Back to bug 2102774
| Who | When | What | Removed | Added |
|---|---|---|---|---|
| Red Hat Bugzilla | 2022-06-30 15:30:19 UTC | Pool ID | sst_security_crypto_rhel_9 | |
| Dmitry Belyavskiy | 2022-06-30 15:31:19 UTC | Depends On | 2066882 | |
| Red Hat One Jira (issues.redhat.com) | 2022-06-30 15:40:10 UTC | Link ID | Red Hat Issue Tracker RHELPLAN-126757 | |
| Alexander Sosedkin | 2022-07-19 15:05:08 UTC | Keywords | Triaged | |
| Priority | unspecified | medium | ||
| Severity | unspecified | medium | ||
| Red Hat One Jira (issues.redhat.com) | 2022-07-19 15:13:28 UTC | Link ID | Red Hat Issue Tracker CRYPTO-7937 | |
| Marek Havrila | 2022-08-10 09:30:24 UTC | CC | mhavrila | |
| Ondrej Moriš | 2022-08-10 11:37:10 UTC | Doc Type | If docs needed, set a value | No Doc Update |
| CC | omoris | |||
| QA Contact | qe-baseos-security | omoris | ||
| Red Hat Bugzilla | 2022-08-10 11:37:10 UTC | Doc Type | No Doc Update | No Doc Update |
| Alexander Sosedkin | 2022-08-15 09:59:16 UTC | Status | NEW | POST |
| Link ID | Gitlab redhat-crypto/fedora-crypto-policies/-/merge_requests/119 | |||
| Alexander Sosedkin | 2022-08-16 13:07:11 UTC | Fixed In Version | crypto-policies-20220815-1.git0fbe86f.el9 | |
| Status | POST | MODIFIED | ||
| errata-xmlrpc | 2022-08-16 13:08:48 UTC | Status | MODIFIED | ON_QA |
| Ondrej Moriš | 2022-08-18 15:07:00 UTC | Status | ON_QA | VERIFIED |
| Alexander Sosedkin | 2022-08-19 10:00:35 UTC | Doc Text | .Minimal RSA key bit length option in OpenSSH has been raised Using short RSA keys might make the system more vulnerable to attacks. Since OpenSSH has gained support for controllable RSA key minimal bit length, it now respects `min_rsa_size` property of crypto-policies by default, raising the minimum size to 2048 bits. If you're getting a `Invalid key length` error from OpenSSH, you can either switch to using longer RSA keys or, alternatively, relax the restriction with a custom subpolicy at the expense of security. For example, if the current policy as reported by `update-crypto-policies --show` is `DEFAULT`, one can define a custom subpolicy by putting `min_rsa_size@openssh = 1024` into `/etc/crypto-policies/policies/modules/RSA-OPENSSH-1024.pmod` and then apply it as follows: `update-crypto-policies --set DEFAULT:RSA-OPENSSH-1024`. | |
| Doc Type | No Doc Update | Release Note | ||
| Alexander Sosedkin | 2022-08-19 10:02:53 UTC | Doc Text | .Minimal RSA key bit length option in OpenSSH has been raised Using short RSA keys might make the system more vulnerable to attacks. Since OpenSSH has gained support for controllable RSA key minimal bit length, it now respects `min_rsa_size` property of crypto-policies by default, raising the minimum size to 2048 bits. If you're getting a `Invalid key length` error from OpenSSH, you can either switch to using longer RSA keys or, alternatively, relax the restriction with a custom subpolicy at the expense of security. For example, if the current policy as reported by `update-crypto-policies --show` is `DEFAULT`, one can define a custom subpolicy by putting `min_rsa_size@openssh = 1024` into `/etc/crypto-policies/policies/modules/RSA-OPENSSH-1024.pmod` and then apply it as follows: `update-crypto-policies --set DEFAULT:RSA-OPENSSH-1024`. | .Minimal RSA key bit length option in OpenSSH has been raised Using short RSA keys might make the system more vulnerable to attacks. Since OpenSSH has gained support for controllable RSA key minimal bit length, it now respects `min_rsa_size` property of crypto-policies by default, raising the minimum size to 2048 bits. If you're getting a `Invalid key length` error from OpenSSH, the recommended mitigation is to start using longer RSA keys. Alternatively, one can relax the restriction with a custom subpolicy at the expense of security. For example, if the current policy as reported by `update-crypto-policies --show` is `DEFAULT`, one can define a custom subpolicy by putting `min_rsa_size@openssh = 1024` into `/etc/crypto-policies/policies/modules/RSA-OPENSSH-1024.pmod` and then apply it as follows: `update-crypto-policies --set DEFAULT:RSA-OPENSSH-1024`. |
