ClearML/dropbear
1
0
Fork 0
mirror of https://github.com/clearml/dropbear synced 2025-02-07 13:21:15 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Prefer stronger algorithms in algorithm negotiation.

Browse Source 
Prefer diffie-hellman-group14-sha1 (2048 bit) over
diffie-hellman-group1-sha1 (1024 bit).

Due to meet-in-the-middle attacks the effective key length of
three key 3DES is 112 bits. AES is stronger and faster then 3DES.

Prefer to delay the start of compression until after authentication
has completed. This avoids exposing compression code to attacks
from unauthenticated users.

(github pull request #9)
This commit is contained in:
Fedor Brunner 2015-01-23 23:00:25 +08:00
parent a1dcebe4f4
commit 4122cac66b
1 changed files with 8 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
common-algo.c
View File

@ -141,9 +141,6 @@ algo_type sshciphers[] = {
#ifdef DROPBEAR_AES128 #ifdef DROPBEAR_AES128
{"aes128-ctr", 0, &dropbear_aes128, 1, &dropbear_mode_ctr}, {"aes128-ctr", 0, &dropbear_aes128, 1, &dropbear_mode_ctr},
#endif #endif
#ifdef DROPBEAR_3DES
{"3des-ctr", 0, &dropbear_3des, 1, &dropbear_mode_ctr},
#endif
#ifdef DROPBEAR_AES256 #ifdef DROPBEAR_AES256
{"aes256-ctr", 0, &dropbear_aes256, 1, &dropbear_mode_ctr}, {"aes256-ctr", 0, &dropbear_aes256, 1, &dropbear_mode_ctr},
#endif #endif
@ -153,9 +150,6 @@ algo_type sshciphers[] = {
#ifdef DROPBEAR_AES128 #ifdef DROPBEAR_AES128
{"aes128-cbc", 0, &dropbear_aes128, 1, &dropbear_mode_cbc}, {"aes128-cbc", 0, &dropbear_aes128, 1, &dropbear_mode_cbc},
#endif #endif
#ifdef DROPBEAR_3DES
{"3des-cbc", 0, &dropbear_3des, 1, &dropbear_mode_cbc},
#endif
#ifdef DROPBEAR_AES256 #ifdef DROPBEAR_AES256
{"aes256-cbc", 0, &dropbear_aes256, 1, &dropbear_mode_cbc}, {"aes256-cbc", 0, &dropbear_aes256, 1, &dropbear_mode_cbc},
#endif #endif
@ -166,6 +160,12 @@ algo_type sshciphers[] = {
#ifdef DROPBEAR_TWOFISH128 #ifdef DROPBEAR_TWOFISH128
{"twofish128-cbc", 0, &dropbear_twofish128, 1, &dropbear_mode_cbc}, {"twofish128-cbc", 0, &dropbear_twofish128, 1, &dropbear_mode_cbc},
#endif #endif
#ifdef DROPBEAR_3DES
{"3des-ctr", 0, &dropbear_3des, 1, &dropbear_mode_ctr},
#endif
#ifdef DROPBEAR_3DES
{"3des-cbc", 0, &dropbear_3des, 1, &dropbear_mode_cbc},
#endif
#ifdef DROPBEAR_BLOWFISH #ifdef DROPBEAR_BLOWFISH
{"blowfish-cbc", 0, &dropbear_blowfish, 1, &dropbear_mode_cbc}, {"blowfish-cbc", 0, &dropbear_blowfish, 1, &dropbear_mode_cbc},
#endif #endif
@ -200,8 +200,8 @@ algo_type sshhashes[] = {
#ifndef DISABLE_ZLIB #ifndef DISABLE_ZLIB
algo_type ssh_compress[] = { algo_type ssh_compress[] = {
{"zlib", DROPBEAR_COMP_ZLIB, NULL, 1, NULL},
{"zlib@openssh.com", DROPBEAR_COMP_ZLIB_DELAY, NULL, 1, NULL}, {"zlib@openssh.com", DROPBEAR_COMP_ZLIB_DELAY, NULL, 1, NULL},
{"zlib", DROPBEAR_COMP_ZLIB, NULL, 1, NULL},
{"none", DROPBEAR_COMP_NONE, NULL, 1, NULL}, {"none", DROPBEAR_COMP_NONE, NULL, 1, NULL},
{NULL, 0, NULL, 0, NULL} {NULL, 0, NULL, 0, NULL}
}; };
@ -270,8 +270,8 @@ algo_type sshkex[] = {
{"ecdh-sha2-nistp256", 0, &kex_ecdh_nistp256, 1, NULL}, {"ecdh-sha2-nistp256", 0, &kex_ecdh_nistp256, 1, NULL},
#endif #endif
#endif #endif
{"diffie-hellman-group1-sha1", 0, &kex_dh_group1, 1, NULL},
{"diffie-hellman-group14-sha1", 0, &kex_dh_group14, 1, NULL}, {"diffie-hellman-group14-sha1", 0, &kex_dh_group14, 1, NULL},
{"diffie-hellman-group1-sha1", 0, &kex_dh_group1, 1, NULL},
#ifdef USE_KEXGUESS2 #ifdef USE_KEXGUESS2
{KEXGUESS2_ALGO_NAME, KEXGUESS2_ALGO_ID, NULL, 1, NULL}, {KEXGUESS2_ALGO_NAME, KEXGUESS2_ALGO_ID, NULL, 1, NULL},
#endif #endif