Skip to content

Conversation

Eugeny
Copy link
Contributor

@Eugeny Eugeny commented Feb 24, 2025

@Eugeny Eugeny force-pushed the ssh-key-hazmat-allow-insecure-rsa-keys branch from 901370b to 8dc1cce Compare February 24, 2025 22:15
@Eugeny Eugeny marked this pull request as ready for review February 24, 2025 22:19
@tarcieri
Copy link
Member

It would probably make sense to figure out a common naming convention we can use for rsa and dsa which allows insecure cryptography

@Eugeny
Copy link
Contributor Author

Eugeny commented Feb 25, 2025

I'm fine with it either way. I've chosen the hazmat- prefix as it's used as module name for dangerous stuff elsewhere in RustCrypto (e.g. rsa). I can rename dsa to hazmat-dsa but I think the current name is better as it's in line with other algo features.

@tarcieri
Copy link
Member

Related: RustCrypto/RSA#445

@nbdd0121
Copy link

Using crate features can be dangerous as features are unified, so if one crate enables it it disable this protection for another crate. I think this should be opt-in for each use-site, rather than globally.

@tarcieri
Copy link
Member

Yeah, if we support this it would be better to have an explicit API for it (which could still be feature-gated)

@tarcieri
Copy link
Member

tarcieri commented Jun 1, 2025

We can probably remove this check entirely when the rsa crate enforces a minimum modulus size (RustCrypto/RSA#445), which is currently proposed to be 1024-bits.

@Eugeny would that be good enough for your use cases? I hope you don't actually want to use RSA keys smaller than that.

@Eugeny
Copy link
Contributor Author

Eugeny commented Jun 1, 2025

That would be perfectly fine and also aligns with what OpenSSH is doing 👍

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants