ERR_INVALID_FORMAT;
-               goto out;
-       }
-       if (strcmp("ssh-dss", ktype) != 0) {
-               ret = SSH_ERR_KEY_TYPE_MISMATCH;
-               goto out;
-       }
-       if (sshbuf_len(b) != 0) {
-               ret = SSH_ERR_UNEXPECTED_TRAILING_DATA;
-               goto out;
-       }
-
-       if (len != SIGBLOB_LEN) {
-               ret = SSH_ERR_INVALID_FORMAT;
-               goto out;
-       }
-
-       /* parse signature */
-       if ((dsig = DSA_SIG_new()) == NULL ||
-           (sig_r = BN_new()) == NULL ||
-           (sig_s = BN_new()) == NULL) {
-               ret = SSH_ERR_ALLOC_FAIL;
-               goto out;
-       }
-       if ((BN_bin2bn(sigblob, INTBLOB_LEN, sig_r) == NULL) ||
-           (BN_bin2bn(sigblob + INTBLOB_LEN, INTBLOB_LEN, sig_s) == NULL)) {
-               ret = SSH_ERR_LIBCRYPTO_ERROR;
-               goto out;
-       }
-       if (!DSA_SIG_set0(dsig, sig_r, sig_s)) {
-               ret = SSH_ERR_LIBCRYPTO_ERROR;
-               goto out;
-       }
-       sig_r = sig_s = NULL; /* transferred */
-
-       /* sha1 the data */
-       if ((ret = ssh_digest_memory(SSH_DIGEST_SHA1, data, dlen,
-           digest, sizeof(digest))) != 0)
-               goto out;
-
-       switch (DSA_do_verify(digest, hlen, dsig, key->dsa)) {
-       case 1:
-               ret = 0;
-               break;
-       case 0:
-               ret = SSH_ERR_SIGNATURE_INVALID;
-               goto out;
-       default:
-               ret = SSH_ERR_LIBCRYPTO_ERROR;
-               goto out;
-       }
-
- out:
-       explicit_bzero(digest, sizeof(digest));
-       DSA_SIG_free(dsig);
-       BN_clear_free(sig_r);
-       BN_clear_free(sig_s);
-       sshbuf_free(b);
-       free(ktype);
-       if (sigblob != NULL)
-               freezero(sigblob, len);
-       return ret;
-}
-
-static const struct sshkey_impl_funcs sshkey_dss_funcs = {
-       /* .size = */           ssh_dss_size,
-       /* .alloc = */          ssh_dss_alloc,
-       /* .cleanup = */        ssh_dss_cleanup,
-       /* .equal = */          ssh_dss_equal,
-       /* .ssh_serialize_public = */ ssh_dss_serialize_public,
-       /* .ssh_deserialize_public = */ ssh_dss_deserialize_public,
-       /* .ssh_serialize_private = */ ssh_dss_serialize_private,
-       /* .ssh_deserialize_private = */ ssh_dss_deserialize_private,
-       /* .generate = */       ssh_dss_generate,
-       /* .copy_public = */    ssh_dss_copy_public,
-       /* .sign = */           ssh_dss_sign,
-       /* .verify = */         ssh_dss_verify,
-};
-
-const struct sshkey_impl sshkey_dss_impl = {
-       /* .name = */           "ssh-dss",
-       /* .shortname = */      "DSA",
-       /* .sigalg = */         NULL,
-       /* .type = */           KEY_DSA,
-       /* .nid = */            0,
-       /* .cert = */           0,
-       /* .sigonly = */        0,
-       /* .keybits = */        0,
-       /* .funcs = */          &sshkey_dss_funcs,
-};
-
-const struct sshkey_impl sshkey_dsa_cert_impl = {
-       /* .name = */           "ssh-dss-cert-v01@openssh.com",
-       /* .shortname = */      "DSA-CERT",
-       /* .sigalg = */         NULL,
-       /* .type = */           KEY_DSA_CERT,
-       /* .nid = */            0,
-       /* .cert = */           1,
-       /* .sigonly = */        0,
-       /* .keybits = */        0,
-       /* .funcs = */          &sshkey_dss_funcs,
-};
-
-#endif /* WITH_OPENSSL && WITH_DSA */

