Skip to content

Commit ac58737

Browse files
drakkangopherbot
drakkan
authored and
gopherbot
committed
ssh: export supported algorithms
Fixes golang/go#61537 Change-Id: If3478121e3ae445391e3faeceeb889d75e9e3214 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/531935 LUCI-TryBot-Result: Go LUCI <[email protected]> Auto-Submit: Nicola Murino <[email protected]> Reviewed-by: Cherry Mui <[email protected]> Reviewed-by: Michael Knyszek <[email protected]> Reviewed-by: Filippo Valsorda <[email protected]>
1 parent 9dbbcf0 commit ac58737

23 files changed

+483
-214
lines changed

‎ssh/agent/client.go

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -555,7 +555,7 @@ func (c *client) insertKey(s interface{}, comment string, constraints []byte) er
555555
})
556556
case *dsa.PrivateKey:
557557
req = ssh.Marshal(dsaKeyMsg{
558-
Type: ssh.KeyAlgoDSA,
558+
Type: ssh.InsecureKeyAlgoDSA,
559559
P: k.P,
560560
Q: k.Q,
561561
G: k.G,
@@ -803,16 +803,16 @@ var _ ssh.AlgorithmSigner = &agentKeyringSigner{}
803803
//
804804
// This map must be kept in sync with the one in certs.go.
805805
var certKeyAlgoNames = map[string]string{
806-
ssh.CertAlgoRSAv01: ssh.KeyAlgoRSA,
807-
ssh.CertAlgoRSASHA256v01: ssh.KeyAlgoRSASHA256,
808-
ssh.CertAlgoRSASHA512v01: ssh.KeyAlgoRSASHA512,
809-
ssh.CertAlgoDSAv01: ssh.KeyAlgoDSA,
810-
ssh.CertAlgoECDSA256v01: ssh.KeyAlgoECDSA256,
811-
ssh.CertAlgoECDSA384v01: ssh.KeyAlgoECDSA384,
812-
ssh.CertAlgoECDSA521v01: ssh.KeyAlgoECDSA521,
813-
ssh.CertAlgoSKECDSA256v01: ssh.KeyAlgoSKECDSA256,
814-
ssh.CertAlgoED25519v01: ssh.KeyAlgoED25519,
815-
ssh.CertAlgoSKED25519v01: ssh.KeyAlgoSKED25519,
806+
ssh.CertAlgoRSAv01: ssh.KeyAlgoRSA,
807+
ssh.CertAlgoRSASHA256v01: ssh.KeyAlgoRSASHA256,
808+
ssh.CertAlgoRSASHA512v01: ssh.KeyAlgoRSASHA512,
809+
ssh.InsecureCertAlgoDSAv01: ssh.InsecureKeyAlgoDSA,
810+
ssh.CertAlgoECDSA256v01: ssh.KeyAlgoECDSA256,
811+
ssh.CertAlgoECDSA384v01: ssh.KeyAlgoECDSA384,
812+
ssh.CertAlgoECDSA521v01: ssh.KeyAlgoECDSA521,
813+
ssh.CertAlgoSKECDSA256v01: ssh.KeyAlgoSKECDSA256,
814+
ssh.CertAlgoED25519v01: ssh.KeyAlgoED25519,
815+
ssh.CertAlgoSKED25519v01: ssh.KeyAlgoSKED25519,
816816
}
817817

818818
// underlyingAlgo returns the signature algorithm associated with algo (which is

‎ssh/agent/server.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -506,15 +506,15 @@ func (s *server) insertIdentity(req []byte) error {
506506
switch record.Type {
507507
case ssh.KeyAlgoRSA:
508508
addedKey, err = parseRSAKey(req)
509-
case ssh.KeyAlgoDSA:
509+
case ssh.InsecureKeyAlgoDSA:
510510
addedKey, err = parseDSAKey(req)
511511
case ssh.KeyAlgoECDSA256, ssh.KeyAlgoECDSA384, ssh.KeyAlgoECDSA521:
512512
addedKey, err = parseECDSAKey(req)
513513
case ssh.KeyAlgoED25519:
514514
addedKey, err = parseEd25519Key(req)
515515
case ssh.CertAlgoRSAv01:
516516
addedKey, err = parseRSACert(req)
517-
case ssh.CertAlgoDSAv01:
517+
case ssh.InsecureCertAlgoDSAv01:
518518
addedKey, err = parseDSACert(req)
519519
case ssh.CertAlgoECDSA256v01, ssh.CertAlgoECDSA384v01, ssh.CertAlgoECDSA521v01:
520520
addedKey, err = parseECDSACert(req)

