8c22023ca5
From OpenSSH 8.8p1's release notes:
---
Potentially-incompatible changes
================================
This release disables RSA signatures using the SHA-1 hash algorithm
by default. This change has been made as the SHA-1 hash algorithm is
cryptographically broken, and it is possible to create chosen-prefix
hash collisions for <USD$50K [1]
For most users, this change should be invisible and there is
no need to replace ssh-rsa keys. OpenSSH has supported RFC8332
RSA/SHA-256/512 signatures since release 7.2 and existing ssh-rsa keys
will automatically use the stronger algorithm where possible.
Incompatibility is more likely when connecting to older SSH
implementations that have not been upgraded or have not closely tracked
improvements in the SSH protocol. For these cases, it may be necessary
to selectively re-enable RSA/SHA1 to allow connection and/or user
authentication via the HostkeyAlgorithms and PubkeyAcceptedAlgorithms
options. For example, the following stanza in ~/.ssh/config will enable
RSA/SHA1 for host and user authentication for a single destination host:
Host old-host
HostkeyAlgorithms +ssh-rsa
PubkeyAcceptedAlgorithms +ssh-rsa
We recommend enabling RSA/SHA1 only as a stopgap measure until legacy
implementations can be upgraded or reconfigured with another key type
(such as ECDSA or Ed25519).
[1] "SHA-1 is a Shambles: First Chosen-Prefix Collision on SHA-1 and
Application to the PGP Web of Trust" Leurent, G and Peyrin, T
(2020) https://eprint.iacr.org/2020/014.pdf
---
Relnotes: Yes
Sponsored by: The FreeBSD Foundation
116 lines
3.6 KiB
C
116 lines
3.6 KiB
C
/* $OpenBSD: myproposal.h,v 1.69 2021/08/29 23:53:10 djm Exp $ */
|
|
|
|
/*
|
|
* Copyright (c) 2000 Markus Friedl. All rights reserved.
|
|
*
|
|
* Redistribution and use in source and binary forms, with or without
|
|
* modification, are permitted provided that the following conditions
|
|
* are met:
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
* notice, this list of conditions and the following disclaimer.
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
* documentation and/or other materials provided with the distribution.
|
|
*
|
|
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
|
|
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
|
|
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
|
|
* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
|
|
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
|
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
|
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
|
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
|
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
|
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
*/
|
|
|
|
#define KEX_SERVER_KEX \
|
|
"curve25519-sha256," \
|
|
"curve25519-sha256@libssh.org," \
|
|
"ecdh-sha2-nistp256," \
|
|
"ecdh-sha2-nistp384," \
|
|
"ecdh-sha2-nistp521," \
|
|
"diffie-hellman-group-exchange-sha256," \
|
|
"diffie-hellman-group16-sha512," \
|
|
"diffie-hellman-group18-sha512," \
|
|
"diffie-hellman-group14-sha256"
|
|
|
|
#define KEX_CLIENT_KEX KEX_SERVER_KEX
|
|
|
|
#define KEX_DEFAULT_PK_ALG \
|
|
"ssh-ed25519-cert-v01@openssh.com," \
|
|
"ecdsa-sha2-nistp256-cert-v01@openssh.com," \
|
|
"ecdsa-sha2-nistp384-cert-v01@openssh.com," \
|
|
"ecdsa-sha2-nistp521-cert-v01@openssh.com," \
|
|
"sk-ssh-ed25519-cert-v01@openssh.com," \
|
|
"sk-ecdsa-sha2-nistp256-cert-v01@openssh.com," \
|
|
"rsa-sha2-512-cert-v01@openssh.com," \
|
|
"rsa-sha2-256-cert-v01@openssh.com," \
|
|
"ssh-ed25519," \
|
|
"ecdsa-sha2-nistp256," \
|
|
"ecdsa-sha2-nistp384," \
|
|
"ecdsa-sha2-nistp521," \
|
|
"sk-ssh-ed25519@openssh.com," \
|
|
"sk-ecdsa-sha2-nistp256@openssh.com," \
|
|
"rsa-sha2-512," \
|
|
"rsa-sha2-256"
|
|
|
|
#define KEX_SERVER_ENCRYPT \
|
|
"chacha20-poly1305@openssh.com," \
|
|
"aes128-ctr,aes192-ctr,aes256-ctr," \
|
|
"aes128-gcm@openssh.com,aes256-gcm@openssh.com"
|
|
|
|
#define KEX_CLIENT_ENCRYPT KEX_SERVER_ENCRYPT
|
|
|
|
#define KEX_SERVER_MAC \
|
|
"umac-64-etm@openssh.com," \
|
|
"umac-128-etm@openssh.com," \
|
|
"hmac-sha2-256-etm@openssh.com," \
|
|
"hmac-sha2-512-etm@openssh.com," \
|
|
"hmac-sha1-etm@openssh.com," \
|
|
"umac-64@openssh.com," \
|
|
"umac-128@openssh.com," \
|
|
"hmac-sha2-256," \
|
|
"hmac-sha2-512," \
|
|
"hmac-sha1"
|
|
|
|
#define KEX_CLIENT_MAC KEX_SERVER_MAC
|
|
|
|
/* Not a KEX value, but here so all the algorithm defaults are together */
|
|
#define SSH_ALLOWED_CA_SIGALGS \
|
|
"ssh-ed25519," \
|
|
"ecdsa-sha2-nistp256," \
|
|
"ecdsa-sha2-nistp384," \
|
|
"ecdsa-sha2-nistp521," \
|
|
"sk-ssh-ed25519@openssh.com," \
|
|
"sk-ecdsa-sha2-nistp256@openssh.com," \
|
|
"rsa-sha2-512," \
|
|
"rsa-sha2-256"
|
|
|
|
#define KEX_DEFAULT_COMP "none,zlib@openssh.com"
|
|
#define KEX_DEFAULT_LANG ""
|
|
|
|
#define KEX_CLIENT \
|
|
KEX_CLIENT_KEX, \
|
|
KEX_DEFAULT_PK_ALG, \
|
|
KEX_CLIENT_ENCRYPT, \
|
|
KEX_CLIENT_ENCRYPT, \
|
|
KEX_CLIENT_MAC, \
|
|
KEX_CLIENT_MAC, \
|
|
KEX_DEFAULT_COMP, \
|
|
KEX_DEFAULT_COMP, \
|
|
KEX_DEFAULT_LANG, \
|
|
KEX_DEFAULT_LANG
|
|
|
|
#define KEX_SERVER \
|
|
KEX_SERVER_KEX, \
|
|
KEX_DEFAULT_PK_ALG, \
|
|
KEX_SERVER_ENCRYPT, \
|
|
KEX_SERVER_ENCRYPT, \
|
|
KEX_SERVER_MAC, \
|
|
KEX_SERVER_MAC, \
|
|
KEX_DEFAULT_COMP, \
|
|
KEX_DEFAULT_COMP, \
|
|
KEX_DEFAULT_LANG, \
|
|
KEX_DEFAULT_LANG
|