diff --git a/ssh-keygen.c b/ssh-keygen.c
index 89c3ed28762826f954334706b1b99aa5f7a9c4f2..3217f084d384a0909251fa83fcd85ac337bbd9f7 100644 (file)
--- a/ssh-keygen.c
+++ b/ssh-keygen.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-keygen.c,v 1.477 2024/12/04 14:24:20 djm Exp $ */
+/* $OpenBSD: ssh-keygen.c,v 1.478 2025/05/06 05:40:56 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1994 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -70,18 +70,14 @@
 #define DEFAULT_KEY_TYPE_NAME "ed25519"
 
 /*
- * Default number of bits in the RSA, DSA and ECDSA keys.  These value can be
+ * Default number of bits in the RSA and ECDSA keys.  These value can be
  * overridden on the command line.
  *
- * These values, with the exception of DSA, provide security equivalent to at
- * least 128 bits of security according to NIST Special Publication 800-57:
- * Recommendation for Key Management Part 1 rev 4 section 5.6.1.
- * For DSA it (and FIPS-186-4 section 4.2) specifies that the only size for
- * which a 160bit hash is acceptable is 1kbit, and since ssh-dss specifies only
- * SHA1 we limit the DSA key size 1k bits.
+ * These values provide security equivalent to at least 128 bits of security
+ * according to NIST Special Publication 800-57: Recommendation for Key
+ * Management Part 1 rev 4 section 5.6.1.
  */
 #define DEFAULT_BITS           3072
-#define DEFAULT_BITS_DSA       1024
 #define DEFAULT_BITS_ECDSA     256
 
 static int quiet = 0;
@@ -185,9 +181,6 @@ type_bits_valid(int type, const char *name, u_int32_t *bitsp)
                int nid;
 
                switch(type) {
-               case KEY_DSA:
-                       *bitsp = DEFAULT_BITS_DSA;
-                       break;
                case KEY_ECDSA:
                        if (name != NULL &&
                            (nid = sshkey_ecdsa_nid_from_name(name)) > 0)
@@ -203,10 +196,6 @@ type_bits_valid(int type, const char *name, u_int32_t *bitsp)
        }
 #ifdef WITH_OPENSSL
        switch (type) {
-       case KEY_DSA:
-               if (*bitsp != 1024)
-                       fatal("Invalid DSA key length: must be 1024 bits");
-               break;
        case KEY_RSA:
                if (*bitsp < SSH_RSA_MINIMUM_MODULUS_SIZE)
                        fatal("Invalid RSA key length: minimum is %d bits",
@@ -262,12 +251,6 @@ ask_filename(struct passwd *pw, const char *prompt)
                name = _PATH_SSH_CLIENT_ID_ED25519;
        else {
                switch (sshkey_type_from_shortname(key_type_name)) {
-#ifdef WITH_DSA
-               case KEY_DSA_CERT:
-               case KEY_DSA:
-                       name = _PATH_SSH_CLIENT_ID_DSA;
-                       break;
-#endif
 #ifdef OPENSSL_HAS_ECC
                case KEY_ECDSA_CERT:
                case KEY_ECDSA:
@@ -382,12 +365,6 @@ do_convert_to_pkcs8(struct sshkey *k)
                    EVP_PKEY_get0_RSA(k->pkey)))
                        fatal("PEM_write_RSA_PUBKEY failed");
                break;
-#ifdef WITH_DSA
-       case KEY_DSA:
-               if (!PEM_write_DSA_PUBKEY(stdout, k->dsa))
-                       fatal("PEM_write_DSA_PUBKEY failed");
-               break;
-#endif
 #ifdef OPENSSL_HAS_ECC
        case KEY_ECDSA:
                if (!PEM_write_EC_PUBKEY(stdout,
@@ -410,12 +387,6 @@ do_convert_to_pem(struct sshkey *k)
                    EVP_PKEY_get0_RSA(k->pkey)))
                        fatal("PEM_write_RSAPublicKey failed");
                break;
-#ifdef WITH_DSA
-       case KEY_DSA:
-               if (!PEM_write_DSA_PUBKEY(stdout, k->dsa))
-                       fatal("PEM_write_DSA_PUBKEY failed");
-               break;
-#endif
 #ifdef OPENSSL_HAS_ECC
        case KEY_ECDSA:
                if (!PEM_write_EC_PUBKEY(stdout,
@@ -491,10 +462,6 @@ do_convert_private_ssh2(struct sshbuf *b)
        u_int magic, i1, i2, i3, i4;
        size_t slen;
        u_long e;
-#ifdef WITH_DSA
-       BIGNUM *dsa_p = NULL, *dsa_q = NULL, *dsa_g = NULL;
-       BIGNUM *dsa_pub_key = NULL, *dsa_priv_key = NULL;
-#endif
        BIGNUM *rsa_n = NULL, *rsa_e = NULL, *rsa_d = NULL;
        BIGNUM *rsa_p = NULL, *rsa_q = NULL, *rsa_iqmp = NULL;
        BIGNUM *rsa_dmp1 = NULL, *rsa_dmq1 = NULL;
@@ -526,10 +493,6 @@ do_convert_private_ssh2(struct sshbuf *b)
 
