| Commit message (Collapse) | Author | Age | Files | Lines | ||
|---|---|---|---|---|---|---|
| ... | ||||||
| * | typo in error message; from Stephan Rickauer |   djm | 2013-08-13 | 1 | -2/+2 | |
| | | ||||||
| * | More useful error message on missing current user in /etc/passwd | djm | 2013-07-20 | 1 | -2/+2 | |
| | | ||||||
| * | do_print_resource_record() can never be called with a NULL filename, so | djm | 2013-07-12 | 1 | -2/+2 | |
| | | | | | | don't attempt (and bungle) asking for one if it has not been specified bz#2127 ok dtucker@ | |||||
| * | fix pointer-signedness warnings from clang/llvm-3.3; "seems nice" deraadt@ | djm | 2013-07-12 | 1 | -3/+4 | |
| | | ||||||
| * | bye, bye xfree(); ok markus@ | djm | 2013-05-17 | 1 | -52/+52 | |
| | | ||||||
| * | fix some memory leaks; bz#2088 ok dtucker@ | djm | 2013-04-19 | 1 | -1/+4 | |
| | | ||||||
| * | append to moduli file when screening candidates rather than overwriting. | djm | 2013-02-10 | 1 | -2/+2 | |
| | | | | | | allows resumption of interrupted screen; patch from Christophe Garault in bz#1957; ok dtucker@ | |||||
| * | -u before -V in usage(); |   jmc | 2013-01-18 | 1 | -2/+2 | |
| | | ||||||
| * | add support for Key Revocation Lists (KRLs). These are a compact way to | djm | 2013-01-17 | 1 | -7/+250 | |
| | | | | | | | | | represent lists of revoked keys and certificates, taking as little as a single bit of incremental cost to revoke a certificate by serial number. KRLs are loaded via the existing RevokedKeys sshd_config option. feedback and ok markus@ | |||||
| * | correctly initialise fingerprint type for fingerprinting PKCS#11 keys | djm | 2013-01-09 | 1 | -1/+4 | |
| | | ||||||
| * | allow fingerprinting of keys hosted in PKCS#11 tokens: ssh-keygen -lD ... | djm | 2013-01-03 | 1 | -6/+21 | |
| | | | | | ok markus@ | |||||
| * | Fix compilation with -Wall -Werror (trivial type fixes) | djm | 2012-12-03 | 1 | -2/+2 | |
| | | ||||||
| * | allow the full range of unsigned serial numbers; 'fine' deraadt@ | djm | 2012-11-14 | 1 | -5/+7 | |
| | | ||||||
| * | fix -z option, broken in revision 1.215 | djm | 2012-10-02 | 1 | -2/+2 | |
| | | ||||||
| * | print details of which host lines were deleted when using | djm | 2012-08-17 | 1 | -5/+17 | |
| | | | | | "ssh-keygen -R host"; ok markus@ | |||||
| * | missing full stop in usage(); | jmc | 2012-07-06 | 1 | -2/+2 | |
| | | ||||||
| * | Add options to specify starting line number and number of lines to process |   dtucker | 2012-07-06 | 1 | -6/+16 | |
| | | | | | | when screening moduli candidates. This allows processing of different parts of a candidate moduli file in parallel. man page help jmc@, ok djm@ | |||||
| * | add support for RFC6594 SSHFP DNS records for ECDSA key types. | djm | 2012-05-23 | 1 | -1/+3 | |
| | | | | | patch from bugzilla-m67 AT nulld.me in bz#1978; ok + tweak markus@ | |||||
| * | allow conversion of RSA1 keys to public PEM and PKCS8; "nice" markus@ | djm | 2012-02-29 | 1 | -5/+7 | |
| | | ||||||
| * | put -K in the right place (usage()); | jmc | 2011-10-16 | 1 | -2/+2 | |
| | | ||||||
| * | Add optional checkpoints for moduli screening. feedback & ok deraadt | dtucker | 2011-10-16 | 1 | -4/+12 | |
| | | ||||||
| * | certificate options are supposed to be packed in lexical order of option | djm | 2011-04-18 | 1 | -4/+4 | |
| | | | | | | name (though we don't actually enforce this at present). Move one up that was out of sequence | |||||
| * | fix -Wshadow | djm | 2011-04-12 | 1 | -10/+10 | |
| | | ||||||
| * | use strcasecmp() for "clear" cert permission option also; ok djm |   stevesk | 2011-03-24 | 1 | -2/+2 | |
| | | ||||||
| * | remove -d, documentation removed >10 years ago; ok markus | stevesk | 2011-03-23 | 1 | -5/+2 | |
| | | ||||||
| * | Add -A option. For each of the key types (rsa1, rsa, dsa and ecdsa) | stevesk | 2011-03-23 | 1 | -28/+138 | |
| | | | | | | | | | | for which host keys do not exist, generate the host keys with the default key file path, an empty passphrase, default bits for the key type, and default comment. This will be used by /etc/rc to generate new host keys. Idea from deraadt. ok deraadt | |||||
| * | some unsigned long long casts that make things a bit easier for | djm | 2011-01-11 | 1 | -4/+7 | |
| | | | | | portable without resorting to dropping PRIu64 formats everywhere | |||||
| * | fix a possible NULL deref on loading a corrupt ECDH key | djm | 2010-10-28 | 1 | -3/+2 | |
| | | | | | | | | store ECDH group information in private keys files as "named groups" rather than as a set of explicit group parameters (by setting the OPENSSL_EC_NAMED_CURVE flag). This makes for shorter key files and retrieves the group's OpenSSL NID that we need for various things. | |||||
