Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Disable all sha1 by default #337

Merged
merged 2 commits into from
Dec 18, 2024
+9 −5
Merged

Disable all sha1 by default #337

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
bfb38aa
Disable all sha1 by default
mkj Dec 18, 2024
359b873
Force rsa sha1 when fuzzing
mkj Dec 18, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 4 additions & 5 deletions src/default_options.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -124,7 +124,7 @@ IMPORTANT: Some options will require "make clean" after changes */

/* Message integrity. sha2-256 is recommended as a default,
sha1 for compatibility */
#define DROPBEAR_SHA1_HMAC 1
#define DROPBEAR_SHA1_HMAC 0
#define DROPBEAR_SHA2_256_HMAC 1
#define DROPBEAR_SHA2_512_HMAC 0
#define DROPBEAR_SHA1_96_HMAC 0
Expand All @@ -137,9 +137,8 @@ IMPORTANT: Some options will require "make clean" after changes */
#define DROPBEAR_RSA 1
/* Newer SSH implementations use SHA256 for RSA signatures. SHA1
* support is required to communicate with some older implementations.
* It will be removed in future due to SHA1 insecurity, it can be
* disabled with DROPBEAR_RSA_SHA1 set to 0 */
#define DROPBEAR_RSA_SHA1 1
* It is disabled by default. */
#define DROPBEAR_RSA_SHA1 0

/* DSS may be necessary to connect to some systems but is not
* recommended for new keys (1024 bits is small, and it uses SHA1).
Expand Down Expand Up @@ -202,7 +201,7 @@ IMPORTANT: Some options will require "make clean" after changes */
* Small systems should generally include either curve25519 or ecdh for performance.
* curve25519 is less widely supported but is faster
*/
#define DROPBEAR_DH_GROUP14_SHA1 1
#define DROPBEAR_DH_GROUP14_SHA1 0
#define DROPBEAR_DH_GROUP14_SHA256 1
#define DROPBEAR_DH_GROUP16 0
#define DROPBEAR_CURVE25519 1
Expand Down
5 changes: 5 additions & 0 deletions src/sysoptions.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -436,6 +436,11 @@
#endif
#define DROPBEAR_DSS 1

#if defined(DROPBEAR_RSA_SHA1)
#undef DROPBEAR_RSA_SHA1
#endif
#define DROPBEAR_RSA_SHA1 1

#if defined(DROPBEAR_USE_SSH_CONFIG)
#undef DROPBEAR_USE_SSH_CONFIG
#endif
Expand Down
Loading