From 4122cac66b139492d5b7fa6a1b8afcb1bfc529f7 Mon Sep 17 00:00:00 2001
From: Fedor Brunner <fedor.brunner@azet.sk>
Date: Fri, 23 Jan 2015 23:00:25 +0800
Subject: [PATCH] Prefer stronger algorithms in algorithm negotiation. Prefer
diffie-hellman-group14-sha1 (2048 bit) over diffie-hellman-group1-sha1 (1024
bit).
Due to meet-in-the-middle attacks the effective key length of
three key 3DES is 112 bits. AES is stronger and faster then 3DES.
Prefer to delay the start of compression until after authentication
has completed. This avoids exposing compression code to attacks
from unauthenticated users.
(github pull request #9)
---
common-algo.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/common-algo.c b/common-algo.c
index ab3086ed..95c53f4c 100644
--- a/common-algo.c
+++ b/common-algo.c
@@ -141,9 +141,6 @@ algo_type sshciphers[] = {
#ifdef DROPBEAR_AES128
{"aes128-ctr", 0, &dropbear_aes128, 1, &dropbear_mode_ctr},
#endif
-#ifdef DROPBEAR_3DES
- {"3des-ctr", 0, &dropbear_3des, 1, &dropbear_mode_ctr},
-#endif
#ifdef DROPBEAR_AES256
{"aes256-ctr", 0, &dropbear_aes256, 1, &dropbear_mode_ctr},
#endif
@@ -153,9 +150,6 @@ algo_type sshciphers[] = {
#ifdef DROPBEAR_AES128
{"aes128-cbc", 0, &dropbear_aes128, 1, &dropbear_mode_cbc},
#endif
-#ifdef DROPBEAR_3DES
- {"3des-cbc", 0, &dropbear_3des, 1, &dropbear_mode_cbc},
-#endif
#ifdef DROPBEAR_AES256
{"aes256-cbc", 0, &dropbear_aes256, 1, &dropbear_mode_cbc},
#endif
@@ -166,6 +160,12 @@ algo_type sshciphers[] = {
#ifdef DROPBEAR_TWOFISH128
{"twofish128-cbc", 0, &dropbear_twofish128, 1, &dropbear_mode_cbc},
#endif
+#ifdef DROPBEAR_3DES
+ {"3des-ctr", 0, &dropbear_3des, 1, &dropbear_mode_ctr},
+#endif
+#ifdef DROPBEAR_3DES
+ {"3des-cbc", 0, &dropbear_3des, 1, &dropbear_mode_cbc},
+#endif
#ifdef DROPBEAR_BLOWFISH
{"blowfish-cbc", 0, &dropbear_blowfish, 1, &dropbear_mode_cbc},
#endif
@@ -200,8 +200,8 @@ algo_type sshhashes[] = {
#ifndef DISABLE_ZLIB
algo_type ssh_compress[] = {
- {"zlib", DROPBEAR_COMP_ZLIB, NULL, 1, NULL},
{"zlib@openssh.com", DROPBEAR_COMP_ZLIB_DELAY, NULL, 1, NULL},
+ {"zlib", DROPBEAR_COMP_ZLIB, NULL, 1, NULL},
{"none", DROPBEAR_COMP_NONE, NULL, 1, NULL},
{NULL, 0, NULL, 0, NULL}
};
@@ -270,8 +270,8 @@ algo_type sshkex[] = {
{"ecdh-sha2-nistp256", 0, &kex_ecdh_nistp256, 1, NULL},
#endif
#endif
- {"diffie-hellman-group1-sha1", 0, &kex_dh_group1, 1, NULL},
{"diffie-hellman-group14-sha1", 0, &kex_dh_group14, 1, NULL},
+ {"diffie-hellman-group1-sha1", 0, &kex_dh_group1, 1, NULL},
#ifdef USE_KEXGUESS2
{KEXGUESS2_ALGO_NAME, KEXGUESS2_ALGO_ID, NULL, 1, NULL},
#endif
--
GitLab