The largest ECDSA key has 521 bits

Signed-off-by: Jakub Jelen <jjelen@redhat.com>
Reviewed-by: Andreas Schneider <asn@cryptomilk.org>

src/pki.c

@@ -1538,7 +1538,7 @@ int ssh_pki_import_cert_file(const char *filename, ssh_key *pkey)
  * @param[in] parameter Parameter to the creation of key:
  *                      rsa : length of the key in bits (e.g. 1024, 2048, 4096)
  *                      dsa : length of the key in bits (e.g. 1024, 2048, 3072)
- *                      ecdsa : bits of the key (e.g. 256, 384, 512)
+ *                      ecdsa : bits of the key (e.g. 256, 384, 521)
  * @param[out] pkey     A pointer to store the allocated private key. You need
  *                      to free the memory.
  *

src/pki_crypto.c

@@ -558,7 +558,7 @@ int pki_key_generate_ecdsa(ssh_key key, int parameter) {
         case 384:
             nid = NID_secp384r1;
             break;
-        case 512:
+        case 521:
             nid = NID_secp521r1;
             break;
         case 256:

src/pki_gcrypt.c

@@ -1348,7 +1348,7 @@ int pki_key_generate_ecdsa(ssh_key key, int parameter) {
         case 384:
             nid = NID_gcrypt_nistp384;
             break;
-        case 512:
+        case 521:
             nid = NID_gcrypt_nistp521;
             break;
         case 256:

src/pki_mbedcrypto.c

@@ -1439,7 +1439,7 @@ int pki_key_generate_ecdsa(ssh_key key, int parameter)
         case 384:
             nid = NID_mbedtls_nistp384;
             break;
-        case 512:
+        case 521:
             nid = NID_mbedtls_nistp521;
             break;
         case 256:

tests/unittests/torture_options.c

@@ -674,7 +674,7 @@ static void torture_bind_options_import_key(void **state)
     assert_int_equal(rc, 0);
 #endif
     /* set ecdsa key */
-    base64_key = torture_get_testkey(SSH_KEYTYPE_ECDSA, 512, 0);
+    base64_key = torture_get_testkey(SSH_KEYTYPE_ECDSA, 521, 0);
     rc = ssh_pki_import_privkey_base64(base64_key, NULL, NULL, NULL, &key);
     assert_int_equal(rc, SSH_OK);
     assert_non_null(key);

tests/unittests/torture_pki_ecdsa.c

@@ -451,7 +451,7 @@ static void torture_pki_generate_key_ecdsa(void **state)
     ssh_signature_free(sign);
     SSH_KEY_FREE(key);
 
-    rc = ssh_pki_generate(SSH_KEYTYPE_ECDSA, 512, &key);
+    rc = ssh_pki_generate(SSH_KEYTYPE_ECDSA, 521, &key);
     assert_true(rc == SSH_OK);
     assert_true(key != NULL);
     sign = pki_do_sign(key, ECDSA_HASH, 20);