        if (strstr(type, "rsa")) {
                ktype = KEY_RSA;
-#ifdef WITH_DSA
-       } else if (strstr(type, "dsa")) {
-               ktype = KEY_DSA;
-#endif
        } else {
                free(type);
                return NULL;
@@ -539,27 +502,6 @@ do_convert_private_ssh2(struct sshbuf *b)
        free(type);
 
        switch (key->type) {
-#ifdef WITH_DSA
-       case KEY_DSA:
-               if ((dsa_p = BN_new()) == NULL ||
-                   (dsa_q = BN_new()) == NULL ||
-                   (dsa_g = BN_new()) == NULL ||
-                   (dsa_pub_key = BN_new()) == NULL ||
-                   (dsa_priv_key = BN_new()) == NULL)
-                       fatal_f("BN_new");
-               buffer_get_bignum_bits(b, dsa_p);
-               buffer_get_bignum_bits(b, dsa_g);
-               buffer_get_bignum_bits(b, dsa_q);
-               buffer_get_bignum_bits(b, dsa_pub_key);
-               buffer_get_bignum_bits(b, dsa_priv_key);
-               if (!DSA_set0_pqg(key->dsa, dsa_p, dsa_q, dsa_g))
-                       fatal_f("DSA_set0_pqg failed");
-               dsa_p = dsa_q = dsa_g = NULL; /* transferred */
-               if (!DSA_set0_key(key->dsa, dsa_pub_key, dsa_priv_key))
-                       fatal_f("DSA_set0_key failed");
-               dsa_pub_key = dsa_priv_key = NULL; /* transferred */
-               break;
-#endif
        case KEY_RSA:
                if ((r = sshbuf_get_u8(b, &e1)) != 0 ||
                    (e1 < 30 && (r = sshbuf_get_u8(b, &e2)) != 0) ||
@@ -734,14 +676,6 @@ do_convert_from_pkcs8(struct sshkey **k, int *private)
                (*k)->pkey = pubkey;
                pubkey = NULL;
                break;
-#ifdef WITH_DSA
-       case EVP_PKEY_DSA:
-               if ((*k = sshkey_new(KEY_UNSPEC)) == NULL)
-                       fatal("sshkey_new failed");
-               (*k)->type = KEY_DSA;
-               (*k)->dsa = EVP_PKEY_get1_DSA(pubkey);
-               break;
-#endif
 #ifdef OPENSSL_HAS_ECC
        case EVP_PKEY_EC:
                if ((*k = sshkey_new(KEY_UNSPEC)) == NULL)
@@ -817,12 +751,6 @@ do_convert_from(struct passwd *pw)
                        fprintf(stdout, "\n");
        } else {
                switch (k->type) {
-#ifdef WITH_DSA
-               case KEY_DSA:
-                       ok = PEM_write_DSAPrivateKey(stdout, k->dsa, NULL,
-                           NULL, 0, NULL, NULL);
-                       break;
-#endif
 #ifdef OPENSSL_HAS_ECC
                case KEY_ECDSA:
                        ok = PEM_write_ECPrivateKey(stdout,
@@ -3329,7 +3257,7 @@ usage(void)
        fprintf(stderr,
            "usage: ssh-keygen [-q] [-a rounds] [-b bits] [-C comment] [-f output_keyfile]\n"
