From 932742357175eae87d139699d3e31c6df2e72ba2 Mon Sep 17 00:00:00 2001
From: "djm@openbsd.org" <djm@openbsd.org>
Date: Fri, 30 Oct 2026 02:18:03 +0000
Subject: [PATCH] upstream: disallow use of certificates signed with RSA/SHA1
 in

sshsig

Anthropic ANT-2026-IQ6B344U

OpenBSD-Commit-ID: 9c922381db32a3c6ea1432b67c7ca1ae578d8c36
---
 ssh-keygen.1 | 11 +++++++++--
 sshsig.c     | 11 ++++++++++-
 2 files changed, 19 insertions(+), 3 deletions(-)

diff --git a/ssh-keygen.1 b/ssh-keygen.1
index d4da3844c..5c1bc9f8b 100644
--- a/ssh-keygen.1
+++ b/ssh-keygen.1
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: ssh-keygen.1,v 1.242 2026/10/01 07:08:05 djm Exp $
+.\"	$OpenBSD: ssh-keygen.1,v 1.243 2026/10/30 02:18:03 djm Exp $
 .\"
 .\" Author: Tatu Ylonen <ylo@cs.hut.fi>
 .\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -35,7 +35,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: October 1 2026 $
+.Dd $Mdocdate: October 30 2026 $
 .Dt SSH-KEYGEN 1
 .Os
 .Sh NAME
@@ -1291,6 +1291,13 @@ are case-insensitive):
 .It Cm cert-authority
 Indicates that this key is accepted as a certificate authority (CA) and
 that certificates signed by this CA may be accepted for verification.
+Certificates must be signed using one of the default
+.Cm CASignatureAlgorithms
+listed in
+.Xr ssh_config 5 ;
+in particular, certificates signed using the legacy RSA-SHA1
+.Dq ssh-rsa
+algorithm are not accepted.
 .It Cm namespaces Ns = Ns "namespace-list"
 Specifies a pattern-list of namespaces that are accepted for this key.
 If this option is present, the signature namespace embedded in the
diff --git a/sshsig.c b/sshsig.c
index 5b267d07d..2b64a1f1c 100644
--- a/sshsig.c
+++ b/sshsig.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshsig.c,v 1.41 2025/12/22 01:49:03 djm Exp $ */
+/* $OpenBSD: sshsig.c,v 1.42 2026/10/30 02:18:03 djm Exp $ */
 /*
  * Copyright (c) 2019 Google LLC
  *
@@ -34,6 +34,7 @@
 #include "sshkey.h"
 #include "match.h"
 #include "digest.h"
+#include "myproposal.h"
 
 #define SIG_VERSION		0x01
 #define MAGIC_PREAMBLE		"SSHSIG"
@@ -918,6 +919,14 @@ check_allowed_keys_line(const char *path, u_long linenum, char *line,
 		debug("%s:%lu: matched key", path, linenum);
 	} else if (sigopts->ca && sshkey_is_cert(sign_key) &&
 	    sshkey_equal_public(sign_key->cert->signature_key, found_key)) {
+		/* Ensure that the CA used an acceptable signature algorithm */
+		if ((r = sshkey_check_cert_sigtype(sign_key,
+		    SSH_ALLOWED_CA_SIGALGS)) != 0) {
+			error("%s:%lu: certificate signed with disallowed "
+			    "algorithm %s", path, linenum,
+			    sign_key->cert->signature_type);
+			goto done;
+		}
 		if (principal) {
 			/* Match certificate CA key with specified principal */
 			if ((r = sshkey_cert_check_authority(sign_key, 0, 0,