[openssh-commits] [openssh] 03/11: upstream: when signing a certificate with an RSA key, default to

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit 4a41d245d6b13bd3882c8dc058dbd2e2b39a9f67
Author: djm at openbsd.org <djm at openbsd.org>
Date:   Fri Jan 24 00:27:04 2020 +0000

    upstream: when signing a certificate with an RSA key, default to
    
    a safe signature algorithm (rsa-sha-512) if not is explicitly specified by
    the user; ok markus@
    
    OpenBSD-Commit-ID: e05f638f0be6c0266e1d3d799716b461011e83a9
---
 ssh-keygen.c | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/ssh-keygen.c b/ssh-keygen.c
index 564c3c48..f2192edb 100644
--- a/ssh-keygen.c
+++ b/ssh-keygen.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-keygen.c,v 1.389 2020/01/24 00:00:31 djm Exp $ */
+/* $OpenBSD: ssh-keygen.c,v 1.390 2020/01/24 00:27:04 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo at cs.hut.fi>
  * Copyright (c) 1994 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -1788,10 +1788,14 @@ do_ca_sign(struct passwd *pw, const char *ca_key_path, int prefer_agent,
 	}
 	free(tmp);
 
-	if (key_type_name != NULL &&
-	    sshkey_type_from_name(key_type_name) != ca->type)  {
-		fatal("CA key type %s doesn't match specified %s",
-		    sshkey_ssh_name(ca), key_type_name);
+	if (key_type_name != NULL) {
+		if (sshkey_type_from_name(key_type_name) != ca->type) {
+			fatal("CA key type %s doesn't match specified %s",
+			    sshkey_ssh_name(ca), key_type_name);
+		}
+	} else if (ca->type == KEY_RSA) {
+		/* Default to a good signature algorithm */
+		key_type_name = "rsa-sha2-512";
 	}
 	ca_fp = sshkey_fingerprint(ca, fingerprint_hash, SSH_FP_DEFAULT);
 

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.