Modern signature algorithms tracker

[nklaassen]

RFD

Tasks

Preview Give feedback

1. RFD 136 - Modern Signature Algorithms #28110
   rfd size/lg +2

User key types

Tasks

Preview Give feedback

1. use suite algo for user JWTs
2. Support split SSH and TLS keys in GenerateUserCerts APIs
3. split app keys and use configured algorithm Split user keys for app access #44609
4. split db keys and use configured algorithm Split user keys for db access #44718
5. split k8s keys and use configured algorithm Split user keys for k8s access #44779
6. support split SSH and TLS keys in web login APIs
7. support split SSH and TLS keys with Device Trust Device Trust support for split SSH and TLS keys #45546 https://github.com/gravitational/teleport.e/pull/4881
8. support split SSH and TLS keys with headless authn Headless authn support for split SSH/TLS keys #45646
9. find solution for identity files that currently can only hold 1 private key for SSH and TLS (just use the same key for both protocols for now)
10. split SSH and TLS keys in server-side login APIs support split SSH/TLS keys in SSO login endpoints #45876
11. split SSH and TLS keys client side in tsh split SSH and TLS keys in tsh login #45995

CA key types and signature algorithms

Tasks

Preview Give feedback

1. software keystore support for new algorithms
2. GCP KMS keystore support for new algorithms
3. AWS KMS keystore support for new algorithms
4. PKCS#11 keystore support for new algorithms
5. new CA keys use configured algorithm suite

Host key types

Tasks

Preview Give feedback

1. support key algorithms for host identities #46420
   machine-id no-changelog size/sm +3
2. decide whether to split host SSH and TLS keys (not going to split these)

Other

Tasks

Preview Give feedback

1. support file configuration of signature_algorithm_suite #46203
   no-changelog size/sm +2
2. dynamic configuration of algorithm suite via cluster_auth_preference
3. add signature algorithm suite to ping response #44567
   no-changelog size/sm +2
4. allow EC ssh keys in FIPS mode #44476
   no-changelog size/sm +2
5. support ECDSA JWTs and JWKs #43387
   application-access database-access no-changelog size/sm +4
6. ECDSA support for SAML IdP (edit: will stay with RSA) https://github.com/gravitational/teleport.e/pull/4764
7. ECDSA support for OIDC IdP (edit: will stay with RSA) revert OIDC IdP CA to use RSA keys in new suites #46792
8. support key algorithms for proxy generated k8s certs #46460
   kubernetes-access no-changelog size/sm +3
9. update default signature_algorithm_suite for new clusters #46791
   size/md +1
10. feat: update tctl status to show key algorithms and storage #47175
    documentation size/md tctl +3
11. prevent signature_algorithm_suite incompatible with AWS KMS on cloud tenants fix signature_algorithm_suite checks for HSM and Cloud #47183
12. feat: PuTTY PPK support for non-RSA keys #48650
    backport/branch/v17 no-changelog size/sm +3
13. docs: add signature algorithms reference #47976
    documentation no-changelog size/md +3
14. feat: interactive tctl auth rotate #49171
    backport/branch/v17 size/lg tctl +3
15. check terraform configuration support
16. check helm chart configuration support
17. check operator configuration support (k8s operator does not support cluster_auth_preference configuration)

Related Issues

• Other key types for Teleport clients #3489
• Configurable key types and signature algorithms for Teleport CAs #22505

[benarent]

@nklaassen , Do we have any update on docs for this feature?

[rosstimothy]

Not yet @benarent. The documentation task listed under Other above is still open. We will have documentation prior to the v17 release.

[nklaassen]

Hey @benarent the docs PR is up #47976