1 #

     2 # Removes cast128-cbc support.

     3 #

     4 # At this moment this algorithm is not listed in Approved Security

     5 # Technologies: Standards Details at all. Eventually it will be added as

     6 # deprecated.

     7 #

     8 # SunSSH did not support cast128-cbc. In this respect removing cast128-cbc from

     9 # OpenSSH doesn't constitute a regression in functionality from SunSSH.

    10 #

    11 # Interoperability gain provided by cast128-cbc is negligible, because all

    12 # relevant ssh implementations also provide several more common encryption

    13 # algorithms (aes256-ctr, aes128-cbc, ...) on top of cast128-cbc.

    14 #

    15 # This is a Solaris specific patch and it is not likely to be accepted upstream.

    16 #

    17 diff -pur old/cipher.c new/cipher.c

    18 --- old/cipher.c

    19 +++ new/cipher.c

    20 @@ -88,8 +88,10 @@ static const struct sshcipher ciphers[]

    21  	{ "3des-cbc",	SSH_CIPHER_SSH2, 8, 24, 0, 0, 0, 1, EVP_des_ede3_cbc },

    22  	{ "blowfish-cbc",

    23  			SSH_CIPHER_SSH2, 8, 16, 0, 0, 0, 1, EVP_bf_cbc },

    24 +#ifndef WITHOUT_CAST128

    25  	{ "cast128-cbc",

    26  			SSH_CIPHER_SSH2, 8, 16, 0, 0, 0, 1, EVP_cast5_cbc },

    27 +#endif

    28  	{ "arcfour",	SSH_CIPHER_SSH2, 8, 16, 0, 0, 0, 0, EVP_rc4 },

    29  	{ "arcfour128",	SSH_CIPHER_SSH2, 8, 16, 0, 0, 1536, 0, EVP_rc4 },

    30  	{ "arcfour256",	SSH_CIPHER_SSH2, 8, 32, 0, 0, 1536, 0, EVP_rc4 },

    31 diff -pur old/myproposal.h new/myproposal.h

    32 --- old/myproposal.h

    33 +++ new/myproposal.h

    34 @@ -119,9 +119,16 @@

    35  	"aes128-ctr,aes192-ctr,aes256-ctr" \

    36  	AESGCM_CIPHER_MODES

    37  

    38 +#ifdef WITHOUT_CAST128

    39 +# define CAST128

    40 +#else

    41 +# define CAST128 "cast128-cbc"

    42 +#endif

    43 +

    44  #define KEX_CLIENT_ENCRYPT KEX_SERVER_ENCRYPT "," \

    45  	"arcfour256,arcfour128," \

    46 -	"aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc," \

    47 +	"aes128-cbc,3des-cbc,blowfish-cbc," \

    48 +	CAST128 \

    49  	"aes192-cbc,aes256-cbc,arcfour,[email protected]"

    50  

    51  #define KEX_SERVER_MAC \