| Commit message (Collapse) | Author | Age | Files | Lines | ||
|---|---|---|---|---|---|---|
| ... | ||||||
| * | Add support for certificate key types for users and hosts. |   djm | 2010-02-26 | 1 | -34/+561 | |
| | | | | | | | | | | | | | | | | | | | | | | | | | OpenSSH certificate key types are not X.509 certificates, but a much simpler format that encodes a public key, identity information and some validity constraints and signs it with a CA key. CA keys are regular SSH keys. This certificate style avoids the attack surface of X.509 certificates and is very easy to deploy. Certified host keys allow automatic acceptance of new host keys when a CA certificate is marked as trusted in ~/.ssh/known_hosts. see VERIFYING HOST KEYS in ssh(1) for details. Certified user keys allow authentication of users when the signing CA key is marked as trusted in authorized_keys. See "AUTHORIZED_KEYS FILE FORMAT" in sshd(8) for details. Certificates are minted using ssh-keygen(1), documentation is in the "CERTIFICATES" section of that manpage. Documentation on the format of certificates is in the file PROTOCOL.certkeys feedback and ok markus@ | |||||
| * | Ignore and log any Protocol 1 keys where the claimed size is not equal to |   dtucker | 2010-01-13 | 1 | -1/+7 | |
| | | | | | the actual size. Noted by Derek Martin, ok djm@ | |||||
| * | switch from 35 to the more common value of RSA_F4 == (2**16)+1 == 65537 |   markus | 2009-12-11 | 1 | -2/+2 | |
| | | | | | for the RSA public exponent; discussed with provos; ok djm@ | |||||
| * | typo in error message; ok djm@ |   stevesk | 2008-10-10 | 1 | -2/+2 | |
| | | ||||||
| * | In random art visualization, make sure to use the end marker only at the |   grunk | 2008-07-25 | 1 | -2/+3 | |
| | | | | | end. Initial diff by Dirk Loss, tweaks and ok djm@ | |||||
| * | /*NOTREACHED*/ for lint warning: | stevesk | 2008-07-07 | 1 | -1/+2 | |
| | | | | | | warning: function key_equal falls off bottom without returning value ok djm@ | |||||
| * | add key length to visual fingerprint; zap magical constants; |   otto | 2008-06-25 | 1 | -3/+3 | |
| | | | | | ok grunk@ djm@ | |||||
| * | add my copyright, ok djm@ | grunk | 2008-06-12 | 1 | -1/+2 | |
| | | ||||||
| * | We already mark the start of the worm, now also mark the end of the worm | grunk | 2008-06-12 | 1 | -3/+6 | |
| | | | | | | in our random art drawings. ok djm@ | |||||
| * | supply the key type (rsa1, rsa, dsa) as a caption in the frame of the | grunk | 2008-06-12 | 1 | -8/+16 | |
| | | | | | | | | random art. while there, stress the fact that the field base should at least be 8 characters for the pictures to make sense. comment and ok djm@ | |||||
| * | use an odd number of rows and columns and a separate start marker, looks | otto | 2008-06-12 | 1 | -5/+5 | |
| | | | | | better; ok grunk@ | |||||
| * | #define statements that are not atoms need braces around them, else they | grunk | 2008-06-11 | 1 | -5/+5 | |
| | | | | | | | | will cause trouble in some cases. Also do a computation of -1 once, and not in a loop several times. spotted by otto@ | |||||
| * | simpler way of computing the augmentations; ok grunk@ | otto | 2008-06-11 | 1 | -9/+7 | |
| | | ||||||
| * | Introduce SSH Fingerprint ASCII Visualization, a technique inspired by the | grunk | 2008-06-11 | 1 | -1/+104 | |
| | | | | | | | | | | | | | | | | | | | | | | | | graphical hash visualization schemes known as "random art", and by Dan Kaminsky's musings on the subject during a BlackOp talk at the 23C3 in Berlin. Scientific publication (original paper): "Hash Visualization: a New Technique to improve Real-World Security", Perrig A. and Song D., 1999, International Workshop on Cryptographic Techniques and E-Commerce (CrypTEC '99) http://sparrow.ece.cmu.edu/~adrian/projects/validation/validation.pdf The algorithm used here is a worm crawling over a discrete plane, leaving a trace (augmenting the field) everywhere it goes. Movement is taken from dgst_raw 2bit-wise. Bumping into walls makes the respective movement vector be ignored for this turn, thus switching to the other color of the chessboard. Graphs are not unambiguous for now, because circles in graphs can be walked in either direction. discussions with several people, help, corrections and ok markus@ djm@ | |||||
| * | Delint: remove some unreachable statements, from Bret Lambert. |   ray | 2007-07-12 | 1 | -3/+1 | |
| | | | | | OK markus@ and dtucker@. | |||||
