summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--ChangeLog5
-rw-r--r--PROTOCOL14
-rw-r--r--authfile.c6
-rw-r--r--cipher.c105
-rw-r--r--cipher.h8
-rw-r--r--kex.c16
-rw-r--r--kex.h3
-rw-r--r--monitor_wrap.c39
-rw-r--r--myproposal.h3
-rw-r--r--packet.c45
-rw-r--r--ssh_config.57
-rw-r--r--sshd_config.57
12 files changed, 179 insertions, 79 deletions
diff --git a/ChangeLog b/ChangeLog
index 0f62953c7..b5812cc7d 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -32,6 +32,11 @@
32 sftp-server.8: add argument name to -d 32 sftp-server.8: add argument name to -d
33 sftp-server.c: add -d to usage() 33 sftp-server.c: add -d to usage()
34 ok djm 34 ok djm
35 - markus@cvs.openbsd.org 2013/01/08 18:49:04
36 [PROTOCOL authfile.c cipher.c cipher.h kex.c kex.h monitor_wrap.c]
37 [myproposal.h packet.c ssh_config.5 sshd_config.5]
38 support AES-GCM as defined in RFC 5647 (but with simpler KEX handling)
39 ok and feedback djm@
35 40
3620121217 4120121217
37 - (dtucker) [Makefile.in] Add some scaffolding so that the new regress 42 - (dtucker) [Makefile.in] Add some scaffolding so that the new regress
diff --git a/PROTOCOL b/PROTOCOL
index eb5d0889c..48b3a4400 100644
--- a/PROTOCOL
+++ b/PROTOCOL
@@ -79,6 +79,18 @@ contains:
79 byte[n1] payload; n1 = packet_length - padding_length - 1 79 byte[n1] payload; n1 = packet_length - padding_length - 1
80 byte[n2] random padding; n2 = padding_length 80 byte[n2] random padding; n2 = padding_length
81 81
821.6 transport: AES-GCM
83
84OpenSSH supports the AES-GCM algorithm as specified in RFC 5647.
85Because of problems with the specification of the key exchange
86the behaviour of OpenSSH differs from the RFC as follows:
87
88AES-GCM is only negotiated as the cipher algorithms
89"aes128-gcm@openssh.com" or "aes256-gcm@openssh.com" and never as
90an MAC algorithm. Additionally, if AES-GCM is selected as the cipher
91the exchanged MAC algorithms are ignored and there doesn't have to be
92a matching MAC.
93
822. Connection protocol changes 942. Connection protocol changes
83 95
842.1. connection: Channel write close extension "eow@openssh.com" 962.1. connection: Channel write close extension "eow@openssh.com"
@@ -319,4 +331,4 @@ link(oldpath, newpath) and will respond with a SSH_FXP_STATUS message.
319This extension is advertised in the SSH_FXP_VERSION hello with version 331This extension is advertised in the SSH_FXP_VERSION hello with version
320"1". 332"1".
321 333
322$OpenBSD: PROTOCOL,v 1.19 2013/01/03 12:49:01 djm Exp $ 334$OpenBSD: PROTOCOL,v 1.20 2013/01/08 18:49:04 markus Exp $
diff --git a/authfile.c b/authfile.c
index d9ee4ca65..3544d170b 100644
--- a/authfile.c
+++ b/authfile.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: authfile.c,v 1.94 2012/12/11 22:31:18 markus Exp $ */ 1/* $OpenBSD: authfile.c,v 1.95 2013/01/08 18:49:04 markus Exp $ */
2/* 2/*
3 * Author: Tatu Ylonen <ylo@cs.hut.fi> 3 * Author: Tatu Ylonen <ylo@cs.hut.fi>
4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -150,7 +150,7 @@ key_private_rsa1_to_blob(Key *key, Buffer *blob, const char *passphrase,
150 cipher_set_key_string(&ciphercontext, cipher, passphrase, 150 cipher_set_key_string(&ciphercontext, cipher, passphrase,
151 CIPHER_ENCRYPT); 151 CIPHER_ENCRYPT);
152 cipher_crypt(&ciphercontext, cp, 152 cipher_crypt(&ciphercontext, cp,
153 buffer_ptr(&buffer), buffer_len(&buffer), 0); 153 buffer_ptr(&buffer), buffer_len(&buffer), 0, 0);
154 cipher_cleanup(&ciphercontext); 154 cipher_cleanup(&ciphercontext);
155 memset(&ciphercontext, 0, sizeof(ciphercontext)); 155 memset(&ciphercontext, 0, sizeof(ciphercontext));
156 156
@@ -474,7 +474,7 @@ key_parse_private_rsa1(Buffer *blob, const char *passphrase, char **commentp)
474 cipher_set_key_string(&ciphercontext, cipher, passphrase, 474 cipher_set_key_string(&ciphercontext, cipher, passphrase,
475 CIPHER_DECRYPT); 475 CIPHER_DECRYPT);
476 cipher_crypt(&ciphercontext, cp, 476 cipher_crypt(&ciphercontext, cp,
477 buffer_ptr(&copy), buffer_len(&copy), 0); 477 buffer_ptr(&copy), buffer_len(&copy), 0, 0);
478 cipher_cleanup(&ciphercontext); 478 cipher_cleanup(&ciphercontext);
479 memset(&ciphercontext, 0, sizeof(ciphercontext)); 479 memset(&ciphercontext, 0, sizeof(ciphercontext));
480 buffer_free(&copy); 480 buffer_free(&copy);
diff --git a/cipher.c b/cipher.c
index aae69c347..cad8a2f36 100644
--- a/cipher.c
