diff --git a/default_options.h.in b/default_options.h.in index 201044d..1dfe709 100644 --- a/default_options.h.in +++ b/default_options.h.in @@ -9,9 +9,9 @@ Local customisation should be added to localoptions.h which is used if it exists. Options defined there will override any options in this file. -Options can also be defined with -DDROPBEAR_XXX in Makefile CFLAGS +Options can also be defined with -DDROPBEAR_XXX=[0,1] in Makefile CFLAGS -IMPORTANT: Many options will require "make clean" after changes */ +IMPORTANT: Some options will require "make clean" after changes */ #define DROPBEAR_DEFPORT "22" @@ -41,9 +41,9 @@ IMPORTANT: Many options will require "make clean" after changes */ #define DEBUG_TRACE 0 /* Set this if you want to use the DROPBEAR_SMALL_CODE option. This can save -several kB in binary size however will make the symmetrical ciphers and hashes -slower, perhaps by 50%. Recommended for small systems that aren't doing -much traffic. */ + * several kB in binary size however will make the symmetrical ciphers and hashes + * slower, perhaps by 50%. Recommended for small systems that aren't doing + * much traffic. */ #define DROPBEAR_SMALL_CODE 1 /* Enable X11 Forwarding - server only */ @@ -52,7 +52,6 @@ much traffic. */ /* Enable TCP Fowarding */ /* 'Local' is "-L" style (client listening port forwarded via server) * 'Remote' is "-R" style (server listening port forwarded via client) */ - #define DROPBEAR_CLI_LOCALTCPFWD 1 #define DROPBEAR_CLI_REMOTETCPFWD 1 @@ -85,8 +84,8 @@ much traffic. */ #define DROPBEAR_AES128 1 #define DROPBEAR_3DES 1 #define DROPBEAR_AES256 1 -#define DROPBEAR_TWOFISH256 1 -#define DROPBEAR_TWOFISH128 1 +#define DROPBEAR_TWOFISH256 0 +#define DROPBEAR_TWOFISH128 0 /* Compiling in Blowfish will add ~6kB to runtime heap memory usage */ #define DROPBEAR_BLOWFISH 0 @@ -99,21 +98,11 @@ much traffic. */ * and forwards compatibility */ #define DROPBEAR_ENABLE_CTR_MODE 1 -/* Twofish counter mode is disabled by default because it -has not been tested for interoperability with other SSH implementations. -If you test it please contact the Dropbear author */ -#define DROPBEAR_TWOFISH_CTR 0 - /* Message integrity. sha2-256 is recommended as a default, sha1 for compatibility */ #define DROPBEAR_SHA1_HMAC 1 #define DROPBEAR_SHA1_96_HMAC 1 #define DROPBEAR_SHA2_256_HMAC 1 -/* Default is to include it if sha512 is being compiled in for ECDSA */ -#define DROPBEAR_SHA2_512_HMAC (DROPBEAR_ECDSA) - -/* XXX needed for fingerprints */ -#define DROPBEAR_MD5_HMAC 0 /* Hostkey/public key algorithms - at least one required, these are used * for hostkey as well as for verifying signatures with pubkey auth. @@ -139,30 +128,33 @@ If you test it please contact the Dropbear author */ with badly seeded /dev/urandom when systems first boot. */ #define DROPBEAR_DELAY_HOSTKEY 1 -/* Enable Curve25519 for key exchange. This is another elliptic - * curve method with good security properties. Increases binary size - * by ~8kB on x86-64 */ -#define DROPBEAR_CURVE25519 1 - -/* Enable elliptic curve Diffie Hellman key exchange, see note about - * ECDSA above */ -#define DROPBEAR_ECDH 1 /* Key exchange algorithm. + * group14_sha1 - 2048 bit, sha1 * group14_sha256 - 2048 bit, sha2-256 * group16 - 4096 bit, sha2-512 * group1 - 1024 bit, sha1 + * curve25519 - elliptic curve DH + * ecdh - NIST elliptic curve DH (256, 384, 521) * - * group14 is supported by most implementations. - * group16 provides a greater strength level but is slower and increases binary size * group1 is too small for security though is necessary if you need compatibility with some implementations such as Dropbear versions < 0.53 + * group14 is supported by most implementations. + * group16 provides a greater strength level but is slower and increases binary size + * curve25519 and ecdh algorithms are faster than non-elliptic curve methods + * curve25519 increases binary size by ~8kB on x86-64 + * including either ECDH or ECDSA increases binary size by ~30kB on x86-64 + + * Small systems should generally include either curve25519 or ecdh for performance. + * curve25519 is less widely supported but is faster */ #define DROPBEAR_DH_GROUP1 1 #define DROPBEAR_DH_GROUP14_SHA1 1 #define DROPBEAR_DH_GROUP14_SHA256 1 #define DROPBEAR_DH_GROUP16 0 +#define DROPBEAR_CURVE25519 1 +#define DROPBEAR_ECDH 1 /* Control the memory/performance/compression tradeoff for zlib. * Set windowBits=8 for least memory usage, see your system's @@ -178,8 +170,6 @@ If you test it please contact the Dropbear author */ /* Whether to print the message of the day (MOTD). */ #define DO_MOTD 0 - -/* The MOTD file path */ #define MOTD_FILENAME "/etc/motd" /* Authentication Types - at least one required. @@ -223,7 +213,7 @@ Homedir is prepended unless path begins with / */ /* Save a network roundtrip by sendng a real auth request immediately after * sending a query for the available methods. This is not yet enabled by default since it could cause problems with non-compliant servers */ - #define DROPBEAR_CLI_IMMEDIATE_AUTH 0 +#define DROPBEAR_CLI_IMMEDIATE_AUTH 0 /* Set this to use PRNGD or EGD instead of /dev/urandom */ #define DROPBEAR_USE_PRNGD 0 diff --git a/sysoptions.h b/sysoptions.h index b081ffc..ba4b4ca 100644 --- a/sysoptions.h +++ b/sysoptions.h @@ -99,6 +99,23 @@ #define MAX_MAC_LEN 20 #endif +/* sha2-512 is not necessary unless unforseen problems arise with sha2-256 */ +#ifndef DROPBEAR_SHA2_512_HMAC +#define DROPBEAR_SHA2_512_HMAC 0 +#endif + +/* might be needed for compatibility with very old implementations */ +#ifndef DROPBEAR_MD5_HMAC +#define DROPBEAR_MD5_HMAC 0 +#endif + +/* Twofish counter mode is disabled by default because it +has not been tested for interoperability with other SSH implementations. +If you test it please contact the Dropbear author */ +#ifndef DROPBEAR_TWOFISH_CTR +#define DROPBEAR_TWOFISH_CTR 0 +#endif + #define DROPBEAR_ECC ((DROPBEAR_ECDH) || (DROPBEAR_ECDSA))