| * | add missing checks for openssl return codes; with & ok djm@ | markus | 2006-11-06 | 1 | -7/+9 | |
| | | ||||||
| * | almost entirely get rid of the culture of ".h files that include .h files" |   deraadt | 2006-08-03 | 1 | -3/+3 | |
| | | | | | | ok djm, sort of ok stevesk makes the pain stop in one easy step | |||||
| * | move #include <stdio.h> out of includes.h | stevesk | 2006-08-01 | 1 | -1/+2 | |
| | | ||||||
| * | move #include <string.h> out of includes.h | stevesk | 2006-07-22 | 1 | -1/+3 | |
| | | ||||||
| * | Put $OpenBSD$ tags back (as comments) to replace the RCSID()s that | djm | 2006-03-25 | 1 | -0/+1 | |
| | | | | | Theo nuked - our scripts to sync -portable need them in the files | |||||
| * | introduce xcalloc() and xasprintf() failure-checked allocations functions | djm | 2006-03-25 | 1 | -6/+4 | |
| | | | | | | | | | | | and use them throughout openssh xcalloc is particularly important because malloc(nmemb * size) is a dangerous idiom (subject to integer overflow) and it is time for it to die feedback and ok deraadt@ | |||||
| * | djm did a typo | deraadt | 2006-03-20 | 1 | -1/+1 | |
| | | ||||||
| * | in a switch (), break after return or goto is stupid | deraadt | 2006-03-20 | 1 | -16/+2 | |
| | | ||||||
| * | (really) last of the Coverity diffs: avoid possible NULL deref in | djm | 2006-03-20 | 1 | -0/+2 | |
| | | | | | key_free. via elad AT netbsd.org; markus@ ok | |||||
| * | RCSID() can die | deraadt | 2006-03-19 | 1 | -1/+0 | |
| | | ||||||
| * | make this -Wsign-compare clean; ok avsm@ markus@ | djm | 2005-06-17 | 1 | -2/+2 | |
| | | ||||||
| * | use new buffer API to avoid fatal errors on corrupt keys in authorized_keys | djm | 2004-10-29 | 1 | -11/+27 | |
| | | | | | files; ok markus@ | |||||
| * | more s/illegal/invalid/ | markus | 2004-07-28 | 1 | -3/+3 | |
| | | ||||||
| * | constify. ok markus@ & djm@ |   jakob | 2003-11-10 | 1 | -19/+21 | |
| | | ||||||
| * | minor tweak: when generating the hex fingerprint, give strlcat the full bound to the buffer, and add a comment below explaining why the zero-termination is one less than the bound. |   avsm | 2003-07-09 | 1 | -2/+4 | |
| | | | | | markus@ ok | |||||
| * | int -> u_int; ok djm@, deraadt@, mouring@ | markus | 2003-06-24 | 1 | -3/+3 | |
| | | ||||||
| * | add experimental support for verifying hos keys using DNS as described | jakob | 2003-05-14 | 1 | -2/+2 | |
| | | | | | | in draft-ietf-secsh-dns-xx.txt. more information in README.dns. ok markus@ and henning@ | |||||
| * | merge ssh-dss.h ssh-rsa.h into key.h; ok deraadt@ | markus | 2003-02-12 | 1 | -3/+1 | |
| | | ||||||
| * | better debug3 message | markus | 2003-02-04 | 1 | -3/+3 | |
| | | ||||||
| * | signed vs unsigned from -pedantic; ok henning@ | markus | 2002-09-09 | 1 | -2/+3 | |
| | | ||||||
| * | don't allocate, copy, and discard if there is not interested in the data; ok deraadt@ | markus | 2002-07-04 | 1 | -10/+7 | |
| | | ||||||
| * | patch memory leaks; grendel@zeitbombe.org | deraadt | 2002-07-04 | 1 | -1/+3 | |
| | | ||||||
| * | minor KNF | deraadt | 2002-06-30 | 1 | -7/+7 | |
| | | ||||||
| * | KNF | deraadt | 2002-06-23 | 1 | -2/+8 | |
| | | ||||||
| * | add comment: | markus | 2002-05-31 | 1 | -1/+5 | |
| | | | | | | | key_verify returns 1 for a correct signature, 0 for an incorrect signature and -1 on error. CVS ---------------------------------------------------------------------- | |||||
| * | KNF whitespace | markus | 2002-03-19 | 1 | -2/+2 | |
| | | ||||||
| * | add key_demote() for ssh-privsep | markus | 2002-03-18 | 1 | -1/+44 | |
| | | ||||||
| * | add some const EVP_MD for openssl-0.9.7 | markus | 2002-02-28 | 1 | -2/+2 | |
| | | ||||||
| * | signed vs. unsigned: make size arguments u_int, ok stevesk@ | markus | 2002-02-24 | 1 | -10/+9 | |
| | | ||||||
| * | use EVP_MD_size(evp_md) and not evp_md->md_size; ok steveks@ | markus | 2002-01-25 | 1 | -7/+6 | |
| | | ||||||
| * | call fatal() for openssl allocation failures | markus | 2001-12-27 | 1 | -21/+31 | |
| | | ||||||
| * | be more careful on allocation | markus | 2001-12-25 | 1 | -1/+6 | |
| | | ||||||
| * | basic KNF done while i was looking for something else | deraadt | 2001-12-19 | 1 | -4/+4 | |
| | | ||||||
| * | minor KNF | deraadt | 2001-12-05 | 1 | -13/+14 | |
| | | ||||||
| * | mem leak | markus | 2001-11-21 | 1 | -3/+4 | |
| | | ||||||
 |
index : wireguard-openbsd | |
| WireGuard implementation for the OpenBSD kernel | Matt Dunwoodie |
| summaryrefslogtreecommitdiffstats |