+++ b/cipher.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: cipher.c,v 1.84 2012/12/12 16:46:10 naddy Exp $ */ 1/* $OpenBSD: cipher.c,v 1.85 2013/01/08 18:49:04 markus Exp $ */
2/* 2/*
3 * Author: Tatu Ylonen <ylo@cs.hut.fi> 3 * Author: Tatu Ylonen <ylo@cs.hut.fi>
4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -71,29 +71,38 @@ struct Cipher {
71 u_int cbc_mode; 71 u_int cbc_mode;
72 const EVP_CIPHER *(*evptype)(void); 72 const EVP_CIPHER *(*evptype)(void);
73} ciphers[] = { 73} ciphers[] = {
74 { "none", SSH_CIPHER_NONE, 8, 0, 0, 0, EVP_enc_null }, 74 { NULL, SSH_CIPHER_INVALID, 0, 0, 0, 0, NULL }
75 { "des", SSH_CIPHER_DES, 8, 8, 0, 1, EVP_des_cbc }, 75
76 { "3des", SSH_CIPHER_3DES, 8, 16, 0, 1, evp_ssh1_3des }, 76 { "none", SSH_CIPHER_NONE, 8, 0, 0, 0, 0, 0, EVP_enc_null },
77 { "blowfish", SSH_CIPHER_BLOWFISH, 8, 32, 0, 1, evp_ssh1_bf }, 77 { "des", SSH_CIPHER_DES, 8, 8, 0, 0, 0, 1, EVP_des_cbc },
78 78 { "3des", SSH_CIPHER_3DES, 8, 16, 0, 0, 0, 1, evp_ssh1_3des },
79 { "3des-cbc", SSH_CIPHER_SSH2, 8, 24, 0, 1, EVP_des_ede3_cbc }, 79 { "blowfish", SSH_CIPHER_BLOWFISH, 8, 32, 0, 0, 0, 1, evp_ssh1_bf },
80 { "blowfish-cbc", SSH_CIPHER_SSH2, 8, 16, 0, 1, EVP_bf_cbc }, 80
81 { "cast128-cbc", SSH_CIPHER_SSH2, 8, 16, 0, 1, EVP_cast5_cbc }, 81 { "3des-cbc", SSH_CIPHER_SSH2, 8, 24, 0, 0, 0, 1, EVP_des_ede3_cbc },
82 { "arcfour", SSH_CIPHER_SSH2, 8, 16, 0, 0, EVP_rc4 }, 82 { "blowfish-cbc",
83 { "arcfour128", SSH_CIPHER_SSH2, 8, 16, 1536, 0, EVP_rc4 }, 83 SSH_CIPHER_SSH2, 8, 16, 0, 0, 0, 1, EVP_bf_cbc },
84 { "arcfour256", SSH_CIPHER_SSH2, 8, 32, 1536, 0, EVP_rc4 }, 84 { "cast128-cbc",
85 { "aes128-cbc", SSH_CIPHER_SSH2, 16, 16, 0, 1, EVP_aes_128_cbc }, 85 SSH_CIPHER_SSH2, 8, 16, 0, 0, 0, 1, EVP_cast5_cbc },
86 { "aes192-cbc", SSH_CIPHER_SSH2, 16, 24, 0, 1, EVP_aes_192_cbc }, 86 { "arcfour", SSH_CIPHER_SSH2, 8, 16, 0, 0, 0, 0, EVP_rc4 },
87 { "aes256-cbc", SSH_CIPHER_SSH2, 16, 32, 0, 1, EVP_aes_256_cbc }, 87 { "arcfour128", SSH_CIPHER_SSH2, 8, 16, 0, 0, 1536, 0, EVP_rc4 },
88 { "arcfour256", SSH_CIPHER_SSH2, 8, 32, 0, 0, 1536, 0, EVP_rc4 },
89 { "aes128-cbc", SSH_CIPHER_SSH2, 16, 16, 0, 0, 0, 1, EVP_aes_128_cbc },
90 { "aes192-cbc", SSH_CIPHER_SSH2, 16, 24, 0, 0, 0, 1, EVP_aes_192_cbc },
91 { "aes256-cbc", SSH_CIPHER_SSH2, 16, 32, 0, 0, 0, 1, EVP_aes_256_cbc },
88 { "rijndael-cbc@lysator.liu.se", 92 { "rijndael-cbc@lysator.liu.se",
89 SSH_CIPHER_SSH2, 16, 32, 0, 1, EVP_aes_256_cbc }, 93 SSH_CIPHER_SSH2, 16, 32, 0, 0, 0, 1, EVP_aes_256_cbc },
90 { "aes128-ctr", SSH_CIPHER_SSH2, 16, 16, 0, 0, EVP_aes_128_ctr }, 94 { "aes128-ctr", SSH_CIPHER_SSH2, 16, 16, 0, 0, 0, 0, EVP_aes_128_ctr },
91 { "aes192-ctr", SSH_CIPHER_SSH2, 16, 24, 0, 0, EVP_aes_192_ctr }, 95 { "aes192-ctr", SSH_CIPHER_SSH2, 16, 24, 0, 0, 0, 0, EVP_aes_192_ctr },
92 { "aes256-ctr", SSH_CIPHER_SSH2, 16, 32, 0, 0, EVP_aes_256_ctr }, 96 { "aes256-ctr", SSH_CIPHER_SSH2, 16, 32, 0, 0, 0, 0, EVP_aes_256_ctr },
97 { "aes128-gcm@openssh.com",
98 SSH_CIPHER_SSH2, 16, 16, 12, 16, 0, 0, EVP_aes_128_gcm },
99 { "aes256-gcm@openssh.com",
100 SSH_CIPHER_SSH2, 16, 32, 12, 16, 0, 0, EVP_aes_256_gcm },
93#ifdef USE_CIPHER_ACSS 101#ifdef USE_CIPHER_ACSS
94 { "acss@openssh.org", SSH_CIPHER_SSH2, 16, 5, 0, 0, EVP_acss }, 102 { "acss@openssh.org",
103 SSH_CIPHER_SSH2, 16, 5, 0, 0, 0, 0, EVP_acss },
95#endif 104#endif
96 { NULL, SSH_CIPHER_INVALID, 0, 0, 0, 0, NULL } 105 { NULL, SSH_CIPHER_INVALID, 0, 0, 0, 0, 0, 0, NULL }
97}; 106};
98 107
99/*--*/ 108/*--*/
@@ -111,6 +120,18 @@ cipher_keylen(const Cipher *c)
111} 120}
112 121
113u_int 122u_int
123cipher_authlen(const Cipher *c)
124{
125 return (c->auth_len);
126}
127
128u_int
129cipher_ivlen(const Cipher *c)
130{
131 return (c->iv_len ? c->iv_len : c->block_size);
132}
133
134u_int
114cipher_get_number(const Cipher *c) 135cipher_get_number(const Cipher *c)
115{ 136{
116 return (c->number); 137 return (c->number);
@@ -229,11 +250,12 @@ cipher_init(CipherContext *cc, Cipher *cipher,
229 keylen = 8; 250 keylen = 8;
230 } 251 }
231 cc->plaintext = (cipher->number == SSH_CIPHER_NONE); 252 cc->plaintext = (cipher->number == SSH_CIPHER_NONE);
253 cc->encrypt = do_encrypt;
232 254
233 if (keylen < cipher->key_len) 255 if (keylen < cipher->key_len)
234 fatal("cipher_init: key length %d is insufficient for %s.", 256 fatal("cipher_init: key length %d is insufficient for %s.",
235 keylen, cipher->name); 257 keylen, cipher->name);
236 if (iv != NULL && ivlen < cipher->block_size) 258 if (iv != NULL && ivlen < cipher_ivlen(cipher))
