The branch main has been updated by emaste:
URL:
https://cgit.FreeBSD.org/src/commit/?id=0b707d5fe8b6b1920eb29c6375a6be92b7e44758
commit 0b707d5fe8b6b1920eb29c6375a6be92b7e44758
Author: Ed Maste <ema...@freebsd.org>
AuthorDate: 2025-02-09 20:41:12 +0000
Commit: Ed Maste <ema...@freebsd.org>
CommitDate: 2025-02-10 20:54:25 +0000
ssh: Disable support for DSA keys
This is the upstream default -- from the 9.8p1 release notes:
Future deprecation notice
=========================
OpenSSH plans to remove support for the DSA signature algorithm in
early 2025. This release disables DSA by default at compile time.
DSA, as specified in the SSHv2 protocol, is inherently weak - being
limited to a 160 bit private key and use of the SHA1 digest. Its
estimated security level is only 80 bits symmetric equivalent.
OpenSSH has disabled DSA keys by default since 2015 but has retained
run-time optional support for them. DSA was the only mandatory-to-
implement algorithm in the SSHv2 RFCs, mostly because alternative
algorithms were encumbered by patents when the SSHv2 protocol was
specified.
This has not been the case for decades at this point and better
algorithms are well supported by all actively-maintained SSH
implementations. We do not consider the costs of maintaining DSA
in OpenSSH to be justified and hope that removing it from OpenSSH
can accelerate its wider deprecation in supporting cryptography
libraries.
This release, and its deactivation of DSA by default at compile-time,
marks the second step in our timeline to finally deprecate DSA. The
final step of removing DSA support entirely is planned for the first
OpenSSH release of 2025.
---
The config.h comment /* DSA keys explicitly enabled */ is somewhat
confusing, but this is what upstream's ./configure generates.
Reviewed by: jlduran
Relnotes: Yes
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D48910
---
crypto/openssh/config.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/crypto/openssh/config.h b/crypto/openssh/config.h
index aedacd88df10..29f73831ad7b 100644
--- a/crypto/openssh/config.h
+++ b/crypto/openssh/config.h
@@ -1977,8 +1977,8 @@
/* Define if you want to enable AIX4's authenticate function */
/* #undef WITH_AIXAUTHENTICATE */
-/* Define if to enable DSA keys. */
-#define WITH_DSA 1
+/* DSA keys explicitly enabled */
+/* #undef WITH_DSA */
/* Define if you have/want arrays (cluster-wide session management, not C
arrays) */
