changeset 457:e430a26064ee DROPBEAR_0.50

Make dropbearkey only generate 1024 bit keys
author Matt Johnston <matt@ucc.asn.au>
date Wed, 08 Aug 2007 15:57:50 +0000
parents f6c999ba31da
children c1e9c81d1d27 f4addc06745b
files CHANGES dropbearkey.c
diffstat 2 files changed, 10 insertions(+), 2 deletions(-) [+]
line wrap: on
line diff
--- a/CHANGES	Wed Aug 08 15:48:52 2007 +0000
+++ b/CHANGES	Wed Aug 08 15:57:50 2007 +0000
@@ -21,6 +21,10 @@
 - Add -K <keepalive_time> argument, ensuring that data is transmitted
   over the connection at least every N seconds.
 
+- dropbearkey will no longer generate DSS keys of sizes other than 1024
+  bits, as required by the DSS specification. (Other sizes are still
+  accepted for use to provide backwards compatibility).
+
 0.49 - Fri 23 February 2007
 
 - Security: dbclient previously would prompt to confirm a 
--- a/dropbearkey.c	Wed Aug 08 15:48:52 2007 +0000
+++ b/dropbearkey.c	Wed Aug 08 15:57:50 2007 +0000
@@ -75,6 +75,7 @@
 #endif
 					"-f filename	Use filename for the secret key\n"
 					"-s bits	Key size in bits, should be a multiple of 8 (optional)\n"
+					"           (DSS has a fixed size of 1024 bits)\n"
 					"-y		Just print the publickey and fingerprint for the\n		private key in <filename>.\n"
 #ifdef DEBUG_TRACE
 					"-v		verbose\n"
@@ -187,8 +188,11 @@
 			fprintf(stderr, "Bits must be an integer\n");
 			exit(EXIT_FAILURE);
 		}
-	
-		if (bits < 512 || bits > 4096 || (bits % 8 != 0)) {
+		
+		if (keytype == DROPBEAR_SIGNKEY_DSS && bits != 1024) {
+			fprintf(stderr, "DSS keys have a fixed size of 1024 bits\n");
+			exit(EXIT_FAILURE);			
+		} else if (bits < 512 || bits > 4096 || (bits % 8 != 0)) {
 			fprintf(stderr, "Bits must satisfy 512 <= bits <= 4096, and be a"
 					" multiple of 8\n");
 			exit(EXIT_FAILURE);