summaryrefslogtreecommitdiff
path: root/ssh-keygen.c
Commit message (Collapse)AuthorAgeFilesLines
* - deraadt@cvs.openbsd.org 2013/09/02 22:00:34Damien Miller2013-09-141-1/+1
| | | | | | | | | | [ssh-keygen.c sshconnect1.c sshd.c] All the instances of arc4random_stir() are bogus, since arc4random() does this itself, inside itself, and has for a very long time.. Actually, this was probably reducing the entropy available. ok djm ID SYNC ONLY for portable; we don't trust other arc4random implementations to do this right.
* - mikeb@cvs.openbsd.org 2013/08/28 12:34:27Damien Miller2013-09-141-10/+15
| | | | | | | | [ssh-keygen.c] improve batch processing a bit by making use of the quite flag a bit more often and exit with a non zero code if asked to find a hostname in a known_hosts file and it wasn't there; originally from reyk@, ok djm
* - djm@cvs.openbsd.org 2013/08/13 18:33:08Damien Miller2013-08-211-2/+2
| | | | | [ssh-keygen.c] another of the same typo
* - djm@cvs.openbsd.org 2013/08/13 18:32:08Damien Miller2013-08-211-2/+2
| | | | | [ssh-keygen.c] typo in error message; from Stephan Rickauer
* - djm@cvs.openbsd.org 2013/07/20 01:44:37Damien Miller2013-07-201-2/+2
| | | | | [ssh-keygen.c ssh.c] More useful error message on missing current user in /etc/passwd
* - djm@cvs.openbsd.org 2013/07/12 05:42:03Damien Miller2013-07-181-2/+2
| | | | | | | [ssh-keygen.c] do_print_resource_record() can never be called with a NULL filename, so don't attempt (and bungle) asking for one if it has not been specified bz#2127 ok dtucker@
* - djm@cvs.openbsd.org 2013/07/12 00:20:00Damien Miller2013-07-181-3/+4
| | | | | [sftp.c ssh-keygen.c ssh-pkcs11.c] fix pointer-signedness warnings from clang/llvm-3.3; "seems nice" deraadt@
* - djm@cvs.openbsd.org 2013/05/17 00:13:13Darren Tucker2013-06-021-52/+52
| | | | | | | | | | | | | | | | | | [xmalloc.h cipher.c sftp-glob.c ssh-keyscan.c ssh.c sftp-common.c ssh-ecdsa.c auth2-chall.c compat.c readconf.c kexgexs.c monitor.c gss-genr.c cipher-3des1.c kex.c monitor_wrap.c ssh-pkcs11-client.c auth-options.c rsa.c auth2-pubkey.c sftp.c hostfile.c auth2.c servconf.c auth.c authfile.c xmalloc.c uuencode.c sftp-client.c auth2-gss.c sftp-server.c bufaux.c mac.c session.c jpake.c kexgexc.c sshconnect.c auth-chall.c auth2-passwd.c sshconnect1.c buffer.c kexecdhs.c kexdhs.c ssh-rsa.c auth1.c ssh-pkcs11.c auth2-kbdint.c kexdhc.c sshd.c umac.c ssh-dss.c auth2-jpake.c bufbn.c clientloop.c monitor_mm.c scp.c roaming_client.c serverloop.c key.c auth-rsa.c ssh-pkcs11-helper.c ssh-keysign.c ssh-keygen.c match.c channels.c sshconnect2.c addrmatch.c mux.c canohost.c kexecdhc.c schnorr.c ssh-add.c misc.c auth2-hostbased.c ssh-agent.c bufec.c groupaccess.c dns.c packet.c readpass.c authfd.c moduli.c] bye, bye xfree(); ok markus@
* - djm@cvs.openbsd.org 2013/04/19 01:01:00Damien Miller2013-04-231-1/+4
| | | | | [ssh-keygen.c] fix some memory leaks; bz#2088 ok dtucker@
* - djm@cvs.openbsd.org 2013/02/10 23:32:10Damien Miller2013-02-121-2/+2
| | | | | | | [ssh-keygen.c] append to moduli file when screening candidates rather than overwriting. allows resumption of interrupted screen; patch from Christophe Garault in bz#1957; ok dtucker@
