Why does SSH support only 1024 bit DSA keys in 3.0?

[lukpueh]

Is there a reason why the ssh serialization module does not support DSA keys with a bit length greater than 1024 in cryptography version 3.0? I could not find any information in the corresponding PR (#5146), git log or changelog.

These are the relevant lines that were released in 3.0.

cryptography/src/cryptography/hazmat/primitives/serialization/ssh.py

Lines 330 to 333 in 143f56f

	def _validate(self, public_numbers):
	parameter_numbers = public_numbers.parameter_numbers
	if parameter_numbers.p.bit_length() != 1024:
	raise ValueError("SSH supports only 1024 bit DSA keys")

And here is a serialization/deserialization snippet that worked fine on cryptography 2.9 but raises said ValueError in 3.0:

from cryptography.hazmat.primitives.serialization import (load_ssh_public_key,
        Encoding, PublicFormat)
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives.asymmetric.dsa import generate_private_key

# Create DSA key pair with key size != 1024
dsa_key = generate_private_key(key_size=2048, backend=default_backend())

# Dump to SSH
ssh_bytes = dsa_key.public_key().public_bytes(Encoding.OpenSSH, PublicFormat.OpenSSH)

# Parse from SSH
dsa_key_parsed = load_ssh_public_key(ssh_bytes, backend=default_backend()) # BREAKS ON v3.0

# Assert that no public key info was lost in serialization
assert dsa_key.public_key().public_numbers() == dsa_key_parsed.public_numbers()

Context:
The update just broke some test code in a project I maintain (secure-systems-lab/securesystemslib#261). I'm fine in changing the test code, I just wanted to know if the change was intentional? Thanks! :)

(cc @markokr, @reaperhulk, @joshuagl)

[markokr]

Because OpenSSH supports only 1024-bit DSA keys.

If there are other SSH server that support other lengths, then it would be OK to relax it.

[ronf]

Basically, this has to do with RFC 4253 mandating that SHA-1 be used as a hash for the "ssh-dss" signature blob.

More detail about this can be found in https://bugzilla.mindrot.org/show_bug.cgi?id=1647.

[lukpueh]

Thanks for the quick reply and the pointer! I wasn't aware of that restriction.

We were using the ssh format only to store a DSA public key from a test gpg keychain as stand-alone file. gpg --export-ssh-key, which we used to create the file, didn't mind that the key was 2048 bits long, and nor did cryptography when importing the key, until now.

I guess we can close this issue.

[reaperhulk]

DSA is also slowly being deprecated and removed from the ecosystem (for example, Go: golang/go#40337). We have no plans for removal on our end at this time, but similarly we're not interested in expanding DSA support further.