|
1 # |
|
2 # Removes cast128-cbc support. |
|
3 # |
|
4 # At this moment this algorithm is not listed in Approved Security |
|
5 # Technologies: Standards Details at all. Eventually it will be added as |
|
6 # deprecated. |
|
7 # |
|
8 # SunSSH did not support cast128-cbc. In this respect removing cast128-cbc from |
|
9 # OpenSSH doesn't constitute a regression in functionality from SunSSH. |
|
10 # |
|
11 # Interoperability gain provided by cast128-cbc is negligible, because all |
|
12 # relevant ssh implementations also provide several more common encryption |
|
13 # algorithms (aes256-ctr, aes128-cbc, ...) on top of cast128-cbc. |
|
14 # |
|
15 # This is a Solaris specific patch and it is not likely to be accepted upstream. |
|
16 # |
|
17 diff -pur old/cipher.c new/cipher.c |
|
18 --- old/cipher.c |
|
19 +++ new/cipher.c |
|
20 @@ -88,8 +88,10 @@ static const struct sshcipher ciphers[] |
|
21 { "3des-cbc", SSH_CIPHER_SSH2, 8, 24, 0, 0, 0, 1, EVP_des_ede3_cbc }, |
|
22 { "blowfish-cbc", |
|
23 SSH_CIPHER_SSH2, 8, 16, 0, 0, 0, 1, EVP_bf_cbc }, |
|
24 +#ifndef WITHOUT_CAST128 |
|
25 { "cast128-cbc", |
|
26 SSH_CIPHER_SSH2, 8, 16, 0, 0, 0, 1, EVP_cast5_cbc }, |
|
27 +#endif |
|
28 { "arcfour", SSH_CIPHER_SSH2, 8, 16, 0, 0, 0, 0, EVP_rc4 }, |
|
29 { "arcfour128", SSH_CIPHER_SSH2, 8, 16, 0, 0, 1536, 0, EVP_rc4 }, |
|
30 { "arcfour256", SSH_CIPHER_SSH2, 8, 32, 0, 0, 1536, 0, EVP_rc4 }, |
|
31 diff -pur old/myproposal.h new/myproposal.h |
|
32 --- old/myproposal.h |
|
33 +++ new/myproposal.h |
|
34 @@ -119,9 +119,16 @@ |
|
35 "aes128-ctr,aes192-ctr,aes256-ctr" \ |
|
36 AESGCM_CIPHER_MODES |
|
37 |
|
38 +#ifdef WITHOUT_CAST128 |
|
39 +# define CAST128 |
|
40 +#else |
|
41 +# define CAST128 "cast128-cbc" |
|
42 +#endif |
|
43 + |
|
44 #define KEX_CLIENT_ENCRYPT KEX_SERVER_ENCRYPT "," \ |
|
45 "arcfour256,arcfour128," \ |
|
46 - "aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc," \ |
|
47 + "aes128-cbc,3des-cbc,blowfish-cbc," \ |
|
48 + CAST128 \ |
|
49 "aes192-cbc,aes256-cbc,arcfour,[email protected]" |
|
50 |
|
51 #define KEX_SERVER_MAC \ |
|
52 diff -pur old/ssh.1 new/ssh.1 |
|
53 --- old/ssh.1 2016-01-20 13:49:25.822403799 -0800 |
|
54 +++ new/ssh.1 2016-01-20 13:52:04.664954014 -0800 |
|
55 @@ -788,7 +788,7 @@ options (see above). |
|
56 Both protocols support similar authentication methods, |
|
57 but protocol 2 is the default since |
|
58 it provides additional mechanisms for confidentiality |
|
59 -(the traffic is encrypted using AES, 3DES, Blowfish, CAST128, or Arcfour) |
|
60 +(the traffic is encrypted using AES, 3DES, Blowfish, or Arcfour) |
|
61 and integrity (hmac-md5, hmac-sha1, |
|
62 hmac-sha2-256, hmac-sha2-512, |
|
63 umac-64, umac-128, hmac-ripemd160). |
|
64 diff -pur old/ssh_config.5 new/ssh_config.5 |
|
65 --- old/ssh_config.5 2016-01-20 13:49:33.670445077 -0800 |
|
66 +++ new/ssh_config.5 2016-01-20 13:53:00.137039489 -0800 |
|
67 @@ -408,8 +408,6 @@ arcfour256 |
|
68 .It |
|
69 blowfish-cbc |
|
70 .It |
|
71 -cast128-cbc |
|
72 -.It |
|
73 [email protected] |
|
74 .El |
|
75 .Pp |
|
76 @@ -419,7 +417,7 @@ [email protected], |
|
77 aes128-ctr,aes192-ctr,aes256-ctr, |
|
78 [email protected],[email protected], |
|
79 arcfour256,arcfour128, |
|
80 -aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc, |
|
81 +aes128-cbc,3des-cbc,blowfish-cbc, |
|
82 aes192-cbc,aes256-cbc,arcfour |
|
83 .Ed |
|
84 .Pp |
|
85 diff -pur old/sshd.8 new/sshd.8 |
|
86 --- old/sshd.8 2016-01-20 13:49:48.116460059 -0800 |
|
87 +++ new/sshd.8 2016-01-20 13:54:11.984168556 -0800 |
|
88 @@ -307,7 +307,7 @@ For protocol 2, |
|
89 forward security is provided through a Diffie-Hellman key agreement. |
|
90 This key agreement results in a shared session key. |
|
91 The rest of the session is encrypted using a symmetric cipher, currently |
|
92 -128-bit AES, Blowfish, 3DES, CAST128, Arcfour, 192-bit AES, or 256-bit AES. |
|
93 +128-bit AES, Blowfish, 3DES, Arcfour, 192-bit AES, or 256-bit AES. |
|
94 The client selects the encryption algorithm |
|
95 to use from those offered by the server. |
|
96 Additionally, session integrity is provided |
|
97 diff -pur old/sshd_config.5 new/sshd_config.5 |
|
98 --- old/sshd_config.5 2016-01-20 13:49:40.842997029 -0800 |
|
99 +++ new/sshd_config.5 2016-01-20 13:53:50.533090678 -0800 |
|
100 @@ -469,8 +469,6 @@ arcfour256 |
|
101 .It |
|
102 blowfish-cbc |
|
103 .It |
|
104 -cast128-cbc |
|
105 -.It |
|
106 [email protected] |
|
107 .El |
|
108 .Pp |