Commit Graph

228 Commits

Author SHA1 Message Date
naddy@openbsd.org 579d9adb70
upstream: remove one more mention of DSA
OpenBSD-Commit-ID: 8515f55a15f02836ba657df341415f63c60526ca
2024-06-20 10:19:09 +10:00
djm@openbsd.org 00eb95957d
upstream: disable the DSA signature algorithm by default; ok
markus@

(yes, I know this expands to "the Digitial Signature Algorithm
signature algorithm)

OpenBSD-Commit-ID: 961ef594e46dd2dcade8dd5721fa565cee79ffed
2024-06-17 18:48:29 +10:00
job@openbsd.org e1c284d60a
upstream: Generate Ed25519 keys when invoked without arguments
Ed25519 public keys are very convenient due to their small size.
OpenSSH has supported Ed25519 since version 6.5 (January 2014).

OK djm@ markus@ sthen@ deraadt@

OpenBSD-Commit-ID: f498beaad19c8cdcc357381a60df4a9c69858b3f
2023-09-07 09:53:59 +10:00
naddy@openbsd.org 076aeda86a
upstream: man page typos; ok jmc@
OpenBSD-Commit-ID: e6ddfef94b0eb867ad88abe07cedc8ed581c07f0
2023-07-27 09:11:21 +10:00
jmc@openbsd.org d39a96f70f
upstream: space between macro and punctuation;
OpenBSD-Commit-ID: abc95e550be9e6d9a7ff64b65c104c7be21ab19e
2023-02-16 21:11:35 +11:00
djm@openbsd.org d651f5c9fe
upstream: let ssh-keygen and ssh-keyscan accept
-Ohashalg=sha1|sha256 when outputting SSHFP fingerprints to allow algorithm
selection. bz3493 ok dtucker@

OpenBSD-Commit-ID: e6e07fe21318a873bd877f333e189eb963a11b3d
2023-02-10 16:12:42 +11:00
jsg@openbsd.org 86af013b56
upstream: fix repeated words ok miod@ jmc@
OpenBSD-Commit-ID: 6765daefe26a6b648cc15cadbbe337596af709b7
2022-09-14 10:16:04 +10:00
jmc@openbsd.org edb0bcb3c7 upstream: use .Cm for "sign"; from josiah frentsos
OpenBSD-Commit-ID: 7f80a53d54857ac6ae49ea6ad93c5bd12231d1e4
2022-08-17 16:03:01 +10:00
djm@openbsd.org ec1ddb72a1 upstream: allow certificate validity intervals, sshsig verification
times and authorized_keys expiry-time options to accept dates in the UTC time
zone in addition to the default of interpreting them in the system time zone.
YYYYMMDD and YYMMDDHHMM[SS] dates/times will be interpreted as UTC if
suffixed with a 'Z' character.

Also allow certificate validity intervals to be specified in raw
seconds-since-epoch as hex value, e.g. -V 0x1234:0x4567890. This
is intended for use by regress tests and other tools that call
ssh-keygen as part of a CA workflow.

bz3468 ok dtucker

OpenBSD-Commit-ID: 454db1cdffa9fa346aea5211223a2ce0588dfe13
2022-08-11 12:00:49 +10:00
dtucker@openbsd.org 88e376fcd6 upstream: ssh-keygen -A: do not generate DSA keys by default.
Based on github PR#303 from jsegitz with man page text from jmc@, ok markus@
djm@

OpenBSD-Commit-ID: 5c4c57bdd7063ff03381cfb6696659dd3f9f5b9f
2022-06-03 13:38:19 +10:00
djm@openbsd.org 0086a286ea upstream: Allow existing -U (use agent) flag to work with "-Y sign"
operations, where it will be interpreted to require that the private keys is
hosted in an agent; bz3429, suggested by Adam Szkoda; ok dtucker@

OpenBSD-Commit-ID: a7bc69873b99c32c42c7628ed9ea91565ba08c2f
2022-05-09 13:11:03 +10:00
florian@openbsd.org e5c036d209 upstream: Add FIDO AUTHENTICATOR section and explain a bit how FIDO
works. The wording came mostly from the 8.2 OpenSSH release notes, addapted
to fit the man page. Then move the -O bits into the new section as is already
done for CERTIFICATES and MODULI GENERATION. Finally we can explain the
trade-offs of resident keys. While here, consistently refer to the FIDO
thingies as "FIDO authenticators", not "FIDO tokens".