237 fatal("cipher_init: iv length %d is insufficient for %s.", 259 fatal("cipher_init: iv length %d is insufficient for %s.",
238 ivlen, cipher->name); 260 ivlen, cipher->name);
239 cc->cipher = cipher; 261 cc->cipher = cipher;
@@ -254,6 +276,11 @@ cipher_init(CipherContext *cc, Cipher *cipher,
254 (do_encrypt == CIPHER_ENCRYPT)) == 0) 276 (do_encrypt == CIPHER_ENCRYPT)) == 0)
255 fatal("cipher_init: EVP_CipherInit failed for %s", 277 fatal("cipher_init: EVP_CipherInit failed for %s",
256 cipher->name); 278 cipher->name);
279 if (cipher_authlen(cipher) &&
280 !EVP_CIPHER_CTX_ctrl(&cc->evp, EVP_CTRL_GCM_SET_IV_FIXED,
281 -1, (u_char *)iv))
282 fatal("cipher_init: EVP_CTRL_GCM_SET_IV_FIXED failed for %s",
283 cipher->name);
257 klen = EVP_CIPHER_CTX_key_length(&cc->evp); 284 klen = EVP_CIPHER_CTX_key_length(&cc->evp);
258 if (klen > 0 && keylen != (u_int)klen) { 285 if (klen > 0 && keylen != (u_int)klen) {
259 debug2("cipher_init: set keylen (%d -> %d)", klen, keylen); 286 debug2("cipher_init: set keylen (%d -> %d)", klen, keylen);
@@ -284,19 +311,49 @@ cipher_init(CipherContext *cc, Cipher *cipher,
284 * Theses bytes are treated as additional authenticated data for 311 * Theses bytes are treated as additional authenticated data for
285 * authenticated encryption modes. 312 * authenticated encryption modes.
286 * En/Decrypt 'len' bytes at offset 'aadlen' from 'src' to 'dest'. 313 * En/Decrypt 'len' bytes at offset 'aadlen' from 'src' to 'dest'.
314 * Use 'authlen' bytes at offset 'len'+'aadlen' as the authentication tag.
315 * This tag is written on encryption and verified on decryption.
287 * Both 'aadlen' and 'authlen' can be set to 0. 316 * Both 'aadlen' and 'authlen' can be set to 0.
288 */ 317 */
289void 318void
290cipher_crypt(CipherContext *cc, u_char *dest, const u_char *src, 319cipher_crypt(CipherContext *cc, u_char *dest, const u_char *src,
291 u_int len, u_int aadlen) 320 u_int len, u_int aadlen, u_int authlen)
292{ 321{
293 if (aadlen) 322 if (authlen) {
323 u_char lastiv[1];
324
325 if (authlen != cipher_authlen(cc->cipher))
326 fatal("%s: authlen mismatch %d", __func__, authlen);
327 /* increment IV */
328 if (!EVP_CIPHER_CTX_ctrl(&cc->evp, EVP_CTRL_GCM_IV_GEN,
329 1, lastiv))
330 fatal("%s: EVP_CTRL_GCM_IV_GEN", __func__);
331 /* set tag on decyption */
332 if (!cc->encrypt &&
333 !EVP_CIPHER_CTX_ctrl(&cc->evp, EVP_CTRL_GCM_SET_TAG,
334 authlen, (u_char *)src + aadlen + len))
335 fatal("%s: EVP_CTRL_GCM_SET_TAG", __func__);
336 }
337 if (aadlen) {
338 if (authlen &&
339 EVP_Cipher(&cc->evp, NULL, (u_char *)src, aadlen) < 0)
340 fatal("%s: EVP_Cipher(aad) failed", __func__);
294 memcpy(dest, src, aadlen); 341 memcpy(dest, src, aadlen);
342 }
295 if (len % cc->cipher->block_size) 343 if (len % cc->cipher->block_size)
296 fatal("%s: bad plaintext length %d", __func__, len); 344 fatal("%s: bad plaintext length %d", __func__, len);
297 if (EVP_Cipher(&cc->evp, dest + aadlen, (u_char *)src + aadlen, 345 if (EVP_Cipher(&cc->evp, dest + aadlen, (u_char *)src + aadlen,
298 len) < 0) 346 len) < 0)
299 fatal("%s: EVP_Cipher failed", __func__); 347 fatal("%s: EVP_Cipher failed", __func__);
348 if (authlen) {
349 /* compute tag (on encrypt) or verify tag (on decrypt) */
350 if (EVP_Cipher(&cc->evp, NULL, NULL, 0) < 0)
351 fatal("%s: EVP_Cipher(finish) failed", __func__);
352 if (cc->encrypt &&
353 !EVP_CIPHER_CTX_ctrl(&cc->evp, EVP_CTRL_GCM_GET_TAG,
354 authlen, dest + aadlen + len))
355 fatal("%s: EVP_CTRL_GCM_GET_TAG", __func__);
356 }
300} 357}
301 358
302void 359void
diff --git a/cipher.h b/cipher.h
index 78972fea5..8cb57c3e5 100644
--- a/cipher.h
+++ b/cipher.h
@@ -1,4 +1,4 @@
1/* $OpenBSD: cipher.h,v 1.38 2012/12/11 22:31:18 markus Exp $ */ 1/* $OpenBSD: cipher.h,v 1.39 2013/01/08 18:49:04 markus Exp $ */
2 2
3/* 3/*
4 * Author: Tatu Ylonen <ylo@cs.hut.fi> 4 * Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -64,6 +64,7 @@ typedef struct CipherContext CipherContext;
64struct Cipher; 64struct Cipher;
65struct CipherContext { 65struct CipherContext {
66 int plaintext; 66 int plaintext;
67 int encrypt;
67 EVP_CIPHER_CTX evp; 68 EVP_CIPHER_CTX evp;
68 Cipher *cipher; 69 Cipher *cipher;
69}; 70};
@@ -76,11 +77,14 @@ char *cipher_name(int);
76int ciphers_valid(const char *); 77int ciphers_valid(const char *);
77void cipher_init(CipherContext *, Cipher *, const u_char *, u_int, 78void cipher_init(CipherContext *, Cipher *, const u_char *, u_int,
