Skip to content

Commit

Permalink
Enable HostKeyTest to extract ECDSA and DSA keys
Browse files Browse the repository at this point in the history
Their certificate-embedded counterparts are enabled as well.

As with RSA, it *is* possible for DSA keys to be of variable length (not
just 1024 bits), so I've added `{'variable_key_len': True}` to the relevant
`HOST_KEY_TYPES` entries, although this key-value pair is otherwise unused.
  • Loading branch information
dlenskiSB committed Jul 8, 2024
1 parent 9049c84 commit 574a53d
Showing 1 changed file with 11 additions and 0 deletions.
11 changes: 11 additions & 0 deletions src/ssh_audit/hostkeytest.py
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,17 @@ class HostKeyTest:

'ssh-ed448': {'cert': False, 'variable_key_len': False},
# '[email protected]': {'cert': True, 'variable_key_len': False},

'ecdsa-sha2-nistp256': {'cert': False, 'variable_key_len': False},
'ecdsa-sha2-nistp384': {'cert': False, 'variable_key_len': False},
'ecdsa-sha2-nistp521': {'cert': False, 'variable_key_len': False},

'[email protected]': {'cert': True, 'variable_key_len': False},
'[email protected]': {'cert': True, 'variable_key_len': False},
'[email protected]': {'cert': True, 'variable_key_len': False},

'ssh-dss': {'cert': False, 'variable_key_len': True},
'[email protected]': {'cert': True, 'variable_key_len': True},
}

TWO2K_MODULUS_WARNING = '2048-bit modulus only provides 112-bits of symmetric strength'
Expand Down

0 comments on commit 574a53d

Please sign in to comment.