mirror of git://anongit.mindrot.org/openssh.git
- markus@cvs.openbsd.org 2012/10/04 13:21:50
[myproposal.h ssh_config.5 umac.h sshd_config.5 ssh.1 sshd.8 mac.c]
add umac128 variant; ok djm@ at n2k12
(note: further Makefile work is required)
This commit is contained in:
Darren Tucker
parent
0dc283b13a
commit
427e409e99
|
|
@ -28,6 +28,9 @@
|
|||
- djm@cvs.openbsd.org 2012/10/02 07:07:45
|
||||
[ssh-keygen.c]
|
||||
fix -z option, broken in revision 1.215
|
||||
- markus@cvs.openbsd.org 2012/10/04 13:21:50
|
||||
[myproposal.h ssh_config.5 umac.h sshd_config.5 ssh.1 sshd.8 mac.c]
|
||||
add umac128 variant; ok djm@ at n2k12
|
||||
|
||||
20120917
|
||||
- (dtucker) OpenBSD CVS Sync
|
||||
|
|
|
|||
15
mac.c
15
mac.c
|
|
@ -1,4 +1,4 @@
|
|||
/* $OpenBSD: mac.c,v 1.18 2012/06/28 05:07:45 dtucker Exp $ */
|
||||
/* $OpenBSD: mac.c,v 1.19 2012/10/04 13:21:50 markus Exp $ */
|
||||
/*
|
||||
* Copyright (c) 2001 Markus Friedl. All rights reserved.
|
||||
*
|
||||
|
|
@ -48,6 +48,7 @@
|
|||
|
||||
#define SSH_EVP 1 /* OpenSSL EVP-based MAC */
|
||||
#define SSH_UMAC 2 /* UMAC (not integrated with OpenSSL) */
|
||||
#define SSH_UMAC128 3
|
||||
|
||||
struct {
|
||||
char *name;
|
||||
|
|
@ -68,6 +69,7 @@ struct {
|
|||
{ "hmac-ripemd160", SSH_EVP, EVP_ripemd160, 0, -1, -1 },
|
||||
{ "hmac-ripemd160@openssh.com", SSH_EVP, EVP_ripemd160, 0, -1, -1 },
|
||||
{ "umac-64@openssh.com", SSH_UMAC, NULL, 0, 128, 64 },
|
||||
{ "umac-128@openssh.com", SSH_UMAC128, NULL, 0, 128, 128 },
|
||||
{ NULL, 0, NULL, 0, -1, -1 }
|
||||
};
|
||||
|
||||
|
|
@ -122,6 +124,9 @@ mac_init(Mac *mac)
|
|||
case SSH_UMAC:
|
||||
mac->umac_ctx = umac_new(mac->key);
|
||||
return 0;
|
||||
case SSH_UMAC128:
|
||||
mac->umac_ctx = umac128_new(mac->key);
|
||||
return 0;
|
||||
default:
|
||||
return -1;
|
||||
}
|
||||
|
|
@ -151,6 +156,11 @@ mac_compute(Mac *mac, u_int32_t seqno, u_char *data, int datalen)
|
|||
umac_update(mac->umac_ctx, data, datalen);
|
||||
umac_final(mac->umac_ctx, m, nonce);
|
||||
break;
|
||||
case SSH_UMAC128:
|
||||
put_u64(nonce, seqno);
|
||||
umac128_update(mac->umac_ctx, data, datalen);
|
||||
umac128_final(mac->umac_ctx, m, nonce);
|
||||
break;
|
||||
default:
|
||||
fatal("mac_compute: unknown MAC type");
|
||||
}
|
||||
|
|
@ -163,6 +173,9 @@ mac_clear(Mac *mac)
|
|||
if (mac->type == SSH_UMAC) {
|
||||
if (mac->umac_ctx != NULL)
|
||||
umac_delete(mac->umac_ctx);
|
||||
} else if (mac->type == SSH_UMAC128) {
|
||||
if (mac->umac_ctx != NULL)
|
||||
umac128_delete(mac->umac_ctx);
|
||||
} else if (mac->evp_md != NULL)
|
||||
HMAC_cleanup(&mac->evp_ctx);
|
||||
mac->evp_md = NULL;
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
/* $OpenBSD: myproposal.h,v 1.29 2012/06/28 05:07:45 dtucker Exp $ */
|
||||
/* $OpenBSD: myproposal.h,v 1.30 2012/10/04 13:21:50 markus Exp $ */
|
||||
|
||||
/*
|
||||
* Copyright (c) 2000 Markus Friedl. All rights reserved.
|
||||
|
|
@ -86,6 +86,7 @@
|
|||
"hmac-md5," \
|
||||
"hmac-sha1," \
|
||||
"umac-64@openssh.com," \
|
||||
+ "umac-128@openssh.com," \
|
||||
SHA2_HMAC_MODES \
|
||||
"hmac-ripemd160," \
|
||||
"hmac-ripemd160@openssh.com," \
|
||||
|
|
|
|||
6
ssh.1
6
ssh.1
|
|
@ -33,8 +33,8 @@
|
|||
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
||||
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
.\"
|
||||
.\" $OpenBSD: ssh.1,v 1.329 2012/09/26 16:12:13 jmc Exp $
|
||||
.Dd $Mdocdate: September 26 2012 $
|
||||
.\" $OpenBSD: ssh.1,v 1.330 2012/10/04 13:21:50 markus Exp $
|
||||
.Dd $Mdocdate: October 4 2012 $
|
||||
.Dt SSH 1
|
||||
.Os
|
||||
.Sh NAME
|
||||
|
|
@ -674,7 +674,7 @@ it provides additional mechanisms for confidentiality
|
|||
(the traffic is encrypted using AES, 3DES, Blowfish, CAST128, or Arcfour)
|
||||
and integrity (hmac-md5, hmac-sha1,
|
||||
hmac-sha2-256, hmac-sha2-512,
|
||||
umac-64, hmac-ripemd160).