78 const u_char *, u_int, int); 79 const u_char *, u_int, int);
79void cipher_crypt(CipherContext *, u_char *, const u_char *, u_int, u_int); 80void cipher_crypt(CipherContext *, u_char *, const u_char *,
81 u_int, u_int, u_int);
80void cipher_cleanup(CipherContext *); 82void cipher_cleanup(CipherContext *);
81void cipher_set_key_string(CipherContext *, Cipher *, const char *, int); 83void cipher_set_key_string(CipherContext *, Cipher *, const char *, int);
82u_int cipher_blocksize(const Cipher *); 84u_int cipher_blocksize(const Cipher *);
83u_int cipher_keylen(const Cipher *); 85u_int cipher_keylen(const Cipher *);
86u_int cipher_authlen(const Cipher *);
87u_int cipher_ivlen(const Cipher *);
84u_int cipher_is_cbc(const Cipher *); 88u_int cipher_is_cbc(const Cipher *);
85 89
86u_int cipher_get_number(const Cipher *); 90u_int cipher_get_number(const Cipher *);
diff --git a/kex.c b/kex.c
index f77b3c925..57a79dd9e 100644
--- a/kex.c
+++ b/kex.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: kex.c,v 1.87 2012/08/17 01:22:56 djm Exp $ */ 1/* $OpenBSD: kex.c,v 1.88 2013/01/08 18:49:04 markus Exp $ */
2/* 2/*
3 * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved. 3 * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved.
4 * 4 *
@@ -304,6 +304,7 @@ choose_enc(Enc *enc, char *client, char *server)
304 enc->name = name; 304 enc->name = name;
305 enc->enabled = 0; 305 enc->enabled = 0;
306 enc->iv = NULL; 306 enc->iv = NULL;
307 enc->iv_len = cipher_ivlen(enc->cipher);
307 enc->key = NULL; 308 enc->key = NULL;
308 enc->key_len = cipher_keylen(enc->cipher); 309 enc->key_len = cipher_keylen(enc->cipher);
309 enc->block_size = cipher_blocksize(enc->cipher); 310 enc->block_size = cipher_blocksize(enc->cipher);
@@ -415,7 +416,7 @@ kex_choose_conf(Kex *kex)
415 char **my, **peer; 416 char **my, **peer;
416 char **cprop, **sprop; 417 char **cprop, **sprop;
417 int nenc, nmac, ncomp; 418 int nenc, nmac, ncomp;
418 u_int mode, ctos, need; 419 u_int mode, ctos, need, authlen;
419 int first_kex_follows, type; 420 int first_kex_follows, type;
420 421
421 my = kex_buf2prop(&kex->my, NULL); 422 my = kex_buf2prop(&kex->my, NULL);
@@ -448,13 +449,16 @@ kex_choose_conf(Kex *kex)
448 nenc = ctos ? PROPOSAL_ENC_ALGS_CTOS : PROPOSAL_ENC_ALGS_STOC; 449 nenc = ctos ? PROPOSAL_ENC_ALGS_CTOS : PROPOSAL_ENC_ALGS_STOC;
449 nmac = ctos ? PROPOSAL_MAC_ALGS_CTOS : PROPOSAL_MAC_ALGS_STOC; 450 nmac = ctos ? PROPOSAL_MAC_ALGS_CTOS : PROPOSAL_MAC_ALGS_STOC;
450 ncomp = ctos ? PROPOSAL_COMP_ALGS_CTOS : PROPOSAL_COMP_ALGS_STOC; 451 ncomp = ctos ? PROPOSAL_COMP_ALGS_CTOS : PROPOSAL_COMP_ALGS_STOC;
451 choose_enc (&newkeys->enc, cprop[nenc], sprop[nenc]); 452 choose_enc(&newkeys->enc, cprop[nenc], sprop[nenc]);
452 choose_mac (&newkeys->mac, cprop[nmac], sprop[nmac]); 453 /* ignore mac for authenticated encryption */
454 authlen = cipher_authlen(newkeys->enc.cipher);
455 if (authlen == 0)
456 choose_mac(&newkeys->mac, cprop[nmac], sprop[nmac]);
453 choose_comp(&newkeys->comp, cprop[ncomp], sprop[ncomp]); 457 choose_comp(&newkeys->comp, cprop[ncomp], sprop[ncomp]);
454 debug("kex: %s %s %s %s", 458 debug("kex: %s %s %s %s",
455 ctos ? "client->server" : "server->client", 459 ctos ? "client->server" : "server->client",
456 newkeys->enc.name, 460 newkeys->enc.name,
457 newkeys->mac.name, 461 authlen == 0 ? newkeys->mac.name : "<implicit>",
458 newkeys->comp.name); 462 newkeys->comp.name);
459 } 463 }
460 choose_kex(kex, cprop[PROPOSAL_KEX_ALGS], sprop[PROPOSAL_KEX_ALGS]); 464 choose_kex(kex, cprop[PROPOSAL_KEX_ALGS], sprop[PROPOSAL_KEX_ALGS]);
@@ -467,6 +471,8 @@ kex_choose_conf(Kex *kex)
467 need = newkeys->enc.key_len; 471 need = newkeys->enc.key_len;
468 if (need < newkeys->enc.block_size) 472 if (need < newkeys->enc.block_size)
469 need = newkeys->enc.block_size; 473 need = newkeys->enc.block_size;
474 if (need < newkeys->enc.iv_len)
475 need = newkeys->enc.iv_len;
470 if (need < newkeys->mac.key_len) 476 if (need < newkeys->mac.key_len)
471 need = newkeys->mac.key_len; 477 need = newkeys->mac.key_len;
472 } 478 }
diff --git a/kex.h b/kex.h
index 03b984cc8..46731fa45 100644
--- a/kex.h
+++ b/kex.h
@@ -1,4 +1,4 @@
1/* $OpenBSD: kex.h,v 1.53 2012/12/11 22:31:18 markus Exp $ */ 1/* $OpenBSD: kex.h,v 1.54 2013/01/08 18:49:04 markus Exp $ */
2 2
3/* 3/*
4 * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved. 4 * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved.
