diff options
| author | Fedor Brunner <fedor.brunner@azet.sk> | 2015-01-23 23:00:25 +0800 |
|---|---|---|
| committer | Fedor Brunner <fedor.brunner@azet.sk> | 2015-01-23 23:00:25 +0800 |
| commit | 4122cac66b139492d5b7fa6a1b8afcb1bfc529f7 (patch) | |
| tree | b092c8067e55af0d9efea317bc57ef7478bfa497 | |
| parent | a1dcebe4f40f645ef2f4d6a44961941f4ed5b770 (diff) | |
Prefer stronger algorithms in algorithm negotiation.
Prefer diffie-hellman-group14-sha1 (2048 bit) over
diffie-hellman-group1-sha1 (1024 bit).
Due to meet-in-the-middle attacks the effective key length of
three key 3DES is 112 bits. AES is stronger and faster then 3DES.
Prefer to delay the start of compression until after authentication
has completed. This avoids exposing compression code to attacks
from unauthenticated users.
(github pull request #9)
| -rw-r--r-- | common-algo.c | 16 |
1 files changed, 8 insertions, 8 deletions
diff --git a/common-algo.c b/common-algo.c index ab3086e..95c53f4 100644 --- a/common-algo.c +++ b/common-algo.c @@ -141,9 +141,6 @@ algo_type sshciphers[] = { #ifdef DROPBEAR_AES128 {"aes128-ctr", 0, &dropbear_aes128, 1, &dropbear_mode_ctr}, #endif -#ifdef DROPBEAR_3DES - {"3des-ctr", 0, &dropbear_3des, 1, &dropbear_mode_ctr}, -#endif #ifdef DROPBEAR_AES256 {"aes256-ctr", 0, &dropbear_aes256, 1, &dropbear_mode_ctr}, #endif @@ -153,9 +150,6 @@ algo_type sshciphers[] = { #ifdef DROPBEAR_AES128 {"aes128-cbc", 0, &dropbear_aes128, 1, &dropbear_mode_cbc}, #endif -#ifdef DROPBEAR_3DES - {"3des-cbc", 0, &dropbear_3des, 1, &dropbear_mode_cbc}, -#endif #ifdef DROPBEAR_AES256 {"aes256-cbc", 0, &dropbear_aes256, 1, &dropbear_mode_cbc}, #endif @@ -166,6 +160,12 @@ algo_type sshciphers[] = { #ifdef DROPBEAR_TWOFISH128 {"twofish128-cbc", 0, &dropbear_twofish128, 1, &dropbear_mode_cbc}, #endif +#ifdef DROPBEAR_3DES + {"3des-ctr", 0, &dropbear_3des, 1, &dropbear_mode_ctr}, +#endif +#ifdef DROPBEAR_3DES + {"3des-cbc", 0, &dropbear_3des, 1, &dropbear_mode_cbc}, +#endif #ifdef DROPBEAR_BLOWFISH {"blowfish-cbc", 0, &dropbear_blowfish, 1, &dropbear_mode_cbc}, #endif @@ -200,8 +200,8 @@ algo_type sshhashes[] = { #ifndef DISABLE_ZLIB algo_type ssh_compress[] = { - {"zlib", DROPBEAR_COMP_ZLIB, NULL, 1, NULL}, {"zlib@openssh.com", DROPBEAR_COMP_ZLIB_DELAY, NULL, 1, NULL}, + {"zlib", DROPBEAR_COMP_ZLIB, NULL, 1, NULL}, {"none", DROPBEAR_COMP_NONE, NULL, 1, NULL}, {NULL, 0, NULL, 0, NULL} }; @@ -270,8 +270,8 @@ algo_type sshkex[] = { {"ecdh-sha2-nistp256", 0, &kex_ecdh_nistp256, 1, NULL}, #endif #endif - {"diffie-hellman-group1-sha1", 0, &kex_dh_group1, 1, NULL}, {"diffie-hellman-group14-sha1", 0, &kex_dh_group14, 1, NULL}, + {"diffie-hellman-group1-sha1", 0, &kex_dh_group1, 1, NULL}, #ifdef USE_KEXGUESS2 {KEXGUESS2_ALGO_NAME, KEXGUESS2_ALGO_ID, NULL, 1, NULL}, #endif |