            "                  [-m format] [-N new_passphrase] [-O option]\n"
-           "                  [-t dsa | ecdsa | ecdsa-sk | ed25519 | ed25519-sk | rsa]\n"
+           "                  [-t ecdsa | ecdsa-sk | ed25519 | ed25519-sk | rsa]\n"
            "                  [-w provider] [-Z cipher]\n"
            "       ssh-keygen -p [-a rounds] [-f keyfile] [-m format] [-N new_passphrase]\n"
            "                   [-P old_passphrase] [-Z cipher]\n"
@@ -3805,11 +3733,6 @@ main(int argc, char **argv)
                        n += do_print_resource_record(pw,
                            _PATH_HOST_RSA_KEY_FILE, rr_hostname,
                            print_generic, opts, nopts);
-#ifdef WITH_DSA
-                       n += do_print_resource_record(pw,
-                           _PATH_HOST_DSA_KEY_FILE, rr_hostname,
-                           print_generic, opts, nopts);
-#endif
                        n += do_print_resource_record(pw,
                            _PATH_HOST_ECDSA_KEY_FILE, rr_hostname,
                            print_generic, opts, nopts);

diff --git a/ssh-keyscan.c b/ssh-keyscan.c
index 3436c0b5c7c6d2fd563cbe90c0c80d4567283dde..7b1e0ca8650068ee2fb509d035332e759be6c190 100644 (file)
--- a/ssh-keyscan.c
+++ b/ssh-keyscan.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-keyscan.c,v 1.165 2024/12/06 15:17:15 djm Exp $ */
+/* $OpenBSD: ssh-keyscan.c,v 1.166 2025/05/06 05:40:56 djm Exp $ */
 /*
  * Copyright 1995, 1996 by David Mazieres <dm@lcs.mit.edu>.
  *
@@ -62,15 +62,14 @@ int IPv4or6 = AF_UNSPEC;
 
 int ssh_port = SSH_DEFAULT_PORT;
 
-#define KT_DSA         (1)
-#define KT_RSA         (1<<1)
-#define KT_ECDSA       (1<<2)
-#define KT_ED25519     (1<<3)
-#define KT_XMSS                (1<<4)
-#define KT_ECDSA_SK    (1<<5)
-#define KT_ED25519_SK  (1<<6)
+#define KT_RSA         (1)
+#define KT_ECDSA       (1<<1)
+#define KT_ED25519     (1<<2)
+#define KT_XMSS                (1<<3)
+#define KT_ECDSA_SK    (1<<4)
+#define KT_ED25519_SK  (1<<5)
 
-#define KT_MIN         KT_DSA
+#define KT_MIN         KT_RSA
 #define KT_MAX         KT_ED25519_SK
 
 int get_cert = 0;
@@ -240,10 +239,6 @@ keygrab_ssh2(con *c)
        int r;
 
        switch (c->c_keytype) {
-       case KT_DSA:
-               myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = get_cert ?
-                   "ssh-dss-cert-v01@openssh.com" : "ssh-dss";
-               break;
        case KT_RSA:
                myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = get_cert ?
                    "rsa-sha2-512-cert-v01@openssh.com,"
@@ -743,11 +738,6 @@ main(int argc, char **argv)
                                int type = sshkey_type_from_shortname(tname);
 