input & OK jmc, naddy

OpenBSD-Commit-ID: dd98748d7644df048f78dcf793b3b63db9ab1d25
2022-05-05 11:34:52 +10:00
jsg@openbsd.org 86cc93fd3c upstream: remove please from manual pages ok jmc@ sthen@ millert@
OpenBSD-Commit-ID: 6543acb00f4f38a23472538e1685c013ca1a99aa
2022-02-07 12:27:48 +11:00
djm@openbsd.org 2327c306b5 upstream: allow selection of hash at sshsig signing time; code
already supported either sha512 (default) or sha256, but plumbing wasn't
there mostly by Linus Nordberg

OpenBSD-Commit-ID: 1b536404b9da74a84b3a1c8d0b05fd564cdc96cd
2022-01-05 16:06:01 +11:00
djm@openbsd.org 9e3227d4db upstream: ssh-keygen -Y match-principals doesn't accept any -O
options at present, so don't say otherwise in SYNOPSIS; spotted jmc@

OpenBSD-Commit-ID: 9cc43a18f4091010741930b48b3db2f2e4f1d35c
2021-11-28 18:28:08 +11:00
djm@openbsd.org 78230b3ec8 upstream: Add ssh-keygen -Y match-principals operation to perform
matching of principals names against an allowed signers file.

Requested by and mostly written by Fabian Stelzer, towards a TOFU
model for SSH signatures in git. Some tweaks by me.

"doesn't bother me" deraadt@

OpenBSD-Commit-ID: 8d1b71f5a4127bc5e10a880c8ea6053394465247
2021-11-27 18:22:41 +11:00
djm@openbsd.org b9f4635ea5 upstream: when verifying sshsig signatures, support an option
(-Oprint-pubkey) to dump the full public key to stdout; based on patch from
Fabian Stelzer; ok markus@

OpenBSD-Commit-ID: 0598000e5b9adfb45d42afa76ff80daaa12fc3e2
2021-08-11 18:56:29 +10:00
jmc@openbsd.org db2130e234 upstream: punctuation;
OpenBSD-Commit-ID: 64be152e378c45975073ab1c07e0db7eddd15806
2021-07-24 12:30:58 +10:00
djm@openbsd.org d0bb1ce731 upstream: Let allowed signers files used by ssh-keygen(1)
signatures support key lifetimes, and allow the verification mode to specify
a signature time to check at. This is intended for use by git to support
signing objects using ssh keys. ok dtucker@

OpenBSD-Commit-ID: 3e2c67b7dcd94f0610194d1e8e4907829a40cf31
2021-07-23 14:07:19 +10:00
dtucker@openbsd.org d1320c492f upstream: Clarify language about moduli. While both ends of the
connection do need to use the same parameters (ie groups), the DH-GEX
protocol takes care of that and both ends do not need the same contents in
the moduli file, which is what the previous text suggested.  ok djm@ jmc@

OpenBSD-Commit-ID: f0c18cc8e79c2fbf537a432a9070ed94e96a622a
2021-05-14 08:14:41 +10:00
dtucker@openbsd.org 57bf03f021 upstream: Document ssh-keygen -Z, sanity check its argument earlier and
provide a better error message if it's not correct.  Prompted by bz#2879, ok
djm@ jmc@

OpenBSD-Commit-ID: 484178a173e92230fb1803fb4f206d61f7b58005
2020-11-27 21:37:17 +11:00
dtucker@openbsd.org 85cceda21f upstream: Specify that the KDF function is bcrypt. Based on github
PR#214 from rafork, ok markus@, mdoc correction jmc@

OpenBSD-Commit-ID: d8f2853e7edbcd483f31b50da77ab80ffa18b4ef
2020-11-17 22:34:57 +11:00
dtucker@openbsd.org 492d70e18b upstream: Minor man page fixes (capitalization, commas) identified by
the manpage-l10n project via bz#3223.  feedback deraadt@, ok jmc@

OpenBSD-Commit-ID: ab83af0daf18369244a72daaec6c4a58a9eb7e2c
2020-10-26 12:15:52 +11:00
djm@openbsd.org c767735241 upstream: when writing an attestation blob for a FIDO key, record all
the data needed to verify the attestation. Previously we were missing the
"authenticator data" that is included in the signature.

spotted by Ian Haken
feedback Pedro Martelletto and Ian Haken; ok markus@

OpenBSD-Commit-ID: 8439896e63792b2db99c6065dd9a45eabbdb7e0a
2020-09-09 13:11:34 +10:00
jmc@openbsd.org 744df42a12 upstream: tweak previous;
OpenBSD-Commit-ID: 92714b6531e244e4da401b2defaa376374e24be7
2020-08-27 19:47:35 +10:00
djm@openbsd.org 0caff05350 upstream: Request PIN ahead of time for certain FIDO actions
When we know that a particular action will require a PIN, such as
downloading resident keys or generating a verify-required key, request
the PIN before attempting it.

joint work with Pedro Martelletto; ok markus@

OpenBSD-Commit-ID: 863182d38ef075bad1f7d20ca485752a05edb727
2020-08-27 11:28:36 +10:00
djm@openbsd.org 9b8ad93824 upstream: support for user-verified FIDO keys
FIDO2 supports a notion of "user verification" where the user is
required to demonstrate their identity to the token before particular
operations (e.g. signing). Typically this is done by authenticating
themselves using a PIN that has been set on the token.

