fix: raise wolfSSH crypto minimum - #1101
Open
MarkAtwood wants to merge 1 commit into
Open
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Raises wolfSSH’s baseline cryptographic acceptance thresholds to improve security posture, rejecting peers that negotiate below the new minimums (with build-time overrides intended for deployments that must relax them).
Changes:
- Increase DH group-exchange minimum modulus size from 1024 to 2048 bits (
WOLFSSH_DEFAULT_GEXDH_MIN). - Enforce a minimum RSA public-key size for user authentication (new
WOLFSSH_RSA_MIN_KEY_BITS, default 2048) and reject smaller keys withWS_CERT_KEY_SIZE_E.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| wolfssh/internal.h | Raises default DH GEX minimum and introduces WOLFSSH_RSA_MIN_KEY_BITS build-time minimum. |
| src/internal.c | Adds RSA user-auth raw public-key size enforcement using WOLFSSH_RSA_MIN_KEY_BITS. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
MarkAtwood
force-pushed
the
fix/wolfssh-crypto-minimums
branch
from
July 10, 2026 00:56
2470ad3 to
ac14a5c
Compare
MarkAtwood
assigned
MarkAtwood and
ejohnstown and unassigned
wolfSSL-Bot and
MarkAtwood
aidangarske
reviewed
Jul 10, 2026
aidangarske
left a comment
aidangarske
left a comment
Member
There was a problem hiding this comment.
🐺 Skoll Code Review
Overall recommendation: COMMENT
Findings: 2 total — 2 posted, 0 skipped
Posted findings
- [Low] RSA user-auth minimum accepts 2041-2047 bit keys —
src/internal.c:8217-8221 - [Medium] Add regression coverage for the new crypto minimums —
src/internal.c:8217-8222, wolfssh/internal.h:513-521
Review generated by Skoll.
ejohnstown
force-pushed
the
fix/wolfssh-crypto-minimums
branch
from
July 28, 2026 05:38
ac14a5c to
c99f52c
Compare
ejohnstown
changed the title
Raise a cryptographic minimum to current guidance. It rejects peers below the new floor by design. - Reject RSA user-authentication keys smaller than 2048 bits with WS_CERT_KEY_SIZE_E, per NIST SP 800-131A. The floor is configurable via a new WOLFSSH_RSA_MIN_KEY_BITS define (default 2048). Issue: F-6517
ejohnstown
force-pushed
the
fix/wolfssh-crypto-minimums
branch
from
July 28, 2026 05:52
c99f52c to
87a83a5
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This change raises a cryptographic minimum and rejects peers below it by design — good hardening, but calling it out explicitly since it affects interop.
Per NIST SP 800-131A; matches OpenSSH's floor. The
DoUserAuthRequestRsapath previously enforced no minimum (the cert pathDoUserAuthRequestRsaCertalready did). Added the missing check, and introduced aWOLFSSH_RSA_MIN_KEY_BITSdefine (default 2048) that both RSA auth paths now use, so the minimum is uniform and configurable. Both paths count the modulus bits withmp_count_bits()rather than scaling the encrypt size, which rounds up to a byte and would let a 2041-2047 bit key through. Smaller keys fail withWS_CERT_KEY_SIZE_E.Compatibility: deployments still using sub-2048-bit RSA keys will be rejected and must regenerate.
Split out from #1097 so the uncontroversial protocol fixes there can merge independently of this policy decision. Build-verified (
--enable-all) against wolfSSL. Reported by static analysis (Fenrir F-6517).