                                switch (type) {
-#ifdef WITH_DSA
-                               case KEY_DSA:
-                                       get_keytypes |= KT_DSA;
-                                       break;
-#endif
                                case KEY_ECDSA:
                                        get_keytypes |= KT_ECDSA;
                                        break;

diff --git a/ssh-keysign.c b/ssh-keysign.c
index 955f7b0abad941c596e887e1251f825a7d10a940..4d65dd1d33a0792f2678dc6f3811721da0bf0f61 100644 (file)
--- a/ssh-keysign.c
+++ b/ssh-keysign.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-keysign.c,v 1.75 2025/02/15 01:48:30 djm Exp $ */
+/* $OpenBSD: ssh-keysign.c,v 1.76 2025/05/06 05:40:56 djm Exp $ */
 /*
  * Copyright (c) 2002 Markus Friedl.  All rights reserved.
  *
@@ -200,9 +200,6 @@ main(int argc, char **argv)
 
        i = 0;
        /* XXX This really needs to read sshd_config for the paths */
-#ifdef WITH_DSA
-       key_fd[i++] = open(_PATH_HOST_DSA_KEY_FILE, O_RDONLY);
-#endif
        key_fd[i++] = open(_PATH_HOST_ECDSA_KEY_FILE, O_RDONLY);
        key_fd[i++] = open(_PATH_HOST_ED25519_KEY_FILE, O_RDONLY);
        key_fd[i++] = open(_PATH_HOST_XMSS_KEY_FILE, O_RDONLY);

diff --git a/ssh.c b/ssh.c
index dc4886d0ecdf865a72e3a8091a52f651bed23dd4..b2172b810a61c3e51b359f15972cb006869a9e63 100644 (file)
--- a/ssh.c
+++ b/ssh.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh.c,v 1.612 2025/04/09 01:24:40 djm Exp $ */
+/* $OpenBSD: ssh.c,v 1.613 2025/05/06 05:40:56 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -1746,15 +1746,9 @@ main(int ac, char **av)
                        L_CERT(_PATH_HOST_ECDSA_KEY_FILE, 0);
                        L_CERT(_PATH_HOST_ED25519_KEY_FILE, 1);
                        L_CERT(_PATH_HOST_RSA_KEY_FILE, 2);
-#ifdef WITH_DSA
-                       L_CERT(_PATH_HOST_DSA_KEY_FILE, 3);
-#endif
                        L_PUBKEY(_PATH_HOST_ECDSA_KEY_FILE, 4);
                        L_PUBKEY(_PATH_HOST_ED25519_KEY_FILE, 5);
                        L_PUBKEY(_PATH_HOST_RSA_KEY_FILE, 6);
-#ifdef WITH_DSA
-                       L_PUBKEY(_PATH_HOST_DSA_KEY_FILE, 7);
-#endif
                        L_CERT(_PATH_HOST_XMSS_KEY_FILE, 8);
                        L_PUBKEY(_PATH_HOST_XMSS_KEY_FILE, 9);
                        if (loaded == 0)

diff --git a/ssh_config b/ssh_config
index cc5663562e95ef7d1a0a2363260c68fbc0f5ad5d..238a0c5e371b2960a5bbb16745b462a13a735927 100644 (file)
--- a/ssh_config
+++ b/ssh_config
@@ -1,4 +1,4 @@
-#      $OpenBSD: ssh_config,v 1.36 2023/08/02 23:04:38 djm Exp $
+#      $OpenBSD: ssh_config,v 1.37 2025/05/06 05:40:56 djm Exp $
 
