| Commit message (Collapse) | Author | Age | Files | Lines | ||
|---|---|---|---|---|---|---|
| ... | ||||||
| * | Expand comment to document rationale for default key sizes. |   dtucker | 2019-03-25 | 1 | -3/+10 | |
| | | | | | "seems worthwhile" deraadt. | |||||
| * | Increase the default RSA key size to 3072 bits. Based on the estimates | dtucker | 2019-03-25 | 1 | -3/+6 | |
| | | | | | | | from NIST Special Publication 800-57, 3k bits provides security equivalent to 128 bits which is the smallest symmetric cipher we enable by default. ok markus@ deraadt@ | |||||
| * | ssh-keygen -D pkcs11.so needs to initialize pkcs11 interactive, |   benno | 2019-02-10 | 1 | -2/+2 | |
| | | | | | | so it can ask for the smartcards PIN. ok markus@ | |||||
| * | allow auto-incrementing certificate serial number for certs signed |   djm | 2019-01-23 | 1 | -5/+12 | |
| | | | | | in a single commandline. | |||||
| * | move a bunch of global flag variables to main(); make the rest static | djm | 2019-01-23 | 1 | -94/+82 | |
| | | ||||||
| * | add -m to usage(); reminded by jmc@ | djm | 2019-01-22 | 1 | -3/+4 | |
| | | ||||||
| * | when printing certificate contents "ssh-keygen -Lf /path/certificate", | djm | 2018-10-19 | 1 | -3/+4 | |
| | | | | | include the algorithm that the CA used to sign the cert. | |||||
| * | garbage-collect moribund ssh_new_private() API. | djm | 2018-09-14 | 1 | -3/+3 | |
| | | ||||||
| * | hold our collective noses and use the openssl-1.1.x API in OpenSSH; | djm | 2018-09-13 | 1 | -16/+47 | |
| | | | | | feedback and ok tb@ jsing@ markus@ | |||||
| * | allow key revocation by SHA256 hash and allow ssh-keygen to create KRLs | djm | 2018-09-12 | 1 | -8/+67 | |
| | | | | | using SHA256/base64 key fingerprints; ok markus@ | |||||
| * | Use new private key format by default. This format is suported by | djm | 2018-08-08 | 1 | -3/+4 | |
| | | | | | | | | | | | OpenSSH >= 6.5 (released January 2014), so it should be supported by most OpenSSH versions in active use. It is possible to convert new-format private keys to the older format using "ssh-keygen -f /path/key -pm PEM". ok deraadt dtucker | |||||
| * | replace cast with call to sshbuf_mutable_ptr(); ok djm@ |   markus | 2018-07-09 | 1 | -2/+2 | |
| | | ||||||
| * | switch config file parsing to getline(3) as this avoids static limits | markus | 2018-06-06 | 1 | -8/+17 | |
| | | | | | noted by gerhard@; ok dtucker@, djm@ | |||||
| * | whitespace | djm | 2018-06-01 | 1 | -2/+2 | |
| | | ||||||
| * | return correct exit code when searching for and hashing known_hosts | djm | 2018-06-01 | 1 | -5/+4 | |
| | | | | | | entries in a single operation (ssh-keygen -HF hostname); bz2772 Report and fix from Anton Kremenetsky | |||||
| * | add valid-before="[time]" authorized_keys option. A simple way of | djm | 2018-03-12 | 1 | -39/+5 | |
| | | | | | giving a key an expiry date. ok markus@ | |||||
| * | Add experimental support for PQC XMSS keys (Extended Hash-Based Signatures) | markus | 2018-02-23 | 1 | -4/+15 | |
| | | | | | | | | The code is not compiled in by default (see WITH_XMSS in Makefile.inc) Joint work with stefan-lukas_gazdag at genua.eu See https://tools.ietf.org/html/draft-irtf-cfrg-xmss-hash-based-signatures-12 ok djm@ | |||||
| * | Refuse to create a certificate with an unusable number of principals; | djm | 2018-02-10 | 1 | -1/+3 | |
| | | | | | Prompted by gdestuynder via github | |||||
| * | fatal if we're unable to write all the public key; previously we | djm | 2018-02-10 | 1 | -2/+3 | |
| | | | | | | would silently ignore errors writing the comment and terminating newline. Prompted by github PR from WillerZ; ok dtucker | |||||
| * | Remove some #ifdef notyet code from OpenSSL 0.9.8 days. |   jsing | 2018-02-07 | 1 | -23/+1 | |
| | | | | | | | | These functions have never appeared in OpenSSL and are likely never to do so. "kill it with fire" djm@ | |||||
| * | pass negotiated signing algorithm though to sshkey_verify() and | djm | 2017-12-18 | 1 | -2/+2 | |
| | | | | | | check that the negotiated algorithm matches the type in the signature (only matters for RSA SHA1/SHA2 sigs). ok markus@ | |||||
| * | allow certificate validity intervals that specify only a start or | djm | 2017-11-03 | 1 | -4/+8 | |
| | | | | | stop time (we already support specifying both or neither) | |||||
| * | When generating all hostkeys (ssh-keygen -A), clobber existing keys | djm | 2017-07-07 | 1 | -34/+72 | |