@@ -89,6 +89,7 @@ struct Enc {
89 Cipher *cipher; 89 Cipher *cipher;
90 int enabled; 90 int enabled;
91 u_int key_len; 91 u_int key_len;
92 u_int iv_len;
92 u_int block_size; 93 u_int block_size;
93 u_char *key; 94 u_char *key;
94 u_char *iv; 95 u_char *iv;
diff --git a/monitor_wrap.c b/monitor_wrap.c
index c22d0a2a6..ea654a73f 100644
--- a/monitor_wrap.c
+++ b/monitor_wrap.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: monitor_wrap.c,v 1.74 2012/10/01 13:59:51 naddy Exp $ */ 1/* $OpenBSD: monitor_wrap.c,v 1.75 2013/01/08 18:49:04 markus Exp $ */
2/* 2/*
3 * Copyright 2002 Niels Provos <provos@citi.umich.edu> 3 * Copyright 2002 Niels Provos <provos@citi.umich.edu>
4 * Copyright 2002 Markus Friedl <markus@openbsd.org> 4 * Copyright 2002 Markus Friedl <markus@openbsd.org>
@@ -491,25 +491,24 @@ mm_newkeys_from_blob(u_char *blob, int blen)
491 enc->enabled = buffer_get_int(&b); 491 enc->enabled = buffer_get_int(&b);
492 enc->block_size = buffer_get_int(&b); 492 enc->block_size = buffer_get_int(&b);
493 enc->key = buffer_get_string(&b, &enc->key_len); 493 enc->key = buffer_get_string(&b, &enc->key_len);
494 enc->iv = buffer_get_string(&b, &len); 494 enc->iv = buffer_get_string(&b, &enc->iv_len);
495 if (len != enc->block_size)
496 fatal("%s: bad ivlen: expected %u != %u", __func__,
497 enc->block_size, len);
498 495
499 if (enc->name == NULL || cipher_by_name(enc->name) != enc->cipher) 496 if (enc->name == NULL || cipher_by_name(enc->name) != enc->cipher)
500 fatal("%s: bad cipher name %s or pointer %p", __func__, 497 fatal("%s: bad cipher name %s or pointer %p", __func__,
501 enc->name, enc->cipher); 498 enc->name, enc->cipher);
502 499
503 /* Mac structure */ 500 /* Mac structure */
504 mac->name = buffer_get_string(&b, NULL); 501 if (cipher_authlen(enc->cipher) == 0) {
505 if (mac->name == NULL || mac_setup(mac, mac->name) == -1) 502 mac->name = buffer_get_string(&b, NULL);
506 fatal("%s: can not setup mac %s", __func__, mac->name); 503 if (mac->name == NULL || mac_setup(mac, mac->name) == -1)
507 mac->enabled = buffer_get_int(&b); 504 fatal("%s: can not setup mac %s", __func__, mac->name);
508 mac->key = buffer_get_string(&b, &len); 505 mac->enabled = buffer_get_int(&b);
509 if (len > mac->key_len) 506 mac->key = buffer_get_string(&b, &len);
510 fatal("%s: bad mac key length: %u > %d", __func__, len, 507 if (len > mac->key_len)
511 mac->key_len); 508 fatal("%s: bad mac key length: %u > %d", __func__, len,
512 mac->key_len = len; 509 mac->key_len);
510 mac->key_len = len;
511 }
513 512
514 /* Comp structure */ 513 /* Comp structure */
515 comp->type = buffer_get_int(&b); 514 comp->type = buffer_get_int(&b);
@@ -551,13 +550,15 @@ mm_newkeys_to_blob(int mode, u_char **blobp, u_int *lenp)
551 buffer_put_int(&b, enc->enabled); 550 buffer_put_int(&b, enc->enabled);
552 buffer_put_int(&b, enc->block_size); 551 buffer_put_int(&b, enc->block_size);
553 buffer_put_string(&b, enc->key, enc->key_len); 552 buffer_put_string(&b, enc->key, enc->key_len);
554 packet_get_keyiv(mode, enc->iv, enc->block_size); 553 packet_get_keyiv(mode, enc->iv, enc->iv_len);
555 buffer_put_string(&b, enc->iv, enc->block_size); 554 buffer_put_string(&b, enc->iv, enc->iv_len);
556 555
557 /* Mac structure */ 556 /* Mac structure */
558 buffer_put_cstring(&b, mac->name); 557 if (cipher_authlen(enc->cipher) == 0) {
559 buffer_put_int(&b, mac->enabled); 558 buffer_put_cstring(&b, mac->name);
560 buffer_put_string(&b, mac->key, mac->key_len); 559 buffer_put_int(&b, mac->enabled);
560 buffer_put_string(&b, mac->key, mac->key_len);
561 }
561 562
562 /* Comp structure */ 563 /* Comp structure */
563 buffer_put_int(&b, comp->type); 564 buffer_put_int(&b, comp->type);
diff --git a/myproposal.h b/myproposal.h
index d98f4b051..99d093461 100644
--- a/myproposal.h
+++ b/myproposal.h
@@ -1,4 +1,4 @@
1/* $OpenBSD: myproposal.h,v 1.31 2012/12/11 22:31:18 markus Exp $ */ 1/* $OpenBSD: myproposal.h,v 1.32 2013/01/08 18:49:04 markus Exp $ */
2 2
3/* 3/*
4 * Copyright (c) 2000 Markus Friedl. All rights reserved. 4 * Copyright (c) 2000 Markus Friedl. All rights reserved.