* - jmc@cvs.openbsd.org 2013/01/18 07:59:46Damien Miller2013-01-201-2/+2
| | | | | [ssh-keygen.c] -u before -V in usage();
* - djm@cvs.openbsd.org 2013/01/17 23:00:01Damien Miller2013-01-181-7/+250
| | | | | | | | | | [auth.c key.c key.h ssh-keygen.1 ssh-keygen.c sshd_config.5] [krl.c krl.h PROTOCOL.krl] add support for Key Revocation Lists (KRLs). These are a compact way to represent lists of revoked keys and certificates, taking as little as a single bit of incremental cost to revoke a certificate by serial number. KRLs are loaded via the existing RevokedKeys sshd_config option. feedback and ok markus@
* - djm@cvs.openbsd.org 2013/01/09 05:40:17Damien Miller2013-01-091-1/+4
| | | | | [ssh-keygen.c] correctly initialise fingerprint type for fingerprinting PKCS#11 keys
* - djm@cvs.openbsd.org 2013/01/03 23:22:58Damien Miller2013-01-091-6/+21
| | | | | | [ssh-keygen.c] allow fingerprinting of keys hosted in PKCS#11 tokens: ssh-keygen -lD ... ok markus@
* - djm@cvs.openbsd.org 2012/12/03 00:14:06Damien Miller2012-12-031-2/+2
| | | | | [auth2-chall.c ssh-keygen.c] Fix compilation with -Wall -Werror (trivial type fixes)
* - djm@cvs.openbsd.org 2012/11/14 02:32:15Damien Miller2012-11-141-5/+7
| | | | | [ssh-keygen.c] allow the full range of unsigned serial numbers; 'fine' deraadt@
* - djm@cvs.openbsd.org 2012/10/02 07:07:45Darren Tucker2012-10-051-2/+2
| | | | | [ssh-keygen.c] fix -z option, broken in revision 1.215
* - djm@cvs.openbsd.org 2012/08/17 01:25:58Darren Tucker2012-09-061-5/+17
| | | | | | [ssh-keygen.c] print details of which host lines were deleted when using "ssh-keygen -R host"; ok markus@
* - jmc@cvs.openbsd.org 2012/07/06 06:38:03Damien Miller2012-07-311-2/+2
| | | | | [ssh-keygen.c] missing full stop in usage();
* - dtucker@cvs.openbsd.org 2012/07/06 00:41:59Damien Miller2012-07-061-6/+16
| | | | | | | [moduli.c ssh-keygen.1 ssh-keygen.c] Add options to specify starting line number and number of lines to process when screening moduli candidates. This allows processing of different parts of a candidate moduli file in parallel. man page help jmc@, ok djm@
* - djm@cvs.openbsd.org 2012/05/23 03:28:28Damien Miller2012-06-201-1/+3
| | | | | | [dns.c dns.h key.c key.h ssh-keygen.c] add support for RFC6594 SSHFP DNS records for ECDSA key types. patch from bugzilla-m67 AT nulld.me in bz#1978; ok + tweak markus@
* - djm@cvs.openbsd.org 2012/02/29 11:21:26Damien Miller2012-04-221-5/+7
| | | | | [ssh-keygen.c] allow conversion of RSA1 keys to public PEM and PKCS8; "nice" markus@
* - (djm) [ssh-keygen.c] Don't fail in do_gen_all_hostkeys on platformsDamien Miller2012-02-061-0/+2
| | | | that don't support ECC. Patch from Phil Oleson
* - jmc@cvs.openbsd.org 2011/10/16 15:02:41Damien Miller2011-10-181-2/+2
| | | | | [ssh-keygen.c] put -K in the right place (usage());
* - dtucker@cvs.openbsd.org 2011/10/16 11:02:46Damien Miller2011-10-181-4/+12
| | | | | [moduli.c ssh-keygen.1 ssh-keygen.c] Add optional checkpoints for moduli screening. feedback & ok deraadt
* - (dtucker) [ssh-keygen.c ssh-pkcs11.c] Bug #1929: add null implementationsDarren Tucker2011-09-041-3/+0
| | | | ofsh-pkcs11.cpkcs_init and pkcs_terminate for building without dlopen support.