 # This is the ssh client system-wide configuration file.  See
 # ssh_config(5) for more information.  This file provides defaults for
@@ -30,7 +30,6 @@
 #   ConnectTimeout 0
 #   StrictHostKeyChecking ask
 #   IdentityFile ~/.ssh/id_rsa
-#   IdentityFile ~/.ssh/id_dsa
 #   IdentityFile ~/.ssh/id_ecdsa
 #   IdentityFile ~/.ssh/id_ed25519
 #   Port 22

diff --git a/sshconnect.c b/sshconnect.c
index c86182d13673940ea902acb4200f5d431cf102b7..b306fa3cc24f6196167c11563242bf7bb7e19a3c 100644 (file)
--- a/sshconnect.c
+++ b/sshconnect.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshconnect.c,v 1.369 2024/12/06 16:21:48 djm Exp $ */
+/* $OpenBSD: sshconnect.c,v 1.370 2025/05/06 05:40:56 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -1626,9 +1626,6 @@ show_other_keys(struct hostkeys *hostkeys, struct sshkey *key)
 {
        int type[] = {
                KEY_RSA,
-#ifdef WITH_DSA
-               KEY_DSA,
-#endif
                KEY_ECDSA,
                KEY_ED25519,
                KEY_XMSS,

diff --git a/sshd-auth.c b/sshd-auth.c
index 30eecd8a4723e86335604ec1c295199138a978f3..5de06a5baa49ccebd54a0ca0b9332e46e554addc 100644 (file)
--- a/sshd-auth.c
+++ b/sshd-auth.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshd-auth.c,v 1.3 2025/01/16 06:37:10 dtucker Exp $ */
+/* $OpenBSD: sshd-auth.c,v 1.4 2025/05/06 05:40:56 djm Exp $ */
 /*
  * SSH2 implementation:
  * Privilege Separation:
@@ -250,7 +250,6 @@ list_hostkey_types(void)
                        append_hostkey_type(b, "rsa-sha2-512");
                        append_hostkey_type(b, "rsa-sha2-256");
                        /* FALLTHROUGH */
-               case KEY_DSA:
                case KEY_ECDSA:
                case KEY_ED25519:
                case KEY_ECDSA_SK:
@@ -271,7 +270,6 @@ list_hostkey_types(void)
                        append_hostkey_type(b,
                            "rsa-sha2-256-cert-v01@openssh.com");
                        /* FALLTHROUGH */
-               case KEY_DSA_CERT:
                case KEY_ECDSA_CERT:
                case KEY_ED25519_CERT:
                case KEY_ECDSA_SK_CERT:
@@ -297,7 +295,6 @@ get_hostkey_public_by_type(int type, int nid, struct ssh *ssh)
        for (i = 0; i < options.num_host_key_files; i++) {
                switch (type) {
                case KEY_RSA_CERT:
-               case KEY_DSA_CERT:
                case KEY_ECDSA_CERT:
                case KEY_ED25519_CERT:
                case KEY_ECDSA_SK_CERT:

diff --git a/sshd-session.c b/sshd-session.c
index c64eb29fcefd779fbe58428513adc4037d6ea906..60f887e92d7b27df648252412adb048cb77a5389 100644 (file)
--- a/sshd-session.c
+++ b/sshd-session.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshd-session.c,v 1.12 2025/03/12 22:43:44 djm Exp $ */
+/* $OpenBSD: sshd-session.c,v 1.13 2025/05/06 05:40:56 djm Exp $ */
 /*
  * SSH2 implementation:
  * Privilege Separation:
@@ -485,7 +485,6 @@ get_hostkey_by_type(int type, int nid, int need_private, struct ssh *ssh)
        for (i = 0; i < options.num_host_key_files; i++) {
                switch (type) {
                case KEY_RSA_CERT:
-               case KEY_DSA_CERT:
                case KEY_ECDSA_CERT:
                case KEY_ED25519_CERT:
                case KEY_ECDSA_SK_CERT:

