upstream commit

refuse to generate or accept RSA keys smaller than 1024
 bits; feedback and ok dtucker@

Upstream-ID: 7ea3d31271366ba264f06e34a3539bf1ac30f0ba

diff --git a/ssh-keygen.1 b/ssh-keygen.1
index 9b93666c9e44f9d90943d221bd107de5eb3ff2fa..8c3317be702997f78c2dc33e8ffd2adb3c372bff 100644 (file)
--- a/ssh-keygen.1
+++ b/ssh-keygen.1
@@ -1,4 +1,4 @@
-.\"    $OpenBSD: ssh-keygen.1,v 1.125 2015/02/24 15:24:05 naddy Exp $
+.\"    $OpenBSD: ssh-keygen.1,v 1.126 2015/07/03 03:49:45 djm Exp $
 .\"
 .\" Author: Tatu Ylonen <ylo@cs.hut.fi>
 .\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -35,7 +35,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: February 24 2015 $
+.Dd $Mdocdate: July 3 2015 $
 .Dt SSH-KEYGEN 1
 .Os
 .Sh NAME
@@ -244,7 +244,7 @@ This option specifies the number of primality tests to perform.
 Show the bubblebabble digest of specified private or public key file.
 .It Fl b Ar bits
 Specifies the number of bits in the key to create.
-For RSA keys, the minimum size is 768 bits and the default is 2048 bits.
+For RSA keys, the minimum size is 1024 bits and the default is 2048 bits.
 Generally, 2048 bits is considered sufficient.
 DSA keys must be exactly 1024 bits as specified by FIPS 186-2.
 For ECDSA keys, the

diff --git a/ssh-keygen.c b/ssh-keygen.c
index b546366f17c27961e4c2856f3b02aadc49ff8f6b..ea5f1e49e3d013e6840022a6e21b9c8b06c8ca9b 100644 (file)
--- a/ssh-keygen.c
+++ b/ssh-keygen.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-keygen.c,v 1.275 2015/07/03 03:43:18 djm Exp $ */
+/* $OpenBSD: ssh-keygen.c,v 1.276 2015/07/03 03:49:45 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1994 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -217,8 +217,8 @@ type_bits_valid(int type, const char *name, u_int32_t *bitsp)
                fatal("key bits exceeds maximum %d", maxbits);
        if (type == KEY_DSA && *bitsp != 1024)
                fatal("DSA keys must be 1024 bits");
-       else if (type != KEY_ECDSA && type != KEY_ED25519 && *bitsp < 768)
-               fatal("Key must at least be 768 bits");
+       else if (type != KEY_ECDSA && type != KEY_ED25519 && *bitsp < 1024)
+               fatal("Key must at least be 1024 bits");
        else if (type == KEY_ECDSA && sshkey_ecdsa_bits_to_nid(*bitsp) == -1)
                fatal("Invalid ECDSA key length - valid lengths are "
                    "256, 384 or 521 bits");

diff --git a/ssh.h b/ssh.h
index c94633bdce42262fcea6ff2de604856c966ff41a..4f8da5c1b9225785de9d978195c090c88640ca29 100644 (file)
--- a/ssh.h
+++ b/ssh.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh.h,v 1.79 2010/06/25 07:14:46 djm Exp $ */
+/* $OpenBSD: ssh.h,v 1.80 2015/07/03 03:49:45 djm Exp $ */
 
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -93,7 +93,7 @@
 #endif
 
 /* Minimum modulus size (n) for RSA keys. */
-#define SSH_RSA_MINIMUM_MODULUS_SIZE   768
+#define SSH_RSA_MINIMUM_MODULUS_SIZE   1024
 
 /* Listen backlog for sshd, ssh-agent and forwarding sockets */
 #define SSH_LISTEN_BACKLOG             128

diff --git a/sshd.8 b/sshd.8
index dcf20f0ea8197f5ac8042aa4480d2efdeb0cf8e0..213b5fc4315ae678d8998f5193d5182f1bb20ffe 100644 (file)
--- a/sshd.8
+++ b/sshd.8
@@ -33,8 +33,8 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $OpenBSD: sshd.8,v 1.279 2015/05/01 07:11:47 djm Exp $
-.Dd $Mdocdate: May 1 2015 $
+.\" $OpenBSD: sshd.8,v 1.280 2015/07/03 03:49:45 djm Exp $
+.Dd $Mdocdate: July 3 2015 $
 .Dt SSHD 8
 .Os
 .Sh NAME
@@ -184,15 +184,12 @@ Specifies that
 .Nm
 is being run from
 .Xr inetd 8 .
+If SSH protocol 1 is enabled,
 .Nm
-is normally not run
+should not  normally be run
 from inetd because it needs to generate the server key before it can
-respond to the client, and this may take tens of seconds.
-Clients would have to wait too long if the key was regenerated every time.
-However, with small key sizes (e.g. 512) using
-.Nm
-from inetd may
-be feasible.
+respond to the client, and this may take some time.
+Clients may have to wait too long if the key was regenerated every time.
 .It Fl k Ar key_gen_time
 Specifies how often the ephemeral protocol version 1 server key is
 regenerated (default 3600 seconds, or one hour).
@@ -287,7 +284,7 @@ used to identify the host.
 .Pp
 Forward security for protocol 1 is provided through
 an additional server key,
-normally 768 bits,
+normally 1024 bits,
 generated when the server starts.
 This key is normally regenerated every hour if it has been used, and
 is never stored on disk.

diff --git a/sshd.c b/sshd.c
index 801050013fe6ae1d2e95e6f496c528a62f955271..86b3c643bb9b69cd8e8e365a21ae1631796bebf1 100644 (file)
--- a/sshd.c
+++ b/sshd.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshd.c,v 1.452 2015/07/03 03:47:00 djm Exp $ */
+/* $OpenBSD: sshd.c,v 1.453 2015/07/03 03:49:45 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -1874,8 +1874,8 @@ main(int ac, char **av)
 #ifdef WITH_SSH1
        /* Check certain values for sanity. */
        if (options.protocol & SSH_PROTO_1) {
-               if (options.server_key_bits < 512 ||
-                   options.server_key_bits > 32768) {
+               if (options.server_key_bits < SSH_RSA_MINIMUM_MODULUS_SIZE ||
+                   options.server_key_bits > OPENSSL_RSA_MAX_MODULUS_BITS) {
                        fprintf(stderr, "Bad server key size.\n");
                        exit(1);
                }

diff --git a/sshd_config.5 b/sshd_config.5
index 5ab4318906c3e69a37536a7f21ebd1f8acc23c08..edd4cc9b9e3380cced93834f025cf5c7e8ed4011 100644 (file)
--- a/sshd_config.5
+++ b/sshd_config.5
@@ -33,8 +33,8 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $OpenBSD: sshd_config.5,v 1.204 2015/06/05 03:44:14 djm Exp $
-.Dd $Mdocdate: June 5 2015 $
+.\" $OpenBSD: sshd_config.5,v 1.205 2015/07/03 03:49:45 djm Exp $
+.Dd $Mdocdate: July 3 2015 $
 .Dt SSHD_CONFIG 5
 .Os
 .Sh NAME
@@ -1343,7 +1343,7 @@ The default is
 This option applies to protocol version 1 only.
 .It Cm ServerKeyBits
 Defines the number of bits in the ephemeral protocol version 1 server key.
-The minimum value is 512, and the default is 1024.
+The default and minimum value is 1024.
 .It Cm StreamLocalBindMask
 Sets the octal file creation mode mask
 .Pq umask