- markus@cvs.openbsd.org 2012/12/11 22:31:18

     [PROTOCOL authfile.c cipher.c cipher.h kex.h mac.c myproposal.h]
     [packet.c ssh_config.5 sshd_config.5]
     add encrypt-then-mac (EtM) modes to openssh by defining new mac algorithms
     that change the packet format and compute the MAC over the encrypted
     message (including the packet size) instead of the plaintext data;
     these EtM modes are considered more secure and used by default.
     feedback and ok djm@

1 files changed, 2 insertions, 1 deletions

diff --git a/kex.h b/kex.h
index 7373d3c78..03b984cc8 100644
--- a/kex.h
+++ b/kex.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: kex.h,v 1.52 2010/09/22 05:01:29 djm Exp $ */
+/* $OpenBSD: kex.h,v 1.53 2012/12/11 22:31:18 markus Exp $ */
 
 /*
  * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.
@@ -100,6 +100,7 @@ struct Mac {
         u_char  *key;
         u_int   key_len;
         int     type;
+        int     etm;            /* Encrypt-then-MAC */
         const EVP_MD    *evp_md;
         HMAC_CTX        evp_ctx;
         struct umac_ctx *umac_ctx;