| * | Switch ECDSA default key size to 256 bits, which according to RFC5656 |   naddy | 2010-09-02 | 1 | -2/+2 | |
| | | | | | | should still be better than our current RSA-2048 default. ok djm@, markus@ | |||||
| * | permit -b 256, 384 or 521 as key size for ECDSA; ok djm@ |   markus | 2010-09-02 | 1 | -2/+4 | |
| | | ||||||
| * | reintroduce commit from tedu@, which I pulled out for release engineering: | djm | 2010-08-31 | 1 | -2/+2 | |
| | | | | | | OpenSSL_add_all_algorithms is the name of the function we have a man page for, so use that. ok djm | |||||
| * | Implement Elliptic Curve Cryptography modes for key exchange (ECDH) and | djm | 2010-08-31 | 1 | -4/+36 | |
| | | | | | | | | | | | | | | | | | | host/user keys (ECDSA) as specified by RFC5656. ECDH and ECDSA offer better performance than plain DH and DSA at the same equivalent symmetric key length, as well as much shorter keys. Only the mandatory sections of RFC5656 are implemented, specifically the three REQUIRED curves nistp256, nistp384 and nistp521 and only ECDH and ECDSA. Point compression (optional in RFC5656 is NOT implemented). Certificate host and user keys using the new ECDSA key types are supported. Note that this code has not been tested for interoperability and may be subject to change. feedback and ok markus@ | |||||
| * | backout previous temporarily; discussed with deraadt@ | djm | 2010-08-16 | 1 | -2/+2 | |
| | | ||||||
| * | OpenSSL_add_all_algorithms is the name of the function we have a man page |   tedu | 2010-08-12 | 1 | -2/+2 | |
| | | | | | for, so use that. ok djm | |||||
| * | Support CA keys in PKCS#11 tokens; feedback and ok markus@ | djm | 2010-08-04 | 1 | -10/+45 | |
| | | ||||||
| * | tighten the rules for certificate encoding by requiring that options | djm | 2010-08-04 | 1 | -7/+7 | |
| | | | | | appear in lexical order and make our ssh-keygen comply. ok markus@ | |||||
| * | avoid bogus compiler warning | djm | 2010-07-16 | 1 | -2/+2 | |
| | | ||||||
| * | sort usage(); | jmc | 2010-06-30 | 1 | -4/+4 | |
| | | ||||||
| * | allow import (-i) and export (-e) of PEM and PKCS#8 encoded keys; | djm | 2010-06-29 | 1 | -53/+228 | |
| | | | | | bz#1749; ok markus@ | |||||
| * | fix printing of extensions in v01 certificates that I broke in r1.190 | djm | 2010-06-23 | 1 | -50/+46 | |
| | | ||||||
| * | standardise error messages when attempting to open private key | djm | 2010-06-22 | 1 | -65/+61 | |
| | | | | | | files to include "progname: filename: error reason" bz#1783; ok dtucker@ | |||||
| * | Move the permit-* options to the non-critical "extensions" field for v01 | djm | 2010-05-20 | 1 | -39/+55 | |
| | | | | | | | | | certificates. The logic is that if another implementation fails to implement them then the connection just loses features rather than fails outright. ok markus@ | |||||
| * | refuse to generate keys longer than OPENSSL_[RD]SA_MAX_MODULUS_BITS, | djm | 2010-04-23 | 1 | -1/+8 | |
| | | | | | since we would refuse to use them anyway. bz#1516; ok dtucker@ | |||||
| * | bz#1740: display a more helpful error message when $HOME is | djm | 2010-04-23 | 1 | -8/+14 | |
| | | | | | | inaccessible while trying to create .ssh directory. Based on patch from jchadima AT redhat.com; ok dtucker@ | |||||
| * | tweak previous; ok djm | jmc | 2010-04-16 | 1 | -2/+3 | |
| | | ||||||
| * | revised certificate format ssh-{dss,rsa}-cert-v01@openssh.com with the | djm | 2010-04-16 | 1 | -89/+146 | |
| | | | | | | | | | | | | | | | | | | | following changes: move the nonce field to the beginning of the certificate where it can better protect against chosen-prefix attacks on the signature hash Rename "constraints" field to "critical options" Add a new non-critical "extensions" field Add a serial number The older format is still support for authentication and cert generation (use "ssh-keygen -t v00 -s ca_key ..." to generate a v00 certificate) ok markus@ | |||||
| * | also print certificate type (user or host) for ssh-keygen -L | stevesk | 2010-03-15 | 1 | -2/+3 | |
| | | | | | ok djm kettenis | |||||
| * | make internal strptime string match strftime format; | djm | 2010-03-07 | 1 | -5/+5 | |
| | | | | | suggested by vinschen AT redhat.com and markus@ | |||||
| * | "force-command" is not spelled "forced-command"; spotted by | djm | 2010-03-04 | 1 | -2/+2 | |
| | | | | | imorgan AT nas.nasa.gov | |||||
| * | Add a -L flag to print the contents of a certificate; ok markus@ | djm | 2010-03-04 | 1 | -12/+103 | |
| | | ||||||
 |
index : wireguard-openbsd | |
| WireGuard implementation for the OpenBSD kernel | Matt Dunwoodie |
| summaryrefslogtreecommitdiffstats |