diff --git a/sshd.c b/sshd.c
index 4a93e29e4c0470f65454dab46df365277bbb67d0..03732bb09c505c2e12a7342bd598f264833cc715 100644 (file)
--- a/sshd.c
+++ b/sshd.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshd.c,v 1.617 2025/04/07 08:12:22 dtucker Exp $ */
+/* $OpenBSD: sshd.c,v 1.618 2025/05/06 05:40:56 djm Exp $ */
 /*
  * Copyright (c) 2000, 2001, 2002 Markus Friedl.  All rights reserved.
  * Copyright (c) 2002 Niels Provos.  All rights reserved.
@@ -1658,7 +1658,6 @@ main(int ac, char **av)
 
                switch (keytype) {
                case KEY_RSA:
-               case KEY_DSA:
                case KEY_ECDSA:
                case KEY_ED25519:
                case KEY_ECDSA_SK:

diff --git a/sshkey.c b/sshkey.c
index ab80752b8d0bd7b3b73f68a6dc9a59daa1e949dc..55a156818962ee20e40f72a33b71916ed4bb3dd9 100644 (file)
--- a/sshkey.c
+++ b/sshkey.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshkey.c,v 1.148 2024/12/03 15:53:51 tb Exp $ */
+/* $OpenBSD: sshkey.c,v 1.149 2025/05/06 05:40:56 djm Exp $ */
 /*
  * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.
  * Copyright (c) 2008 Alexander von Gernler.  All rights reserved.
@@ -119,10 +119,6 @@ extern const struct sshkey_impl sshkey_rsa_sha256_impl;
 extern const struct sshkey_impl sshkey_rsa_sha256_cert_impl;
 extern const struct sshkey_impl sshkey_rsa_sha512_impl;
 extern const struct sshkey_impl sshkey_rsa_sha512_cert_impl;
-# ifdef WITH_DSA
-extern const struct sshkey_impl sshkey_dss_impl;
-extern const struct sshkey_impl sshkey_dsa_cert_impl;
-# endif
 #endif /* WITH_OPENSSL */
 #ifdef WITH_XMSS
 extern const struct sshkey_impl sshkey_xmss_impl;
@@ -152,10 +148,6 @@ const struct sshkey_impl * const keyimpls[] = {
        &sshkey_ecdsa_sk_webauthn_impl,
 #  endif /* ENABLE_SK */
 # endif /* OPENSSL_HAS_ECC */
-# ifdef WITH_DSA
-       &sshkey_dss_impl,
-       &sshkey_dsa_cert_impl,
-# endif
        &sshkey_rsa_impl,
        &sshkey_rsa_cert_impl,
        &sshkey_rsa_sha256_impl,
@@ -451,8 +443,6 @@ sshkey_type_plain(int type)
        switch (type) {
        case KEY_RSA_CERT:
                return KEY_RSA;
-       case KEY_DSA_CERT:
-               return KEY_DSA;
        case KEY_ECDSA_CERT:
                return KEY_ECDSA;
        case KEY_ECDSA_SK_CERT:
@@ -475,8 +465,6 @@ sshkey_type_certified(int type)
        switch (type) {
        case KEY_RSA:
                return KEY_RSA_CERT;
-       case KEY_DSA:
-               return KEY_DSA_CERT;
        case KEY_ECDSA:
                return KEY_ECDSA_CERT;
        case KEY_ECDSA_SK:
@@ -3322,20 +3310,6 @@ sshkey_private_to_blob_pem_pkcs8(struct sshkey *key, struct sshbuf *buf,
                goto out;
 