* - djm@cvs.openbsd.org 2011/05/04 21:15:29Damien Miller2011-05-051-4/+4
| | | | | [authfile.c authfile.h ssh-add.c] allow "ssh-add - < key"; feedback and ok markus@
* - djm@cvs.openbsd.org 2011/04/12 04:23:50Damien Miller2011-05-051-10/+10
| | | | | [ssh-keygen.c] fix -Wshadow
* - stevesk@cvs.openbsd.org 2011/03/24 22:14:54Damien Miller2011-05-051-2/+2
| | | | | [ssh-keygen.c] use strcasecmp() for "clear" cert permission option also; ok djm
* - stevesk@cvs.openbsd.org 2011/03/23 16:50:04Damien Miller2011-05-051-5/+2
| | | | | [ssh-keygen.c] remove -d, documentation removed >10 years ago; ok markus
* - stevesk@cvs.openbsd.org 2011/03/23 15:16:22Damien Miller2011-05-051-28/+138
| | | | | | | | | | [ssh-keygen.1 ssh-keygen.c] Add -A option. For each of the key types (rsa1, rsa, dsa and ecdsa) for which host keys do not exist, generate the host keys with the default key file path, an empty passphrase, default bits for the key type, and default comment. This will be used by /etc/rc to generate new host keys. Idea from deraadt. ok deraadt
* - (djm) [Makefile.in WARNING.RNG aclocal.m4 buildpkg.sh.in configure.ac]Damien Miller2011-05-051-1/+0
| | | | | | | | | [entropy.c ssh-add.c ssh-agent.c ssh-keygen.c ssh-keyscan.c] [ssh-keysign.c ssh-pkcs11-helper.c ssh-rand-helper.8 ssh-rand-helper.c] [ssh.c ssh_prng_cmds.in sshd.c contrib/aix/buildbff.sh] [regress/README.regress] Remove ssh-rand-helper and all its tentacles. PRNGd seeding has been rolled into entropy.c directly. Thanks to tim@ for testing on affected platforms.
* - djm@cvs.openbsd.org 2011/01/11 06:13:10Damien Miller2011-01-111-4/+7
| | | | | | [clientloop.c ssh-keygen.c sshd.c] some unsigned long long casts that make things a bit easier for portable without resorting to dropping PRIu64 formats everywhere
* - (djm) [servconf.c ssh-add.c ssh-keygen.c] don't look for ECDSA keys onDamien Miller2010-11-111-0/+2
| | | | | platforms that don't support ECC. Fixes some spurious warnings reported by tim@
* - djm@cvs.openbsd.org 2010/10/28 11:22:09Damien Miller2010-11-051-3/+2
| | | | | | | | | | [authfile.c key.c key.h ssh-keygen.c] fix a possible NULL deref on loading a corrupt ECDH key store ECDH group information in private keys files as "named groups" rather than as a set of explicit group parameters (by setting the OPENSSL_EC_NAMED_CURVE flag). This makes for shorter key files and retrieves the group's OpenSSL NID that we need for various things.
* - (djm) [authfd.c authfile.c bufec.c buffer.h configure.ac kex.h kexecdh.c]Damien Miller2010-09-101-0/+6
| | | | | | [kexecdhc.c kexecdhs.c key.c key.h myproposal.h packet.c readconf.c] [ssh-agent.c ssh-ecdsa.c ssh-keygen.c ssh.c] Disable ECDH and ECDSA on platforms that don't have the requisite OpenSSL support. ok dtucker@
* - naddy@cvs.openbsd.org 2010/09/02 17:21:50Damien Miller2010-09-101-2/+2
| | | | | | | [ssh-keygen.c] Switch ECDSA default key size to 256 bits, which according to RFC5656 should still be better than our current RSA-2048 default. ok djm@, markus@
* - markus@cvs.openbsd.org 2010/09/02 16:07:25Damien Miller2010-09-101-2/+4
| | | | | [ssh-keygen.c] permit -b 256, 384 or 521 as key size for ECDSA; ok djm@
* - djm@cvs.openbsd.org 2010/08/31 12:33:38Damien Miller2010-09-101-2/+2
| | | | | | | | [ssh-add.c ssh-agent.c ssh-keygen.c ssh-keysign.c ssh.c sshd.c] reintroduce commit from tedu@, which I pulled out for release engineering: OpenSSL_add_all_algorithms is the name of the function we have a man page for, so use that. ok djm
