Skip to content

Commit

Permalink
Updated notes on OpenSSH default key exchanges. (#258)
Browse files Browse the repository at this point in the history
  • Loading branch information
@jtesta
jtesta committed Mar 19, 2024
1 parent 3d403b1 commit d7f8bf3
Show file tree
Hide file tree
Showing 11 changed files with 24 additions and 23 deletions.
7 changes: 4 additions & 3 deletions src/ssh_audit/ssh2_kexdb.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -62,7 +62,8 @@ class SSH2_KexDB: # pylint: disable=too-few-public-methods
WARN_TAG_SIZE_96 = 'using small 96-bit tag size'

INFO_DEFAULT_OPENSSH_CIPHER = 'default cipher since OpenSSH 6.9'
INFO_DEFAULT_OPENSSH_KEX_64_TO_89 = 'default key exchange from OpenSSH 6.4 to 8.9'
INFO_DEFAULT_OPENSSH_KEX_65_TO_73 = 'default key exchange from OpenSSH 6.5 to 7.3'
INFO_DEFAULT_OPENSSH_KEX_74_TO_89 = 'default key exchange from OpenSSH 7.4 to 8.9'
INFO_DEFAULT_OPENSSH_KEX_90 = 'default key exchange since OpenSSH 9.0'
INFO_DEPRECATED_IN_OPENSSH88 = 'deprecated in OpenSSH 8.8: https://www.openssh.com/txt/release-8.8'
INFO_DISABLED_IN_DBEAR67 = 'disabled in Dropbear SSH 2015.67'
Expand All @@ -82,8 +83,8 @@ class SSH2_KexDB: # pylint: disable=too-few-public-methods
# Format: 'algorithm_name': [['version_first_appeared_in'], [reason_for_failure1, reason_for_failure2, ...], [warning1, warning2, ...], [info1, info2, ...]]
'kex': {
'Curve25519SHA256': [[]],
'curve25519-sha256': [['7.4,d2018.76'], [], [], [INFO_DEFAULT_OPENSSH_KEX_64_TO_89]],
'[email protected]': [['6.4,d2013.62,l10.6.0'], [], [], [INFO_DEFAULT_OPENSSH_KEX_64_TO_89]],
'curve25519-sha256': [['7.4,d2018.76'], [], [], [INFO_DEFAULT_OPENSSH_KEX_74_TO_89]],
'[email protected]': [['6.4,d2013.62,l10.6.0'], [], [], [INFO_DEFAULT_OPENSSH_KEX_65_TO_73]],
'curve448-sha512': [[]],
'[email protected]': [[]],
'diffie-hellman-group14-sha1': [['3.9,d0.53,l10.6.0'], [FAIL_SHA1], [WARN_2048BIT_MODULUS]],
Expand Down
4 changes: 2 additions & 2 deletions test/docker/expected_results/dropbear_2019.78_test1.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -96,7 +96,7 @@
"algorithm": "curve25519-sha256",
"notes": {
"info": [
"default key exchange from OpenSSH 6.4 to 8.9",
"default key exchange from OpenSSH 7.4 to 8.9",
"available since OpenSSH 7.4, Dropbear SSH 2018.76"
]
}
Expand All @@ -105,7 +105,7 @@
"algorithm": "[email protected]",
"notes": {
"info": [
"default key exchange from OpenSSH 6.4 to 8.9",
"default key exchange from OpenSSH 6.5 to 7.3",
"available since OpenSSH 6.4, Dropbear SSH 2013.62"
]
}
Expand Down
4 changes: 2 additions & 2 deletions test/docker/expected_results/dropbear_2019.78_test1.txt
View file
Original file line number Diff line number Diff line change
Expand Up @@ -6,9 +6,9 @@