        switch (key->type) {
-#ifdef WITH_DSA
-       case KEY_DSA:
-               if (format == SSHKEY_PRIVATE_PEM) {
-                       success = PEM_write_bio_DSAPrivateKey(bio, key->dsa,
-                           cipher, passphrase, len, NULL, NULL);
-               } else {
-                       if ((pkey = EVP_PKEY_new()) == NULL) {
-                               r = SSH_ERR_ALLOC_FAIL;
-                               goto out;
-                       }
-                       success = EVP_PKEY_set1_DSA(pkey, key->dsa);
-               }
-               break;
-#endif
 #ifdef OPENSSL_HAS_ECC
        case KEY_ECDSA:
                if (format == SSHKEY_PRIVATE_PEM) {
@@ -3403,7 +3377,6 @@ sshkey_private_to_fileblob(struct sshkey *key, struct sshbuf *blob,
 {
        switch (key->type) {
 #ifdef WITH_OPENSSL
-       case KEY_DSA:
        case KEY_ECDSA:
        case KEY_RSA:
                break; /* see below */
@@ -3578,19 +3551,6 @@ sshkey_parse_private_pem_fileblob(struct sshbuf *blob, int type,
                prv->pkey = pk;
                if ((r = sshkey_check_rsa_length(prv, 0)) != 0)
                        goto out;
-#ifdef WITH_DSA
-       } else if (EVP_PKEY_base_id(pk) == EVP_PKEY_DSA &&
-           (type == KEY_UNSPEC || type == KEY_DSA)) {
-               if ((prv = sshkey_new(KEY_UNSPEC)) == NULL) {
-                       r = SSH_ERR_ALLOC_FAIL;
-                       goto out;
-               }
-               prv->dsa = EVP_PKEY_get1_DSA(pk);
-               prv->type = KEY_DSA;
-#ifdef DEBUG_PK
-               DSA_print_fp(stderr, prv->dsa, 8);
-#endif
-#endif
 #ifdef OPENSSL_HAS_ECC
        } else if (EVP_PKEY_base_id(pk) == EVP_PKEY_EC &&
            (type == KEY_UNSPEC || type == KEY_ECDSA)) {

diff --git a/sshkey.h b/sshkey.h
index 19bbbac7dc0f77f11c8671130e728c6ab032e005..5fa410b9431d2fc1b863066486fc8c53387d7993 100644 (file)
--- a/sshkey.h
+++ b/sshkey.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshkey.h,v 1.66 2025/04/02 04:28:03 tb Exp $ */
+/* $OpenBSD: sshkey.h,v 1.67 2025/05/06 05:40:56 djm Exp $ */
 
 /*
  * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.
@@ -30,9 +30,6 @@
 
 #ifdef WITH_OPENSSL
 #include <openssl/rsa.h>
-#ifdef WITH_DSA
-#include <openssl/dsa.h>
-#endif
 #include <openssl/evp.h>
 # ifdef OPENSSL_HAS_ECC
 #  include <openssl/ec.h>
@@ -46,7 +43,6 @@
 #else /* WITH_OPENSSL */
 # define BIGNUM                void
 # define RSA           void
-# define DSA           void
 # define EC_KEY                void
 # define EC_GROUP      void
 # define EC_POINT      void
@@ -62,11 +58,9 @@ struct sshbuf;
 /* Key types */
 enum sshkey_types {
        KEY_RSA,
-       KEY_DSA,
        KEY_ECDSA,
        KEY_ED25519,
        KEY_RSA_CERT,
-       KEY_DSA_CERT,
        KEY_ECDSA_CERT,
        KEY_ED25519_CERT,
        KEY_XMSS,
@@ -129,8 +123,6 @@ struct sshkey_cert {
 struct sshkey {
        int      type;
        int      flags;
-       /* KEY_DSA */
-       DSA     *dsa;
        /* KEY_ECDSA and KEY_ECDSA_SK */
        int      ecdsa_nid;     /* NID of curve */
        /* libcrypto-backed keys */
@@ -353,7 +345,6 @@ int check_rsa_length(const RSA *rsa); /* XXX remove */
 
 #if !defined(WITH_OPENSSL)
 # undef RSA
-# undef DSA
 # undef EC_KEY
 # undef EC_GROUP
 # undef EC_POINT