@@ -73,6 +73,7 @@
73#define KEX_DEFAULT_ENCRYPT \ 73#define KEX_DEFAULT_ENCRYPT \
74 "aes128-ctr,aes192-ctr,aes256-ctr," \ 74 "aes128-ctr,aes192-ctr,aes256-ctr," \
75 "arcfour256,arcfour128," \ 75 "arcfour256,arcfour128," \
76 "aes128-gcm@openssh.com,aes256-gcm@openssh.com," \
76 "aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc," \ 77 "aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc," \
77 "aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se" 78 "aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se"
78#ifdef HAVE_EVP_SHA256 79#ifdef HAVE_EVP_SHA256
diff --git a/packet.c b/packet.c
index fe379aa49..ae7b04cd8 100644
--- a/packet.c
+++ b/packet.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: packet.c,v 1.179 2012/12/12 16:45:52 markus Exp $ */ 1/* $OpenBSD: packet.c,v 1.180 2013/01/08 18:49:04 markus Exp $ */
2/* 2/*
3 * Author: Tatu Ylonen <ylo@cs.hut.fi> 3 * Author: Tatu Ylonen <ylo@cs.hut.fi>
4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -709,7 +709,7 @@ packet_send1(void)
709 buffer_len(&active_state->outgoing_packet)); 709 buffer_len(&active_state->outgoing_packet));
710 cipher_crypt(&active_state->send_context, cp, 710 cipher_crypt(&active_state->send_context, cp,
711 buffer_ptr(&active_state->outgoing_packet), 711 buffer_ptr(&active_state->outgoing_packet),
712 buffer_len(&active_state->outgoing_packet), 0); 712 buffer_len(&active_state->outgoing_packet), 0, 0);
713 713
714#ifdef PACKET_DEBUG 714#ifdef PACKET_DEBUG
715 fprintf(stderr, "encrypted: "); 715 fprintf(stderr, "encrypted: ");
@@ -757,7 +757,7 @@ set_newkeys(int mode)
757 mac = &active_state->newkeys[mode]->mac; 757 mac = &active_state->newkeys[mode]->mac;
758 comp = &active_state->newkeys[mode]->comp; 758 comp = &active_state->newkeys[mode]->comp;
759 mac_clear(mac); 759 mac_clear(mac);
760 memset(enc->iv, 0, enc->block_size); 760 memset(enc->iv, 0, enc->iv_len);
761 memset(enc->key, 0, enc->key_len); 761 memset(enc->key, 0, enc->key_len);
762 memset(mac->key, 0, mac->key_len); 762 memset(mac->key, 0, mac->key_len);
763 xfree(enc->name); 763 xfree(enc->name);
@@ -774,11 +774,11 @@ set_newkeys(int mode)
774 enc = &active_state->newkeys[mode]->enc; 774 enc = &active_state->newkeys[mode]->enc;
775 mac = &active_state->newkeys[mode]->mac; 775 mac = &active_state->newkeys[mode]->mac;
776 comp = &active_state->newkeys[mode]->comp; 776 comp = &active_state->newkeys[mode]->comp;
777 if (mac_init(mac) == 0) 777 if (cipher_authlen(enc->cipher) == 0 && mac_init(mac) == 0)
778 mac->enabled = 1; 778 mac->enabled = 1;
779 DBG(debug("cipher_init_context: %d", mode)); 779 DBG(debug("cipher_init_context: %d", mode));
780 cipher_init(cc, enc->cipher, enc->key, enc->key_len, 780 cipher_init(cc, enc->cipher, enc->key, enc->key_len,
781 enc->iv, enc->block_size, crypt_type); 781 enc->iv, enc->iv_len, crypt_type);
782 /* Deleting the keys does not gain extra security */ 782 /* Deleting the keys does not gain extra security */
783 /* memset(enc->iv, 0, enc->block_size); 783 /* memset(enc->iv, 0, enc->block_size);
784 memset(enc->key, 0, enc->key_len); 784 memset(enc->key, 0, enc->key_len);
@@ -846,7 +846,7 @@ packet_send2_wrapped(void)
846{ 846{
847 u_char type, *cp, *macbuf = NULL; 847 u_char type, *cp, *macbuf = NULL;
848 u_char padlen, pad = 0; 848 u_char padlen, pad = 0;
849 u_int i, len, aadlen = 0; 849 u_int i, len, authlen = 0, aadlen = 0;
850 u_int32_t rnd = 0; 850 u_int32_t rnd = 0;
851 Enc *enc = NULL; 851 Enc *enc = NULL;
852 Mac *mac = NULL; 852 Mac *mac = NULL;
@@ -857,9 +857,12 @@ packet_send2_wrapped(void)
857 enc = &active_state->newkeys[MODE_OUT]->enc; 857 enc = &active_state->newkeys[MODE_OUT]->enc;
858 mac = &active_state->newkeys[MODE_OUT]->mac; 858 mac = &active_state->newkeys[MODE_OUT]->mac;
859 comp = &active_state->newkeys[MODE_OUT]->comp; 859 comp = &active_state->newkeys[MODE_OUT]->comp;
860 /* disable mac for authenticated encryption */
861 if ((authlen = cipher_authlen(enc->cipher)) != 0)
862 mac = NULL;
860 } 863 }
861 block_size = enc ? enc->block_size : 8; 864 block_size = enc ? enc->block_size : 8;
862 aadlen = mac && mac->enabled && mac->etm ? 4 : 0; 865 aadlen = (mac && mac->enabled && mac->etm) || authlen ? 4 : 0;
863 866
864 cp = buffer_ptr(&active_state->outgoing_packet); 867 cp = buffer_ptr(&active_state->outgoing_packet);
865 type = cp[5]; 868 type = cp[5];
@@ -936,10 +939,10 @@ packet_send2_wrapped(void)
936 DBG(debug("done calc MAC out #%d", active_state->p_send.seqnr)); 939 DBG(debug("done calc MAC out #%d", active_state->p_send.seqnr));
937 } 940 }