| Alexander Sosedkin | 2022-08-19 10:13:18 UTC | Doc Text | .Minimal RSA key bit length option in OpenSSH has been raised Using short RSA keys might make the system more vulnerable to attacks. Since OpenSSH has gained support for controllable RSA key minimal bit length, it now respects `min_rsa_size` property of crypto-policies by default, raising the minimum size to 2048 bits. If you're getting a `Invalid key length` error from OpenSSH, the recommended mitigation is to start using longer RSA keys. Alternatively, one can relax the restriction with a custom subpolicy at the expense of security. For example, if the current policy as reported by `update-crypto-policies --show` is `DEFAULT`, one can define a custom subpolicy by putting `min_rsa_size@openssh = 1024` into `/etc/crypto-policies/policies/modules/RSA-OPENSSH-1024.pmod` and then apply it as follows: `update-crypto-policies --set DEFAULT:RSA-OPENSSH-1024`. | .Minimal RSA key bit length option in OpenSSH has been raised Using short RSA keys might make the system more vulnerable to attacks. Since OpenSSH has gained support for limiting RSA key minimal bit length, it now respects `min_rsa_size` property of crypto-policies by default, raising the minimum size to 2048 bits. In case of connections failing with an `Invalid key length` error from OpenSSH, the recommended mitigation is to start using longer RSA keys. Alternatively, one can relax the restriction with a custom subpolicy at the expense of security. For example, if the current policy as reported by `update-crypto-policies --show` is `DEFAULT`, one can define a custom subpolicy by putting `min_rsa_size@openssh = 1024` into `/etc/crypto-policies/policies/modules/RSA-OPENSSH-1024.pmod` and then apply it as follows: `update-crypto-policies --set DEFAULT:RSA-OPENSSH-1024`. |
| Jan Fiala | 2022-09-15 18:43:19 UTC | Docs Contact | jafiala | |
| CC | jafiala | |||
| Jan Fiala | 2022-09-19 06:29:18 UTC | Doc Type | Release Note | Enhancement |
| Jan Fiala | 2022-09-21 12:51:08 UTC | Flags | needinfo?(asosedki) | |
| CC | asosedki | |||
| Doc Text | .Minimal RSA key bit length option in OpenSSH has been raised Using short RSA keys might make the system more vulnerable to attacks. Since OpenSSH has gained support for limiting RSA key minimal bit length, it now respects `min_rsa_size` property of crypto-policies by default, raising the minimum size to 2048 bits. In case of connections failing with an `Invalid key length` error from OpenSSH, the recommended mitigation is to start using longer RSA keys. Alternatively, one can relax the restriction with a custom subpolicy at the expense of security. For example, if the current policy as reported by `update-crypto-policies --show` is `DEFAULT`, one can define a custom subpolicy by putting `min_rsa_size@openssh = 1024` into `/etc/crypto-policies/policies/modules/RSA-OPENSSH-1024.pmod` and then apply it as follows: `update-crypto-policies --set DEFAULT:RSA-OPENSSH-1024`. | .Minimum RSA key length option in OpenSSH increased Using short RSA keys makes the system more vulnerable to attacks. Because OpenSSH now supports limiting RSA key minimum length, the system-wide cryptographic policies enforce the 2048-bit minimum key length for RSA by default. If you encounter OpenSSH failing connections with an `Invalid key length` error message, start using longer RSA keys. Alternatively, you can relax the restriction by using a custom subpolicy at the expense of security. For example, if the `update-crypto-policies --show` command reports that the current policy is `DEFAULT`: . Define a custom subpolicy by inserting the `min_rsa_size@openssh = 1024` parameter into the `/etc/crypto-policies/policies/modules/RSA-OPENSSH-1024.pmod` file. . Apply the custom subpolicy using the `update-crypto-policies --set DEFAULT:RSA-OPENSSH-1024` command. |
||
| Alexander Sosedkin | 2022-09-21 13:22:59 UTC | Flags | needinfo?(asosedki) | |
| Jan Fiala | 2022-09-27 07:48:18 UTC | Doc Text | .Minimum RSA key length option in OpenSSH increased Using short RSA keys makes the system more vulnerable to attacks. Because OpenSSH now supports limiting RSA key minimum length, the system-wide cryptographic policies enforce the 2048-bit minimum key length for RSA by default. If you encounter OpenSSH failing connections with an `Invalid key length` error message, start using longer RSA keys. Alternatively, you can relax the restriction by using a custom subpolicy at the expense of security. For example, if the `update-crypto-policies --show` command reports that the current policy is `DEFAULT`: . Define a custom subpolicy by inserting the `min_rsa_size@openssh = 1024` parameter into the `/etc/crypto-policies/policies/modules/RSA-OPENSSH-1024.pmod` file. . Apply the custom subpolicy using the `update-crypto-policies --set DEFAULT:RSA-OPENSSH-1024` command. | .`crypto-policies` enforces 2048-bit RSA key length minimum by default Using short RSA keys makes the system more vulnerable to attacks. Because OpenSSH now supports limiting minimum RSA key length, the system-wide cryptographic policies enforce the 2048-bit minimum key length for RSA by default. If you encounter OpenSSH failing connections with an `Invalid key length` error message, start using longer RSA keys. Alternatively, you can relax the restriction by using a custom subpolicy at the expense of security. For example, if the `update-crypto-policies --show` command reports that the current policy is `DEFAULT`: . Define a custom subpolicy by inserting the `min_rsa_size@openssh = 1024` parameter into the `/etc/crypto-policies/policies/modules/RSA-OPENSSH-1024.pmod` file. . Apply the custom subpolicy using the `update-crypto-policies --set DEFAULT:RSA-OPENSSH-1024` command. |
