[openssh-commits] [openssh] 17/87: upstream: make RequiredRSASize apply to CA keys too

[git+noreply at mindrot.org]

This is an automated email from the git hooks/post-receive script.

djm pushed a commit to branch master
in repository openssh.

commit 409167b833bc7a0e46c897ca9f3430475c5a6390
Author: djm at openbsd.org <djm at openbsd.org>
AuthorDate: Fri Oct 30 01:34:10 2026 +0000

    upstream: make RequiredRSASize apply to CA keys too
    
    Anthropic ANT-2026-8H51SIF3
    
    OpenBSD-Commit-ID: 7dde4b6633ec81b8cd0a753bf489b3381a6ec21c
---
 sshkey.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/sshkey.c b/sshkey.c
index dddfeb448..8cd9e07af 100644
--- a/sshkey.c
+++ b/sshkey.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshkey.c,v 1.165 2026/10/01 07:07:49 djm Exp $ */
+/* $OpenBSD: sshkey.c,v 1.166 2026/10/30 01:34:10 djm Exp $ */
 /*
  * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.
  * Copyright (c) 2008 Alexander von Gernler.  All rights reserved.
@@ -1455,9 +1455,16 @@ int
 sshkey_check_rsa_length(const struct sshkey *k, int min_size)
 {
 #ifdef WITH_OPENSSL
-	int nbits;
+	int r, nbits;
 
-	if (k == NULL || k->pkey == NULL ||
+	if (k == NULL)
+		return 0;
+	/* A certificate is no stronger than the CA key that signed it */
+	if (sshkey_is_cert(k) && k->cert != NULL &&
+	    (r = sshkey_check_rsa_length(k->cert->signature_key,
+	    min_size)) != 0)
+		return r;
+	if (k->pkey == NULL ||
 	    (k->type != KEY_RSA && k->type != KEY_RSA_CERT))
 		return 0;
 	nbits = EVP_PKEY_bits(k->pkey);

-- 
To stop receiving notification emails like this one, please contact
djm at mindrot.org.