This adds support for generating and using user verified keys where
the verification happens via PIN (other options might be added in the
future, but none are in common use now). Practically, this adds
another key generation option "verify-required" that yields a key that
requires a PIN before each authentication.

feedback markus@ and Pedro Martelletto; ok markus@

OpenBSD-Commit-ID: 57fd461e4366f87c47502c5614ec08573e6d6a15
2020-08-27 11:28:36 +10:00
solene@openbsd.org dbaaa01dae upstream: - Add [-a rounds] in ssh-keygen man page and usage() -
Reorder parameters list in the first usage() case - Sentence rewording

ok dtucker@
jmc@ noticed usage() missed -a flag too

OpenBSD-Commit-ID: f06b9afe91cc96f260b929a56e9930caecbde246
2020-07-17 13:23:34 +10:00
dtucker@openbsd.org fec89f32a8 upstream: Add default for number of rounds (-a). ok djm@
OpenBSD-Commit-ID: cb7e9aa04ace01a98e63e4bd77f34a42ab169b15
2020-07-15 15:08:10 +10:00
djm@openbsd.org 6ec7457171 upstream: give ssh-keygen the ability to dump the contents of a
binary key revocation list: ssh-keygen -lQf /path bz#3132; ok dtucker

OpenBSD-Commit-ID: b76afc4e3b74ab735dbde4e5f0cfa1f02356033b
2020-04-03 13:33:25 +11:00
dtucker@openbsd.org 7eb903f51e upstream: Fix typo. Patch from itoama at live.jp via github PR#173.
OpenBSD-Commit-ID: 5cdaafab38bbdea0d07e24777d00bfe6f972568a
2020-02-24 17:14:00 +11:00
djm@openbsd.org 963d71851e upstream: sync the description of the $SSH_SK_PROVIDER environment
variable with that of the SecurityKeyProvider ssh/sshd_config(5) directive,
as the latter was more descriptive.

OpenBSD-Commit-ID: 0488f09530524a7e53afca6b6e1780598022552f
2020-02-07 15:03:20 +11:00
djm@openbsd.org d596b1d30d upstream: require FIDO application strings to start with "ssh:"; ok
markus@

OpenBSD-Commit-ID: 94e9c1c066d42b76f035a3d58250a32b14000afb
2020-02-04 21:08:10 +11:00
jmc@openbsd.org 072f3b832d upstream: use better markup for challenge and write-attestation, and
rejig the challenge text a little;

ok djm

OpenBSD-Commit-ID: 9f351e6da9edfdc907d5c3fdaf2e9ff3ab0a7a6f
2020-02-04 10:00:18 +11:00
jmc@openbsd.org 0facae7bc8 upstream: shuffle the challenge keyword to keep the -O list sorted;
OpenBSD-Commit-ID: 08efad608b790949a9a048d65578fae9ed5845fe
2020-02-02 20:25:09 +11:00
djm@openbsd.org 24c0f752ad upstream: changes to support FIDO attestation
Allow writing to disk the attestation certificate that is generated by
the FIDO token at key enrollment time. These certificates may be used
by an out-of-band workflow to prove that a particular key is held in
trustworthy hardware.

Allow passing in a challenge that will be sent to the card during
key enrollment. These are needed to build an attestation workflow
that resists replay attacks.

ok markus@

OpenBSD-Commit-ID: 457dc3c3d689ba39eed328f0817ed9b91a5f78f6
2020-01-29 18:52:55 +11:00
djm@openbsd.org 72a8bea2d7 upstream: ssh-keygen -Y find-principals fixes based on feedback
from Markus:

use "principals" instead of principal, as allowed_signers lines may list
multiple.

When the signing key is a certificate, emit only principals that match
the certificate principal list.

