diff options
| author |   djm <djm@openbsd.org> | 2017-05-07 23:15:59 +0000 |
|---|---|---|
| committer | djm <djm@openbsd.org> | 2017-05-07 23:15:59 +0000 |
| commit | 654a3af37af2adf2c38e16bc892cb8e5cfc320d1 (patch) | |
| tree | 2f1ab94421136cf56d7ea268c74dd373b1f40b21 /usr.bin/ssh/ssh-rsa.c | |
| parent | Don't offer CBC ciphers by default in the client. ok markus@ (diff) | |
| download | wireguard-openbsd-654a3af37af2adf2c38e16bc892cb8e5cfc320d1.tar.xz wireguard-openbsd-654a3af37af2adf2c38e16bc892cb8e5cfc320d1.zip | |
Refuse RSA keys <1024 bits in length. Improve reporting for keys that
do not meet this requirement. ok markus@
Diffstat (limited to 'usr.bin/ssh/ssh-rsa.c')
| -rw-r--r-- | usr.bin/ssh/ssh-rsa.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/usr.bin/ssh/ssh-rsa.c b/usr.bin/ssh/ssh-rsa.c index ed881edaab0..30a0ec38575 100644 --- a/usr.bin/ssh/ssh-rsa.c +++ b/usr.bin/ssh/ssh-rsa.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssh-rsa.c,v 1.60 2016/09/12 23:39:34 djm Exp $ */ +/* $OpenBSD: ssh-rsa.c,v 1.61 2017/05/07 23:15:59 djm Exp $ */ /* * Copyright (c) 2000, 2003 Markus Friedl <markus@openbsd.org> * @@ -94,9 +94,10 @@ ssh_rsa_sign(const struct sshkey *key, u_char **sigp, size_t *lenp, else hash_alg = rsa_hash_alg_from_ident(alg_ident); if (key == NULL || key->rsa == NULL || hash_alg == -1 || - sshkey_type_plain(key->type) != KEY_RSA || - BN_num_bits(key->rsa->n) < SSH_RSA_MINIMUM_MODULUS_SIZE) + sshkey_type_plain(key->type) != KEY_RSA) return SSH_ERR_INVALID_ARGUMENT; + if (BN_num_bits(key->rsa->n) < SSH_RSA_MINIMUM_MODULUS_SIZE) + return SSH_ERR_KEY_LENGTH; slen = RSA_size(key->rsa); if (slen <= 0 || slen > SSHBUF_MAX_BIGNUM) return SSH_ERR_INVALID_ARGUMENT; @@ -167,9 +168,10 @@ ssh_rsa_verify(const struct sshkey *key, if (key == NULL || key->rsa == NULL || sshkey_type_plain(key->type) != KEY_RSA || - BN_num_bits(key->rsa->n) < SSH_RSA_MINIMUM_MODULUS_SIZE || sig == NULL || siglen == 0) return SSH_ERR_INVALID_ARGUMENT; + if (BN_num_bits(key->rsa->n) < SSH_RSA_MINIMUM_MODULUS_SIZE) + return SSH_ERR_KEY_LENGTH; if ((b = sshbuf_from(sig, siglen)) == NULL) return SSH_ERR_ALLOC_FAIL; |