938 /* encrypt packet and append to output buffer. */ 941 /* encrypt packet and append to output buffer. */
939 cp = buffer_append_space(&active_state->output, len); 942 cp = buffer_append_space(&active_state->output, len + authlen);
940 cipher_crypt(&active_state->send_context, cp, 943 cipher_crypt(&active_state->send_context, cp,
941 buffer_ptr(&active_state->outgoing_packet), 944 buffer_ptr(&active_state->outgoing_packet),
942 len - aadlen, aadlen); 945 len - aadlen, aadlen, authlen);
943 /* append unencrypted MAC */ 946 /* append unencrypted MAC */
944 if (mac && mac->enabled) { 947 if (mac && mac->enabled) {
945 if (mac->etm) { 948 if (mac->etm) {
@@ -1199,7 +1202,7 @@ packet_read_poll1(void)
1199 buffer_clear(&active_state->incoming_packet); 1202 buffer_clear(&active_state->incoming_packet);
1200 cp = buffer_append_space(&active_state->incoming_packet, padded_len); 1203 cp = buffer_append_space(&active_state->incoming_packet, padded_len);
1201 cipher_crypt(&active_state->receive_context, cp, 1204 cipher_crypt(&active_state->receive_context, cp,
1202 buffer_ptr(&active_state->input), padded_len, 0); 1205 buffer_ptr(&active_state->input), padded_len, 0, 0);
1203 1206
1204 buffer_consume(&active_state->input, padded_len); 1207 buffer_consume(&active_state->input, padded_len);
1205 1208
@@ -1248,7 +1251,7 @@ packet_read_poll2(u_int32_t *seqnr_p)
1248{ 1251{
1249 u_int padlen, need; 1252 u_int padlen, need;
1250 u_char *macbuf = NULL, *cp, type; 1253 u_char *macbuf = NULL, *cp, type;
1251 u_int maclen, aadlen = 0, block_size; 1254 u_int maclen, authlen = 0, aadlen = 0, block_size;
1252 Enc *enc = NULL; 1255 Enc *enc = NULL;
1253 Mac *mac = NULL; 1256 Mac *mac = NULL;
1254 Comp *comp = NULL; 1257 Comp *comp = NULL;
@@ -1260,10 +1263,13 @@ packet_read_poll2(u_int32_t *seqnr_p)
1260 enc = &active_state->newkeys[MODE_IN]->enc; 1263 enc = &active_state->newkeys[MODE_IN]->enc;
1261 mac = &active_state->newkeys[MODE_IN]->mac; 1264 mac = &active_state->newkeys[MODE_IN]->mac;
1262 comp = &active_state->newkeys[MODE_IN]->comp; 1265 comp = &active_state->newkeys[MODE_IN]->comp;
1266 /* disable mac for authenticated encryption */
1267 if ((authlen = cipher_authlen(enc->cipher)) != 0)
1268 mac = NULL;
1263 } 1269 }
1264 maclen = mac && mac->enabled ? mac->mac_len : 0; 1270 maclen = mac && mac->enabled ? mac->mac_len : 0;
1265 block_size = enc ? enc->block_size : 8; 1271 block_size = enc ? enc->block_size : 8;
1266 aadlen = mac && mac->enabled && mac->etm ? 4 : 0; 1272 aadlen = (mac && mac->enabled && mac->etm) || authlen ? 4 : 0;
1267 1273
1268 if (aadlen && active_state->packlen == 0) { 1274 if (aadlen && active_state->packlen == 0) {
1269 if (buffer_len(&active_state->input) < 4) 1275 if (buffer_len(&active_state->input) < 4)
@@ -1290,7 +1296,7 @@ packet_read_poll2(u_int32_t *seqnr_p)
1290 cp = buffer_append_space(&active_state->incoming_packet, 1296 cp = buffer_append_space(&active_state->incoming_packet,
1291 block_size); 1297 block_size);
1292 cipher_crypt(&active_state->receive_context, cp, 1298 cipher_crypt(&active_state->receive_context, cp,
1293 buffer_ptr(&active_state->input), block_size, 0); 1299 buffer_ptr(&active_state->input), block_size, 0, 0);
1294 cp = buffer_ptr(&active_state->incoming_packet); 1300 cp = buffer_ptr(&active_state->incoming_packet);
1295 active_state->packlen = get_u32(cp); 1301 active_state->packlen = get_u32(cp);
1296 if (active_state->packlen < 1 + 4 || 1302 if (active_state->packlen < 1 + 4 ||
@@ -1316,8 +1322,8 @@ packet_read_poll2(u_int32_t *seqnr_p)
1316 */ 1322 */
1317 need = 4 + active_state->packlen - block_size; 1323 need = 4 + active_state->packlen - block_size;
1318 } 1324 }
1319 DBG(debug("partial packet: block %d, need %d, maclen %d, aadlen %d", 1325 DBG(debug("partial packet: block %d, need %d, maclen %d, authlen %d,"
1320 block_size, need, maclen, aadlen)); 1326 " aadlen %d", block_size, need, maclen, authlen, aadlen));
1321 if (need % block_size != 0) { 1327 if (need % block_size != 0) {
1322 logit("padding error: need %d block %d mod %d", 1328 logit("padding error: need %d block %d mod %d",
1323 need, block_size, need % block_size); 1329 need, block_size, need % block_size);
@@ -1329,10 +1335,11 @@ packet_read_poll2(u_int32_t *seqnr_p)
1329 * check if the entire packet has been received and 1335 * check if the entire packet has been received and
1330 * decrypt into incoming_packet: 1336 * decrypt into incoming_packet:
1331 * 'aadlen' bytes are unencrypted, but authenticated. 1337 * 'aadlen' bytes are unencrypted, but authenticated.
