[ssh_x509] disable dsa method and algorithms in ssh

[ssh_x509 at roumenpetrov.info]

Hello,


Design:
By design ssh-dss algorithm uses SHA-1 hash. For more details see rfc4253 (The Secure Shell (SSH) Transport Layer Protocol, January 2006). The r and q are 160-bit integers.

Document draft-ietf-secsh-transport-12 (January 31, 2002) defines x509v3-sign-dss algorithm algorithm but does not add restrictions. It just specify a DSS-key. Simple ssh-dss is the same final rfc4253.

In document rfc6187(X.509v3 Certificates for Secure Shell Authentication) is described algorithm x509v3-ssh-dss that uses the same signature as "ssh-dss".

The size of integers implies 1024 bit key.

With other word DSA(DSS) keys used in secure shell are 1024-bits with SHA-1 signatures.


Historical:
OpenSSL 1.0.2 released on 22 January 2015 start to use be default 2048 keys i.e, 224 bits for r and q.*

*Historically on SUSE Linux Enterprise Server 11 SP4 regression test fail. It is visible for PKIX-SSH and NSS engine as well.
OS was released on 2018-03-21.

Red Hat implements plan do disable SHA-1 digest. Help was requested on 8 Mart 2022. Actually "strong crypto settings: phase 2" moves SHA-1 to LEGACY.


Implementation:
NSS engine 4.2 (18 December 2022) adds configuration options to "support either build or test without DSA key method". Also regression tests use settings that allows legacy nss algorithms. Unfortunately this is not enough and DSA tests fail on Fedora 37 and Red Hat Enterprise Linux 9.
Remark: in NSS test explicitly use 1024-bit DSA key with SHA-1 as this is format expected in secure shell. Using SHA-256 with 1024-bit DSA pass.
Note that in PKIX-SSH identity could be obtained from OpenSSL engine or OpenSSL store2 and this is reason to use dsa sha-1 in nss tests./


Conclusion:
- support of DSA in broken in SLE_11_SP4
- DSA with SHA-1 cannot be used in RHEL9

In consequence secure shell cannot use //x509v3-ssh-dss , //x509v3-sign-dss, and //ssh-dss as either tests cannot create dsa certificate or signing operation fail.
//

Solution:
Next planed version is mayor i.e., 15.0. Default build will exclude all algorithms that use dsa keys.
Note by proposed design exclusion is at build time not at run-rime.


/Regards,
Roumen Petrov


-- 
Advanced secure shell implementation with X.509 certificate support
http://roumenpetrov.info/secsh/