From ee6e2c69e1a5a32e1060320c6c1960a879a7d26f Mon Sep 17 00:00:00 2001 From: Jakub Jelen Date: Thu, 6 Nov 2025 10:18:28 +0100 Subject: [PATCH] Bump minimal RSA key size to 1024 Fixes: #326 Signed-off-by: Jakub Jelen Reviewed-by: Andreas Schneider --- include/libssh/pki.h | 2 +- src/options.c | 8 ++++---- src/pki.c | 2 +- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/include/libssh/pki.h b/include/libssh/pki.h index e8c80cdf..cfee6ac1 100644 --- a/include/libssh/pki.h +++ b/include/libssh/pki.h @@ -46,7 +46,7 @@ #define MAX_PUBKEY_SIZE 0x100000 /* 1M */ #define MAX_PRIVKEY_SIZE 0x400000 /* 4M */ -#define RSA_MIN_KEY_SIZE 768 +#define RSA_MIN_KEY_SIZE 1024 #define RSA_DEFAULT_KEY_SIZE 3072 #define SSH_KEY_FLAG_EMPTY 0x0 diff --git a/src/options.c b/src/options.c index e0f505c4..b726a863 100644 --- a/src/options.c +++ b/src/options.c @@ -593,10 +593,10 @@ int ssh_options_set_algo(ssh_session session, * - SSH_OPTIONS_RSA_MIN_SIZE * Set the minimum RSA key size in bits to be accepted by the * client for both authentication and hostkey verification. - * The values under 768 bits are not accepted even with this + * The values under 1024 bits are not accepted even with this * configuration option as they are considered completely broken. * Setting 0 will revert the value to defaults. - * Default is 1024 bits or 2048 bits in FIPS mode. + * Default is 3072 bits or 2048 bits in FIPS mode. * (int) * - SSH_OPTIONS_IDENTITY_AGENT @@ -2201,11 +2201,11 @@ static int ssh_bind_set_algo(ssh_bind sshbind, * - SSH_BIND_OPTIONS_RSA_MIN_SIZE * Set the minimum RSA key size in bits to be accepted by * the server for both authentication and hostkey - * operations. The values under 768 bits are not accepted + * operations. The values under 1024 bits are not accepted * even with this configuration option as they are * considered completely broken. Setting 0 will revert * the value to defaults. - * Default is 1024 bits or 2048 bits in FIPS mode. + * Default is 3072 bits or 2048 bits in FIPS mode. * (int) * * diff --git a/src/pki.c b/src/pki.c index 8464151e..dca3eae5 100644 --- a/src/pki.c +++ b/src/pki.c @@ -451,7 +451,7 @@ bool ssh_key_size_allowed_rsa(int min_size, ssh_key key) if (ssh_fips_mode()) { min_size = 2048; } else { - min_size = 1024; + min_size = RSA_MIN_KEY_SIZE; } } return (key_size >= min_size);