diff options
| author | Justus Winter <[email protected]> | 2017-05-24 15:48:42 +0000 |
|---|---|---|
| committer | Justus Winter <[email protected]> | 2017-05-24 16:09:07 +0000 |
| commit | 525f2c482abb6bc2002eb878b03558fb43e6b004 (patch) | |
| tree | dca357392ca690afe00cf387bd6fce011a74b023 /doc/gpg-agent.texi | |
| parent | agent: Write both ssh fingerprints to 'sshcontrol' file. (diff) | |
| download | gnupg-525f2c482abb6bc2002eb878b03558fb43e6b004.tar.gz gnupg-525f2c482abb6bc2002eb878b03558fb43e6b004.zip | |
agent: Make digest algorithms for ssh fingerprints configurable.
* agent/agent.h (opt): New field 'ssh_fingerprint_digest'.
* agent/command-ssh.c (data_sign, ssh_identity_register): Honor the
option for strings used to communicate with the user.
* agent/findkey.c (agent_modify_description): Likewise.
* agent/gpg-agent.c (cmd_and_opt_values): New value.
(opts): New option '--ssh-fingerprint-digest'.
(parse_rereadable_options): Set the default to MD5 for now.
(main): Handle the new option.
* doc/gpg-agent.texi: Document the new option.
--
OpenSSH has transitioned from using MD5 to compute key fingerprints to
SHA256. This patch makes the digest used when communicating key
fingerprints to the user (e.g. in pinentry dialogs) configurable.
For now this patch conservatively defaults to MD5.
GnuPG-bug-id: 2106
Signed-off-by: Justus Winter <[email protected]>
Diffstat (limited to 'doc/gpg-agent.texi')
| -rw-r--r-- | doc/gpg-agent.texi | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/doc/gpg-agent.texi b/doc/gpg-agent.texi index 6ed0ff87e..d61dc85ae 100644 --- a/doc/gpg-agent.texi +++ b/doc/gpg-agent.texi @@ -636,6 +636,13 @@ and allows the use of gpg-agent with the ssh implementation @command{putty}. This is similar to the regular ssh-agent support but makes use of Windows message queue as required by @command{putty}. +@anchor{option --ssh-fingerprint-digest} +@item --ssh-fingerprint-digest +@opindex ssh-fingerprint-digest + +Select the digest algorithm used to compute ssh fingerprints that are +communicated to the user, e.g. in pinentry dialogs. OpenSSH has +transitioned from using MD5 to the more secure SHA256. @end table |