Reorder cipher and key preferences to make more sense #984
Conversation
| 'ecdsa-sha2-nistp256', | ||
| 'ecdsa-sha2-nistp384', | ||
| 'ecdsa-sha2-nistp521', | ||
| 'ssh-ed25519', |
There was a problem hiding this comment.
fine with me, but this order was chosen because it looks like openssh puts ecdsa first
debug2: host key algorithms: ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,rsa-sha2-512,rsa-sha2-256,ssh-rsa
There was a problem hiding this comment.
ubuntu-16.04 : OpenSSH_7.2p2 Ubuntu-4ubuntu2.2, OpenSSL 1.0.2g 1 Mar 2016
OS X 10.11 : OpenSSH_6.9p1, LibreSSL 2.1.8
There was a problem hiding this comment.
This doesn't match what I'm seeing with OpenSSH_7.4p1
There was a problem hiding this comment.
heh, even newer openssh - fair enough
| @@ -109,9 +109,9 @@ class Transport(threading.Thread, ClosingContextManager): | |||
| 'aes192-ctr', | |||
| 'aes256-ctr', | |||
| 'aes128-cbc', | |||
| 'blowfish-cbc', | |||
There was a problem hiding this comment.
I guess this is another case like md5 - older openssh puts blowfish-cbc here, newer openssh omits it (but includes aes192-cbc, aes256-cbc, and 3des-cbc ... maybe blowfish should go last)
debug2: kex_parse_kexinit: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,arcfour256,arcfour128,aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,aes192-cbc,aes256-cbc,arcfour,rijndael-cbc@lysator.liu.se
debug2: ciphers stoc: chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-cbc,aes192-cbc,aes256-cbc,3des-cbc
There was a problem hiding this comment.
AES-192 and AES-256 are definitely preferable to blowfish. Blowfish vs 3des isn't something I care enough to think about.
bitprophet
modified the milestones:
Next 1.x+2.x bugfix release,
Next 2.x-only bugfix release
|
Really gotta stop trying that bloody useless "change bases" feature...will cherry-pick to 2.0 in a sec. |
|
OK, change made to 2.0 and up, re: blowfish. Then just merged into master to get the Ed25519 tweak. Changelogged the former, latter no point since Ed25519 is new in master. |
No description provided.