* - djm@cvs.openbsd.org 2010/08/31 11:54:45Damien Miller2010-08-311-4/+36
| | | | | | | | | | | | | | | | | | | | | | | | | [PROTOCOL PROTOCOL.agent PROTOCOL.certkeys auth2-jpake.c authfd.c] [authfile.c buffer.h dns.c kex.c kex.h key.c key.h monitor.c] [monitor_wrap.c myproposal.h packet.c packet.h pathnames.h readconf.c] [ssh-add.1 ssh-add.c ssh-agent.1 ssh-agent.c ssh-keygen.1 ssh-keygen.c] [ssh-keyscan.1 ssh-keyscan.c ssh-keysign.8 ssh.1 ssh.c ssh2.h] [ssh_config.5 sshconnect.c sshconnect2.c sshd.8 sshd.c sshd_config.5] [uuencode.c uuencode.h bufec.c kexecdh.c kexecdhc.c kexecdhs.c ssh-ecdsa.c] Implement Elliptic Curve Cryptography modes for key exchange (ECDH) and host/user keys (ECDSA) as specified by RFC5656. ECDH and ECDSA offer better performance than plain DH and DSA at the same equivalent symmetric key length, as well as much shorter keys. Only the mandatory sections of RFC5656 are implemented, specifically the three REQUIRED curves nistp256, nistp384 and nistp521 and only ECDH and ECDSA. Point compression (optional in RFC5656 is NOT implemented). Certificate host and user keys using the new ECDSA key types are supported. Note that this code has not been tested for interoperability and may be subject to change. feedback and ok markus@
* - djm@cvs.openbsd.org 2010/08/16 04:06:06Damien Miller2010-08-311-2/+2
| | | | | [ssh-add.c ssh-agent.c ssh-keygen.c ssh-keysign.c ssh.c sshd.c] backout previous temporarily; discussed with deraadt@
* - tedu@cvs.openbsd.org 2010/08/12 23:34:39Damien Miller2010-08-311-2/+2
| | | | | | [ssh-add.c ssh-agent.c ssh-keygen.c ssh-keysign.c ssh.c sshd.c] OpenSSL_add_all_algorithms is the name of the function we have a man page for, so use that. ok djm
* - djm@cvs.openbsd.org 2010/08/04 06:07:11Damien Miller2010-08-051-10/+45
| | | | | [ssh-keygen.1 ssh-keygen.c] Support CA keys in PKCS#11 tokens; feedback and ok markus@
* - djm@cvs.openbsd.org 2010/08/04 05:40:39Damien Miller2010-08-051-7/+7
| | | | | | [PROTOCOL.certkeys ssh-keygen.c] tighten the rules for certificate encoding by requiring that options appear in lexical order and make our ssh-keygen comply. ok markus@
* - OpenBSD CVS SyncDamien Miller2010-08-031-2/+2
| | | | | | - djm@cvs.openbsd.org 2010/07/16 04:45:30 [ssh-keygen.c] avoid bogus compiler warning
* - jmc@cvs.openbsd.org 2010/06/30 07:26:03Damien Miller2010-07-021-4/+4
| | | | | [ssh-keygen.c] sort usage();
* - djm@cvs.openbsd.org 2010/06/29 23:15:30Damien Miller2010-07-021-53/+228
| | | | | | [ssh-keygen.1 ssh-keygen.c] allow import (-i) and export (-e) of PEM and PKCS#8 encoded keys; bz#1749; ok markus@
* - djm@cvs.openbsd.org 2010/06/23 02:59:02Damien Miller2010-06-261-50/+46
| | | | | [ssh-keygen.c] fix printing of extensions in v01 certificates that I broke in r1.190
* - djm@cvs.openbsd.org 2010/06/22 04:32:06Damien Miller2010-06-261-65/+61
| | | | | | | [ssh-keygen.c] standardise error messages when attempting to open private key files to include "progname: filename: error reason" bz#1783; ok dtucker@
* - djm@cvs.openbsd.org 2010/05/20 23:46:02Damien Miller2010-05-211-39/+55
| | | | | | | | | | [PROTOCOL.certkeys auth-options.c ssh-keygen.c] Move the permit-* options to the non-critical "extensions" field for v01 certificates. The logic is that if another implementation fails to implement them then the connection just loses features rather than fails outright. ok markus@
View Lorry Controller Status