NB. the command -Y name changes: "find-principal" => "find-principals"

ok markus@

OpenBSD-Commit-ID: ab575946ff9a55624cd4e811bfd338bf3b1d0faf
2020-01-25 11:27:29 +11:00
jmc@openbsd.org 5533c2fb7e upstream: new sentence, new line;
OpenBSD-Commit-ID: b6c3f2f36ec77e99198619b38a9f146655281925
2020-01-23 18:51:25 +11:00
djm@openbsd.org 56cffcc09f upstream: add a new signature operations "find-principal" to look
up the principal associated with a signature from an allowed-signers file.
Work by Sebastian Kinne; ok dtucker@

OpenBSD-Commit-ID: 6f782cc7e18e38fcfafa62af53246a1dcfe74e5d
2020-01-23 13:45:24 +11:00
naddy@openbsd.org b715fdc71b upstream: one more replacement "(security) key" -> "(FIDO)
authenticator"

OpenBSD-Commit-ID: 031bca03c1d1f878ab929facd561911f1bc68dfd
2020-01-21 18:09:09 +11:00
naddy@openbsd.org 84911da1be upstream: undo merge error and replace the term "security key"
again

OpenBSD-Commit-ID: 341749062c089cc360a7877e9ee3a887aecde395
2020-01-21 18:09:09 +11:00
naddy@openbsd.org 0d005d6372 upstream: sync ssh-keygen.1 and ssh-keygen's usage() with each
other and reality ok markus@

OpenBSD-Commit-ID: cdf64454f2c3604c25977c944e5b6262a3bcce92
2020-01-21 18:09:09 +11:00
jmc@openbsd.org cd53476383 upstream: put the fido options in a list, and tidy up the text a
little; ok djm

OpenBSD-Commit-ID: 491ce15ae52a88b7a6a2b3b6708a14b4aacdeebb
2020-01-09 21:29:19 +11:00
djm@openbsd.org c312ca077c upstream: Extends the SK API to accept a set of key/value options
for all operations. These are intended to future-proof the API a little by
making it easier to specify additional fields for without having to change
the API version for each.

At present, only two options are defined: one to explicitly specify
the device for an operation (rather than accepting the middleware's
autoselection) and another to specify the FIDO2 username that may
be used when generating a resident key. These new options may be
invoked at key generation time via ssh-keygen -O

This also implements a suggestion from Markus to avoid "int" in favour
of uint32_t for the algorithm argument in the API, to make implementation
of ssh-sk-client/helper a little easier.

feedback, fixes and ok markus@

OpenBSD-Commit-ID: 973ce11704609022ab36abbdeb6bc23c8001eabc
2020-01-06 13:12:46 +11:00
jmc@openbsd.org c593cc5e82 upstream: the download resident keys option is -K (upper) not -k
(lower); ok djm

OpenBSD-Commit-ID: 71dc28a3e1fa7c553844abc508845bcf5766e091
2020-01-04 10:15:03 +11:00
djm@openbsd.org 9039971887 upstream: ability to download FIDO2 resident keys from a token via
"ssh-keygen -K". This will save public/private keys into the current
directory.

This is handy if you move a token between hosts.

feedback & ok markus@

OpenBSD-Commit-ID: d57c1f9802f7850f00a117a1d36682a6c6d10da6
2020-01-03 09:43:24 +11:00
jmc@openbsd.org 3b1382ffd5 upstream: simplify the list for moduli options - no need for
-compact;

OpenBSD-Commit-ID: 6492c72280482c6d072be46236b365cb359fc280
2020-01-03 09:41:20 +11:00
djm@openbsd.org 3093d12ff8 upstream: Remove the -x option currently used for
FIDO/U2F-specific key flags. Instead these flags may be specified via -O.

ok markus@

OpenBSD-Commit-ID: f23ebde2a8a7e1bf860a51055a711cffb8c328c1
2019-12-30 21:02:29 +11:00
djm@openbsd.org 3e60d18fba upstream: remove single-letter flags for moduli options
Move all moduli generation options to live under the -O flag.

Frees up seven single-letter flags.

NB. this change break existing ssh-keygen commandline syntax for moduli-
related operations. Very few people use these fortunately.

feedback and ok markus@

OpenBSD-Commit-ID: d498f3eaf28128484826a4fcb343612764927935
2019-12-30 14:33:54 +11:00
djm@openbsd.org 1e645fe767 upstream: prepare for use of ssh-keygen -O flag beyond certs
Move list of available certificate options in ssh-keygen.1 to the
CERTIFICATES section.

Collect options specified by -O but delay parsing/validation of
certificate options until we're sure that we're acting as a CA.

ok markus@

OpenBSD-Commit-ID: 33e6bcc29cfca43606f6fa09bd84b955ee3a4106
2019-12-30 14:32:20 +11:00