diff options
| author |   dtucker <dtucker@openbsd.org> | 2019-03-25 15:49:00 +0000 |
|---|---|---|
| committer | dtucker <dtucker@openbsd.org> | 2019-03-25 15:49:00 +0000 |
| commit | bea142b888d28c7c35ada8b7053c781d0a3abd04 (patch) | |
| tree | eb83986d0d5d242c73abb7c4c46be709a38b17a0 /usr.bin/ssh/ssh-keygen.c | |
| parent | unveiling _PATH_MASTERPASSWD_LOCK requires an "r" permission (diff) | |
| download | wireguard-openbsd-bea142b888d28c7c35ada8b7053c781d0a3abd04.tar.xz wireguard-openbsd-bea142b888d28c7c35ada8b7053c781d0a3abd04.zip | |
Increase the default RSA key size to 3072 bits. Based on the estimates
from NIST Special Publication 800-57, 3k bits provides security equivalent
to 128 bits which is the smallest symmetric cipher we enable by default.
ok markus@ deraadt@
Diffstat (limited to 'usr.bin/ssh/ssh-keygen.c')
| -rw-r--r-- | usr.bin/ssh/ssh-keygen.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/usr.bin/ssh/ssh-keygen.c b/usr.bin/ssh/ssh-keygen.c index dfdfe947a28..fdc074d30ef 100644 --- a/usr.bin/ssh/ssh-keygen.c +++ b/usr.bin/ssh/ssh-keygen.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssh-keygen.c,v 1.327 2019/02/10 16:35:41 benno Exp $ */ +/* $OpenBSD: ssh-keygen.c,v 1.328 2019/03/25 15:49:00 dtucker Exp $ */ /* * Author: Tatu Ylonen <ylo@cs.hut.fi> * Copyright (c) 1994 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland @@ -60,8 +60,11 @@ # define DEFAULT_KEY_TYPE_NAME "ed25519" #endif -/* Number of bits in the RSA/DSA key. This value can be set on the command line. */ -#define DEFAULT_BITS 2048 +/* + * Default number of bits in the RSA/DSA key. This value can be overridden + * on the command line. + */ +#define DEFAULT_BITS 3072 #define DEFAULT_BITS_DSA 1024 #define DEFAULT_BITS_ECDSA 256 |