1332 * 'need' bytes are encrypted, followed by 1338 * 'need' bytes are encrypted, followed by either
1339 * 'authlen' bytes of authentication tag or
1333 * 'maclen' bytes of message authentication code. 1340 * 'maclen' bytes of message authentication code.
1334 */ 1341 */
1335 if (buffer_len(&active_state->input) < aadlen + need + maclen) 1342 if (buffer_len(&active_state->input) < aadlen + need + authlen + maclen)
1336 return SSH_MSG_NONE; 1343 return SSH_MSG_NONE;
1337#ifdef PACKET_DEBUG 1344#ifdef PACKET_DEBUG
1338 fprintf(stderr, "read_poll enc/full: "); 1345 fprintf(stderr, "read_poll enc/full: ");
@@ -1344,8 +1351,8 @@ packet_read_poll2(u_int32_t *seqnr_p)
1344 buffer_ptr(&active_state->input), aadlen + need); 1351 buffer_ptr(&active_state->input), aadlen + need);
1345 cp = buffer_append_space(&active_state->incoming_packet, aadlen + need); 1352 cp = buffer_append_space(&active_state->incoming_packet, aadlen + need);
1346 cipher_crypt(&active_state->receive_context, cp, 1353 cipher_crypt(&active_state->receive_context, cp,
1347 buffer_ptr(&active_state->input), need, aadlen); 1354 buffer_ptr(&active_state->input), need, aadlen, authlen);
1348 buffer_consume(&active_state->input, aadlen + need); 1355 buffer_consume(&active_state->input, aadlen + need + authlen);
1349 /* 1356 /*
1350 * compute MAC over seqnr and packet, 1357 * compute MAC over seqnr and packet,
1351 * increment sequence number for incoming packet 1358 * increment sequence number for incoming packet
diff --git a/ssh_config.5 b/ssh_config.5
index ee466d800..269529c00 100644
--- a/ssh_config.5
+++ b/ssh_config.5
@@ -33,8 +33,8 @@
33.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 33.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
34.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 34.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
35.\" 35.\"
36.\" $OpenBSD: ssh_config.5,v 1.160 2012/12/11 22:31:18 markus Exp $ 36.\" $OpenBSD: ssh_config.5,v 1.161 2013/01/08 18:49:04 markus Exp $
37.Dd $Mdocdate: December 11 2012 $ 37.Dd $Mdocdate: January 8 2013 $
38.Dt SSH_CONFIG 5 38.Dt SSH_CONFIG 5
39.Os 39.Os
40.Sh NAME 40.Sh NAME
@@ -204,6 +204,8 @@ The supported ciphers are
204.Dq aes128-ctr , 204.Dq aes128-ctr ,
205.Dq aes192-ctr , 205.Dq aes192-ctr ,
206.Dq aes256-ctr , 206.Dq aes256-ctr ,
207.Dq aes128-gcm@openssh.com ,
208.Dq aes256-gcm@openssh.com ,
207.Dq arcfour128 , 209.Dq arcfour128 ,
208.Dq arcfour256 , 210.Dq arcfour256 ,
209.Dq arcfour , 211.Dq arcfour ,
@@ -213,6 +215,7 @@ and
213The default is: 215The default is:
214.Bd -literal -offset 3n 216.Bd -literal -offset 3n
215aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128, 217aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,
218aes128-gcm@openssh.com,aes256-gcm@openssh.com,
216aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc, 219aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,
217aes256-cbc,arcfour 220aes256-cbc,arcfour
218.Ed 221.Ed
diff --git a/sshd_config.5 b/sshd_config.5
index 0f4aa639d..e7bb0b55f 100644
--- a/sshd_config.5
+++ b/sshd_config.5
@@ -33,8 +33,8 @@
33.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 33.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
34.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 34.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
35.\" 35.\"
36.\" $OpenBSD: sshd_config.5,v 1.152 2012/12/11 22:31:18 markus Exp $ 36.\" $OpenBSD: sshd_config.5,v 1.153 2013/01/08 18:49:04 markus Exp $
37.Dd $Mdocdate: December 11 2012 $ 37.Dd $Mdocdate: January 8 2013 $
38.Dt SSHD_CONFIG 5 38.Dt SSHD_CONFIG 5
39.Os 39.Os
40.Sh NAME 40.Sh NAME
@@ -336,6 +336,8 @@ The supported ciphers are
336.Dq aes128-ctr , 336.Dq aes128-ctr ,
337.Dq aes192-ctr , 337.Dq aes192-ctr ,
338.Dq aes256-ctr , 338.Dq aes256-ctr ,
339.Dq aes128-gcm@openssh.com ,
340.Dq aes256-gcm@openssh.com ,
339.Dq arcfour128 , 341.Dq arcfour128 ,
340.Dq arcfour256 , 342.Dq arcfour256 ,
341.Dq arcfour , 343.Dq arcfour ,
@@ -345,6 +347,7 @@ and
345The default is: 347The default is:
346.Bd -literal -offset 3n 348.Bd -literal -offset 3n
347aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128, 349aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,
350aes128-gcm@openssh.com,aes256-gcm@openssh.com,
348aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc, 351aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,
349aes256-cbc,arcfour 352aes256-cbc,arcfour
350.Ed 353.Ed
generated by cgit v1.2.3 (git 2.39.1) at 2024-06-27 07:40:19 +0000