|
||||
umac-64, umac-128, hmac-ripemd160).
|
||||
Protocol 1 lacks a strong mechanism for ensuring the
|
||||
integrity of the connection.
|
||||
.Pp
|
||||
|
|
|
|||
|
|
@ -33,8 +33,8 @@
|
|||
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
||||
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
.\"
|
||||
.\" $OpenBSD: ssh_config.5,v 1.157 2012/06/29 13:57:25 naddy Exp $
|
||||
.Dd $Mdocdate: June 29 2012 $
|
||||
.\" $OpenBSD: ssh_config.5,v 1.158 2012/10/04 13:21:50 markus Exp $
|
||||
.Dd $Mdocdate: October 4 2012 $
|
||||
.Dt SSH_CONFIG 5
|
||||
.Os
|
||||
.Sh NAME
|
||||
|
|
@ -792,7 +792,7 @@ for data integrity protection.
|
|||
Multiple algorithms must be comma-separated.
|
||||
The default is:
|
||||
.Bd -literal -offset indent
|
||||
hmac-md5,hmac-sha1,umac-64@openssh.com,
|
||||
hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,
|
||||
hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,
|
||||
hmac-sha1-96,hmac-md5-96
|
||||
.Ed
|
||||
|
|
|
|||
6
sshd.8
6
sshd.8
|
|
@ -33,8 +33,8 @@
|
|||
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
||||
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
.\"
|
||||
.\" $OpenBSD: sshd.8,v 1.266 2012/06/18 12:07:07 dtucker Exp $
|
||||
.Dd $Mdocdate: June 18 2012 $
|
||||
.\" $OpenBSD: sshd.8,v 1.267 2012/10/04 13:21:50 markus Exp $
|
||||
.Dd $Mdocdate: October 4 2012 $
|
||||
.Dt SSHD 8
|
||||
.Os
|
||||
.Sh NAME
|
||||
|
|
@ -316,7 +316,7 @@ The client selects the encryption algorithm
|
|||
to use from those offered by the server.
|
||||
Additionally, session integrity is provided
|
||||
through a cryptographic message authentication code
|
||||
(hmac-md5, hmac-sha1, umac-64, hmac-ripemd160,
|
||||
(hmac-md5, hmac-sha1, umac-64, umac-128, hmac-ripemd160,
|
||||
hmac-sha2-256 or hmac-sha2-512).
|
||||
.Pp
|
||||
Finally, the server and the client enter an authentication dialog.
|
||||
|
|
|
|||
|
|
@ -33,8 +33,8 @@
|
|||
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
||||
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
.\"
|
||||
.\" $OpenBSD: sshd_config.5,v 1.144 2012/06/29 13:57:25 naddy Exp $
|
||||
.Dd $Mdocdate: June 29 2012 $
|
||||
.\" $OpenBSD: sshd_config.5,v 1.145 2012/10/04 13:21:50 markus Exp $
|
||||
.Dd $Mdocdate: October 4 2012 $
|
||||
.Dt SSHD_CONFIG 5
|
||||
.Os
|
||||
.Sh NAME
|
||||
|
|
@ -656,7 +656,7 @@ for data integrity protection.
|
|||
Multiple algorithms must be comma-separated.
|
||||
The default is:
|
||||
.Bd -literal -offset indent
|
||||
hmac-md5,hmac-sha1,umac-64@openssh.com,
|
||||
hmac-md5,hmac-sha1,umac-64@openssh.com,umac-128@openssh.com,
|
||||
hmac-sha2-256,hmac-sha2-512,hmac-ripemd160,
|
||||
hmac-sha1-96,hmac-md5-96
|
||||
.Ed
|
||||
|
|
|
|||
8
umac.h
8
umac.h
|
|
@ -1,4 +1,4 @@
|
|||
/* $OpenBSD: umac.h,v 1.1 2007/06/07 19:37:34 pvalchev Exp $ */
|
||||
/* $OpenBSD: umac.h,v 1.2 2012/10/04 13:21:50 markus Exp $ */
|
||||
/* -----------------------------------------------------------------------
|
||||
*
|
||||
* umac.h -- C Implementation UMAC Message Authentication
|
||||
|
|
@ -116,6 +116,12 @@ int uhash(uhash_ctx_t ctx,
|
|||
|
||||
#endif
|
||||
|
||||
/* matching umac-128 API, we reuse umac_ctx, since it's opaque */
|
||||
struct umac_ctx *umac128_new(u_char key[]);
|
||||
int umac128_update(struct umac_ctx *ctx, u_char *input, long len);
|
||||
int umac128_final(struct umac_ctx *ctx, u_char tag[], u_char nonce[8]);
|
||||
int umac128_delete(struct umac_ctx *ctx);
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
|
|
|||
Loading…
Reference in New Issue