| Jan Fiala | 2022-09-27 08:07:45 UTC | Doc Text | .`crypto-policies` enforces 2048-bit RSA key length minimum by default Using short RSA keys makes the system more vulnerable to attacks. Because OpenSSH now supports limiting minimum RSA key length, the system-wide cryptographic policies enforce the 2048-bit minimum key length for RSA by default. If you encounter OpenSSH failing connections with an `Invalid key length` error message, start using longer RSA keys. Alternatively, you can relax the restriction by using a custom subpolicy at the expense of security. For example, if the `update-crypto-policies --show` command reports that the current policy is `DEFAULT`: . Define a custom subpolicy by inserting the `min_rsa_size@openssh = 1024` parameter into the `/etc/crypto-policies/policies/modules/RSA-OPENSSH-1024.pmod` file. . Apply the custom subpolicy using the `update-crypto-policies --set DEFAULT:RSA-OPENSSH-1024` command. | .Cryptographic policies enforce 2048-bit RSA key length minimum for OpenSSH by default Using short RSA keys makes the system more vulnerable to attacks. Because OpenSSH now supports limiting minimum RSA key length, the system-wide cryptographic policies enforce the 2048-bit minimum key length for RSA by default. If you encounter OpenSSH failing connections with an `Invalid key length` error message, start using longer RSA keys. Alternatively, you can relax the restriction by using a custom subpolicy at the expense of security. For example, if the `update-crypto-policies --show` command reports that the current policy is `DEFAULT`: . Define a custom subpolicy by inserting the `min_rsa_size@openssh = 1024` parameter into the `/etc/crypto-policies/policies/modules/RSA-OPENSSH-1024.pmod` file. . Apply the custom subpolicy using the `update-crypto-policies --set DEFAULT:RSA-OPENSSH-1024` command. |
| Jan Fiala | 2022-09-27 08:46:55 UTC | Doc Text | .Cryptographic policies enforce 2048-bit RSA key length minimum for OpenSSH by default Using short RSA keys makes the system more vulnerable to attacks. Because OpenSSH now supports limiting minimum RSA key length, the system-wide cryptographic policies enforce the 2048-bit minimum key length for RSA by default. If you encounter OpenSSH failing connections with an `Invalid key length` error message, start using longer RSA keys. Alternatively, you can relax the restriction by using a custom subpolicy at the expense of security. For example, if the `update-crypto-policies --show` command reports that the current policy is `DEFAULT`: . Define a custom subpolicy by inserting the `min_rsa_size@openssh = 1024` parameter into the `/etc/crypto-policies/policies/modules/RSA-OPENSSH-1024.pmod` file. . Apply the custom subpolicy using the `update-crypto-policies --set DEFAULT:RSA-OPENSSH-1024` command. | .`crypto-policies` enforce 2048-bit RSA key length minimum for OpenSSH by default Using short RSA keys makes the system more vulnerable to attacks. Because OpenSSH now supports limiting minimum RSA key length, the system-wide cryptographic policies enforce the 2048-bit minimum key length for RSA by default. If you encounter OpenSSH failing connections with an `Invalid key length` error message, start using longer RSA keys. Alternatively, you can relax the restriction by using a custom subpolicy at the expense of security. For example, if the `update-crypto-policies --show` command reports that the current policy is `DEFAULT`: . Define a custom subpolicy by inserting the `min_rsa_size@openssh = 1024` parameter into the `/etc/crypto-policies/policies/modules/RSA-OPENSSH-1024.pmod` file. . Apply the custom subpolicy using the `update-crypto-policies --set DEFAULT:RSA-OPENSSH-1024` command. |
| errata-xmlrpc | 2022-11-15 00:21:37 UTC | Status | VERIFIED | RELEASE_PENDING |
| errata-xmlrpc | 2022-11-15 11:12:53 UTC | Resolution | --- | ERRATA |
| Status | RELEASE_PENDING | CLOSED | ||
| Last Closed | 2022-11-15 11:12:53 UTC | |||
| errata-xmlrpc | 2022-11-15 11:13:01 UTC | Link ID | Red Hat Product Errata RHBA-2022:8279 |
Back to bug 2102774