| | | | | | | | if they exist but are zero length. zero-length keys could previously be made if ssh-keygen failed part way through generating them, so avoid that case too. bz#2561 reported by Krzysztof Cieplucha; ok dtucker@ | |||||
| * | remove post-SSHv1 removal dead code from rsa.c and merge the | djm | 2017-07-01 | 1 | -3/+2 | |
| | | | | | remaining bit that it still used into ssh-rsa.c; ok markus | |||||
| * | Allow ssh-keygen to use a key held in ssh-agent as a CA when signing | djm | 2017-06-28 | 1 | -9/+67 | |
| | | | | | certificates. bz#2377 ok markus | |||||
| * | remove unused wrapper functions from key.[ch]; ok djm@ | markus | 2017-05-30 | 1 | -10/+10 | |
| | | ||||||
| * | Refuse RSA keys <1024 bits in length. Improve reporting for keys that | djm | 2017-05-07 | 1 | -8/+16 | |
| | | | | | do not meet this requirement. ok markus@ | |||||
| * | remove KEY_RSA1 | djm | 2017-04-30 | 1 | -22/+5 | |
| | | | | | ok markus@ | |||||
| * | unifdef WITH_SSH1 | djm | 2017-04-30 | 1 | -8/+1 | |
| | | | | | ok markus@ | |||||
| * | allow ssh-keygen to include arbitrary string or flag certificate | djm | 2017-04-29 | 1 | -2/+37 | |
| | | | | | extensions and critical options. ok markus@ dtucker@ | |||||
| * | ensure hostname is lower-case before hashing it; bz#2591 reported by | djm | 2017-03-10 | 1 | -1/+2 | |
| | | | | | Griff Miller II; ok dtucker@ | |||||
| * | Check l->hosts before dereferencing; fixes potential null pointer deref. | dtucker | 2017-03-06 | 1 | -2/+2 | |
| | | | | | ok djm@ | |||||
| * | linenum is unsigned long so use %lu in log formats. ok deraadt@ | dtucker | 2017-03-06 | 1 | -6/+6 | |
| | | ||||||
| * | fix ssh-keygen -H accidentally corrupting known_hosts that contained | djm | 2017-03-03 | 1 | -3/+3 | |
| | | | | | | | already-hashed entries. HKF_MATCH_HOST_HASHED is only set by hostkeys_foreach() when hostname matching is in use, so we need to look for the hash marker explicitly. | |||||
| * | Do not show rsa1 key type in usage when compiled without SSH1 support. | dtucker | 2017-02-17 | 1 | -3/+9 | |
| | | ||||||
| * | Sanitise escape sequences in key comments sent to printf but preserve | djm | 2017-02-10 | 1 | -4/+8 | |
| | | | | | valid UTF-8 when the locale supports it; bz#2520 ok dtucker@ | |||||
| * | Avoid printf %s NULL. From semarie@, OK djm@ |   millert | 2017-02-08 | 1 | -2/+5 | |
| | | ||||||
| * | Spaces->tabs. | dtucker | 2016-09-12 | 1 | -3/+3 | |
| | | ||||||
| * | Style whitespace fix. Also happens to remove a no-op diff with portable. | dtucker | 2016-09-12 | 1 | -3/+2 | |
| | | ||||||
| * | support SHA256 and SHA512 RSA signatures in certificates; | djm | 2016-05-02 | 1 | -3/+9 | |
| | | | | | ok markus@ | |||||
| * | fix signed/unsigned errors reported by clang-3.7; add | djm | 2016-05-02 | 1 | -4/+4 | |
| | | | | | | | sshbuf_dup_string() to replace a common idiom of strdup(sshbuf_ptr()) with better safety checking; feedback and ok markus@ | |||||
| * | Add a function to enable security-related malloc_options. With and ok | dtucker | 2016-02-15 | 1 | -1/+2 | |
| | | | | | deraadt@, something similar has been in the snaps for a while. | |||||
| * | use SSH_MAX_PUBKEY_BYTES consistently as buffer size when reading key | djm | 2015-12-11 | 1 | -3/+3 | |
| | | | | | files. Increase it to match the size of the buffers already being used. | |||||
| * | Remove NULL-checks before sshkey_free(). |   mmcc | 2015-12-11 | 1 | -3/+2 | |
| | | | | | ok djm@ | |||||
| * | implement SHA2-{256,512} for RSASSA-PKCS1-v1_5 signatures (user and host auth) | markus | 2015-12-04 | 1 | -2/+2 | |
| | | | | | | based on draft-rsa-dsa-sha2-256-03.txt and draft-ssh-ext-info-04.txt; with & ok djm@ | |||||
| * | do not leak temp file if there is no known_hosts file |   deraadt | 2015-11-28 | 1 | -2/+5 | |
| | | | | | from craig leres, ok djm | |||||
| * | allow comment change for all supported formats |   halex | 2015-11-20 | 1 | -4/+6 | |
| | | | | | ok djm@ | |||||
| * | trailing whitespace | djm | 2015-11-19 | 1 | -4/+4 | |
| | | ||||||
| * | move the certificate validity formatting code to sshkey.[ch] | djm | 2015-11-19 | 1 | -44/+8 | |
| | | ||||||
| * | fix "ssh-keygen -l" of private key, broken in support for | djm | 2015-11-18 | 1 | -4/+11 | |
| | | | | | multiple plain keys on stdin | |||||
 |
index : wireguard-openbsd | |
| WireGuard implementation for the OpenBSD kernel | Matt Dunwoodie |
| summaryrefslogtreecommitdiffstats |