# key exchange algorithms
(kex) curve25519-sha256 -- [info] available since OpenSSH 7.4, Dropbear SSH 2018.76
 `- [info] default key exchange from OpenSSH 6.4 to 8.9
 `- [info] default key exchange from OpenSSH 7.4 to 8.9
(kex) [email protected] -- [info] available since OpenSSH 6.4, Dropbear SSH 2013.62
 `- [info] default key exchange from OpenSSH 6.4 to 8.9
 `- [info] default key exchange from OpenSSH 6.5 to 7.3
(kex) ecdh-sha2-nistp521 -- [fail] using elliptic curves that are suspected as being backdoored by the U.S. National Security Agency
`- [info] available since OpenSSH 5.7, Dropbear SSH 2013.62
(kex) ecdh-sha2-nistp384 -- [fail] using elliptic curves that are suspected as being backdoored by the U.S. National Security Agency
Expand Down
4 changes: 2 additions & 2 deletions test/docker/expected_results/openssh_8.0p1_test1.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -115,7 +115,7 @@
"algorithm": "curve25519-sha256",
"notes": {
"info": [
"default key exchange from OpenSSH 6.4 to 8.9",
"default key exchange from OpenSSH 7.4 to 8.9",
"available since OpenSSH 7.4, Dropbear SSH 2018.76"
]
}
Expand All @@ -124,7 +124,7 @@
"algorithm": "[email protected]",
"notes": {
"info": [
"default key exchange from OpenSSH 6.4 to 8.9",
"default key exchange from OpenSSH 6.5 to 7.3",
"available since OpenSSH 6.4, Dropbear SSH 2013.62"
]
}
Expand Down
4 changes: 2 additions & 2 deletions test/docker/expected_results/openssh_8.0p1_test1.txt
View file
Original file line number Diff line number Diff line change
Expand Up @@ -12,9 +12,9 @@

# key exchange algorithms
(kex) curve25519-sha256 -- [info] available since OpenSSH 7.4, Dropbear SSH 2018.76
 `- [info] default key exchange from OpenSSH 6.4 to 8.9
 `- [info] default key exchange from OpenSSH 7.4 to 8.9
(kex) [email protected] -- [info] available since OpenSSH 6.4, Dropbear SSH 2013.62
 `- [info] default key exchange from OpenSSH 6.4 to 8.9
 `- [info] default key exchange from OpenSSH 6.5 to 7.3
(kex) ecdh-sha2-nistp256 -- [fail] using elliptic curves that are suspected as being backdoored by the U.S. National Security Agency
`- [info] available since OpenSSH 5.7, Dropbear SSH 2013.62
(kex) ecdh-sha2-nistp384 -- [fail] using elliptic curves that are suspected as being backdoored by the U.S. National Security Agency
Expand Down
4 changes: 2 additions & 2 deletions test/docker/expected_results/openssh_8.0p1_test2.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -105,7 +105,7 @@
"algorithm": "curve25519-sha256",
"notes": {
"info": [
"default key exchange from OpenSSH 6.4 to 8.9",
"default key exchange from OpenSSH 7.4 to 8.9",
"available since OpenSSH 7.4, Dropbear SSH 2018.76"
]
}
Expand All @@ -114,7 +114,7 @@
"algorithm": "[email protected]",
"notes": {
"info": [
"default key exchange from OpenSSH 6.4 to 8.9",
"default key exchange from OpenSSH 6.5 to 7.3",
"available since OpenSSH 6.4, Dropbear SSH 2013.62"
]
}
Expand Down
4 changes: 2 additions & 2 deletions test/docker/expected_results/openssh_8.0p1_test2.txt
View file
Original file line number Diff line number Diff line change
Expand Up @@ -12,9 +12,9 @@

