From 4664ce2c35e69ff79949eff178be1720bf288ddc Mon Sep 17 00:00:00 2001
From: Matt Johnston <matt@ucc.asn.au>
Date: Mon, 2 May 2016 17:03:55 +0200
Subject: [PATCH] move group14 and group16 to options.h, group14-sha256 on by
 default

---
 options.h    | 14 ++++++++++++--
 sysoptions.h |  5 -----
 2 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/options.h b/options.h
index 0c51bb19..89b68be9 100644
--- a/options.h
+++ b/options.h
@@ -168,10 +168,20 @@ If you test it please contact the Dropbear author */
  * ECDSA above */
 #define DROPBEAR_ECDH
 
-/* Group14 (2048 bit) is recommended. Group1 is less secure (1024 bit) though
-   is the only option for interoperability with some older SSH programs */
+/* Key exchange algorithm.
+ * group1 - 1024 bit, sha1
+ * group14 - 2048 bit, sha1
+ * group14_256 - 2048 bit, sha2-256
+ * group16 - 4096 bit, sha2-512
+ *
+ * group14 is supported by most implementations.
+ * group16 provides a greater strength but is slower and increases binary size
+ * group1 is necessary if compatibility with Dropbear versions < 0.53 is required
+ */ 
 #define DROPBEAR_DH_GROUP1 1
 #define DROPBEAR_DH_GROUP14 1
+#define DROPBEAR_DH_GROUP14_256 1
+#define DROPBEAR_DH_GROUP16 0
 
 /* Control the memory/performance/compression tradeoff for zlib.
  * Set windowBits=8 for least memory usage, see your system's
diff --git a/sysoptions.h b/sysoptions.h
index 9a76655f..6bebce9a 100644
--- a/sysoptions.h
+++ b/sysoptions.h
@@ -127,11 +127,6 @@
 #define DROPBEAR_MD5
 #endif
 
-/* These are disabled in Dropbear 2016.73 by default since the spec 
-   draft-ietf-curdle-ssh-kex-sha2-02 is under development. */
-#define DROPBEAR_DH_GROUP14_256 0
-#define DROPBEAR_DH_GROUP16 0
-
 /* roughly 2x 521 bits */
 #define MAX_ECC_SIZE 140
 
-- 
GitLab