dilim/openssh-portable
1
0 Fork 0
mirror of https://github.com/openssh/openssh-portable.git synced 2026-11-06 05:16:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

upstream: disallow use of certificates signed with RSA/SHA1 in

Browse Source 
sshsig

Anthropic ANT-2026-IQ6B344U

OpenBSD-Commit-ID: 9c922381db32a3c6ea1432b67c7ca1ae578d8c36
This commit is contained in:
djm@openbsd.org authored and Damien Miller committed 2026-10-30 20:10:15 +11:00
1 parent 137e0ed524
commit 9327423571
2 files changed
+19 -3
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

ssh-keygen.1
+9 -2
View File
@@ -1,4 +1,4 @@
.\" $OpenBSD: ssh-keygen.1,v 1.242 2026/10/01 07:08:05 djm Exp $
.\" $OpenBSD: ssh-keygen.1,v 1.243 2026/10/30 02:18:03 djm Exp $
.\"
.\" Author: Tatu Ylonen <ylo@cs.hut.fi>
.\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -35,7 +35,7 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
.Dd $Mdocdate: October 1 2026 $
.Dd $Mdocdate: October 30 2026 $
.Dt SSH-KEYGEN 1
.Os
.Sh NAME
@@ -1291,6 +1291,13 @@ are case-insensitive):
.It Cm cert-authority
Indicates that this key is accepted as a certificate authority (CA) and
that certificates signed by this CA may be accepted for verification.
Certificates must be signed using one of the default
.Cm CASignatureAlgorithms
listed in
.Xr ssh_config 5 ;
in particular, certificates signed using the legacy RSA-SHA1
.Dq ssh-rsa
algorithm are not accepted.
.It Cm namespaces Ns = Ns "namespace-list"
Specifies a pattern-list of namespaces that are accepted for this key.
If this option is present, the signature namespace embedded in the
sshsig.c
+10 -1
View File
@@ -1,4 +1,4 @@
/* $OpenBSD: sshsig.c,v 1.41 2025/12/22 01:49:03 djm Exp $ */
/* $OpenBSD: sshsig.c,v 1.42 2026/10/30 02:18:03 djm Exp $ */
/*
* Copyright (c) 2019 Google LLC
*
@@ -34,6 +34,7 @@
#include "sshkey.h"
#include "match.h"
#include "digest.h"
#include "myproposal.h"
#define SIG_VERSION 0x01
#define MAGIC_PREAMBLE "SSHSIG"
@@ -918,6 +919,14 @@ check_allowed_keys_line(const char *path, u_long linenum, char *line,
debug("%s:%lu: matched key", path, linenum);
} else if (sigopts->ca && sshkey_is_cert(sign_key) &&
sshkey_equal_public(sign_key->cert->signature_key, found_key)) {
/* Ensure that the CA used an acceptable signature algorithm */
if ((r = sshkey_check_cert_sigtype(sign_key,
SSH_ALLOWED_CA_SIGALGS)) != 0) {
error("%s:%lu: certificate signed with disallowed "
"algorithm %s", path, linenum,
sign_key->cert->signature_type);
goto done;
}
if (principal) {
/* Match certificate CA key with specified principal */
if ((r = sshkey_cert_check_authority(sign_key, 0, 0,