# key exchange algorithms
(kex) curve25519-sha256 -- [info] available since OpenSSH 7.4, Dropbear SSH 2018.76
 `- [info] default key exchange from OpenSSH 6.4 to 8.9
 `- [info] default key exchange from OpenSSH 7.4 to 8.9
(kex) [email protected] -- [info] available since OpenSSH 6.4, Dropbear SSH 2013.62
 `- [info] default key exchange from OpenSSH 6.4 to 8.9
 `- [info] default key exchange from OpenSSH 6.5 to 7.3
(kex) ecdh-sha2-nistp256 -- [fail] using elliptic curves that are suspected as being backdoored by the U.S. National Security Agency
`- [info] available since OpenSSH 5.7, Dropbear SSH 2013.62
(kex) ecdh-sha2-nistp384 -- [fail] using elliptic curves that are suspected as being backdoored by the U.S. National Security Agency
Expand Down
4 changes: 2 additions & 2 deletions test/docker/expected_results/openssh_8.0p1_test3.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -105,7 +105,7 @@
"algorithm": "curve25519-sha256",
"notes": {
"info": [
"default key exchange from OpenSSH 6.4 to 8.9",
"default key exchange from OpenSSH 7.4 to 8.9",
"available since OpenSSH 7.4, Dropbear SSH 2018.76"
]
}
Expand All @@ -114,7 +114,7 @@
"algorithm": "[email protected]",
"notes": {
"info": [
"default key exchange from OpenSSH 6.4 to 8.9",
"default key exchange from OpenSSH 6.5 to 7.3",
"available since OpenSSH 6.4, Dropbear SSH 2013.62"
]
}
Expand Down
4 changes: 2 additions & 2 deletions test/docker/expected_results/openssh_8.0p1_test3.txt
View file
Original file line number Diff line number Diff line change
Expand Up @@ -12,9 +12,9 @@

# key exchange algorithms
(kex) curve25519-sha256 -- [info] available since OpenSSH 7.4, Dropbear SSH 2018.76
 `- [info] default key exchange from OpenSSH 6.4 to 8.9
 `- [info] default key exchange from OpenSSH 7.4 to 8.9
(kex) [email protected] -- [info] available since OpenSSH 6.4, Dropbear SSH 2013.62
 `- [info] default key exchange from OpenSSH 6.4 to 8.9
 `- [info] default key exchange from OpenSSH 6.5 to 7.3
(kex) diffie-hellman-group-exchange-sha256 (4096-bit) -- [info] available since OpenSSH 4.4
 `- [info] OpenSSH's GEX fallback mechanism was triggered during testing. Very old SSH clients will still be able to create connections using a 2048-bit modulus, though modern clients will use 4096. This can only be disabled by recompiling the code (see https://github.com/openssh/openssh-portable/blob/V_9_4/dh.c#L477).

Expand Down
4 changes: 2 additions & 2 deletions test/docker/expected_results/tinyssh_20190101_test1.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@
"algorithm": "curve25519-sha256",
"notes": {
"info": [
"default key exchange from OpenSSH 6.4 to 8.9",
"default key exchange from OpenSSH 7.4 to 8.9",
"available since OpenSSH 7.4, Dropbear SSH 2018.76"
]
}
Expand All @@ -52,7 +52,7 @@
"algorithm": "[email protected]",
"notes": {
"info": [
"default key exchange from OpenSSH 6.4 to 8.9",
"default key exchange from OpenSSH 6.5 to 7.3",
"available since OpenSSH 6.4, Dropbear SSH 2013.62"
]
}
Expand Down
4 changes: 2 additions & 2 deletions test/docker/expected_results/tinyssh_20190101_test1.txt
View file
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,9 @@

# key exchange algorithms
(kex) curve25519-sha256 -- [info] available since OpenSSH 7.4, Dropbear SSH 2018.76
 `- [info] default key exchange from OpenSSH 6.4 to 8.9
 `- [info] default key exchange from OpenSSH 7.4 to 8.9
(kex) [email protected] -- [info] available since OpenSSH 6.4, Dropbear SSH 2013.62
 `- [info] default key exchange from OpenSSH 6.4 to 8.9
 `- [info] default key exchange from OpenSSH 6.5 to 7.3
(kex) [email protected] -- [warn] using experimental algorithm
`- [info] available since OpenSSH 8.0
`- [info] the sntrup4591761 algorithm was withdrawn, as it may not provide strong post-quantum security
Expand Down

0 comments on commit d7f8bf3

Please sign in to comment.