‎ssh/certs.go

Lines changed: 23 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -20,14 +20,19 @@ import (
2020
// returned by MultiAlgorithmSigner and don't appear in the Signature.Format
2121
// field.
2222
const (
23-
CertAlgoRSAv01 = "[email protected]"
24-
CertAlgoDSAv01 = "[email protected]"
25-
CertAlgoECDSA256v01 = "[email protected]"
26-
CertAlgoECDSA384v01 = "[email protected]"
27-
CertAlgoECDSA521v01 = "[email protected]"
28-
CertAlgoSKECDSA256v01 = "[email protected]"
29-
CertAlgoED25519v01 = "[email protected]"
30-
CertAlgoSKED25519v01 = "[email protected]"
23+
CertAlgoRSAv01 = "[email protected]"
24+
// Deprecated: DSA is only supported at insecure key sizes, and was removed
25+
// from major implementations.
26+
CertAlgoDSAv01 = InsecureCertAlgoDSAv01
27+
// Deprecated: DSA is only supported at insecure key sizes, and was removed
28+
// from major implementations.
29+
InsecureCertAlgoDSAv01 = "[email protected]"
30+
CertAlgoECDSA256v01 = "[email protected]"
31+
CertAlgoECDSA384v01 = "[email protected]"
32+
CertAlgoECDSA521v01 = "[email protected]"
33+
CertAlgoSKECDSA256v01 = "[email protected]"
34+
CertAlgoED25519v01 = "[email protected]"
35+
CertAlgoSKED25519v01 = "[email protected]"
3136

3237
// CertAlgoRSASHA256v01 and CertAlgoRSASHA512v01 can't appear as a
3338
// Certificate.Type (or PublicKey.Type), but only in
@@ -485,16 +490,16 @@ func (c *Certificate) SignCert(rand io.Reader, authority Signer) error {
485490
//
486491
// This map must be kept in sync with the one in agent/client.go.
487492
var certKeyAlgoNames = map[string]string{
488-
CertAlgoRSAv01: KeyAlgoRSA,
489-
CertAlgoRSASHA256v01: KeyAlgoRSASHA256,
490-
CertAlgoRSASHA512v01: KeyAlgoRSASHA512,
491-
CertAlgoDSAv01: KeyAlgoDSA,
492-
CertAlgoECDSA256v01: KeyAlgoECDSA256,
493-
CertAlgoECDSA384v01: KeyAlgoECDSA384,
494-
CertAlgoECDSA521v01: KeyAlgoECDSA521,
495-
CertAlgoSKECDSA256v01: KeyAlgoSKECDSA256,
496-
CertAlgoED25519v01: KeyAlgoED25519,
497-
CertAlgoSKED25519v01: KeyAlgoSKED25519,
493+
CertAlgoRSAv01: KeyAlgoRSA,
494+
CertAlgoRSASHA256v01: KeyAlgoRSASHA256,
495+
CertAlgoRSASHA512v01: KeyAlgoRSASHA512,
496+
InsecureCertAlgoDSAv01: InsecureKeyAlgoDSA,
497+
CertAlgoECDSA256v01: KeyAlgoECDSA256,
498+
CertAlgoECDSA384v01: KeyAlgoECDSA384,
499+
CertAlgoECDSA521v01: KeyAlgoECDSA521,
500+
CertAlgoSKECDSA256v01: KeyAlgoSKECDSA256,
501+
CertAlgoED25519v01: KeyAlgoED25519,
502+
CertAlgoSKED25519v01: KeyAlgoSKED25519,
498503
}
499504

500505
// underlyingAlgo returns the signature algorithm associated with algo (which is

‎ssh/certs_test.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -297,7 +297,7 @@ func TestCertTypes(t *testing.T) {
297297
{"legacyRSASigner", &legacyRSASigner{testSigners["rsa"]}, KeyAlgoRSA},
298298
{"multiAlgoRSASignerSHA256", multiAlgoSignerSHA256, KeyAlgoRSASHA256},
299299
{"multiAlgoRSASignerSHA512", multiAlgoSignerSHA512, KeyAlgoRSASHA512},
300-
{CertAlgoDSAv01, testSigners["dsa"], ""},
300+
{InsecureCertAlgoDSAv01, testSigners["dsa"], ""},
301301
}
302302

303303
k, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)

‎ssh/cipher.go

Lines changed: 11 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -98,36 +98,36 @@ func streamCipherMode(skip int, createFunc func(key, iv []byte) (cipher.Stream,
9898
var cipherModes = map[string]*cipherMode{
9999
// Ciphers from RFC 4344, which introduced many CTR-based ciphers. Algorithms
100100
// are defined in the order specified in the RFC.
101-
"aes128-ctr": {16, aes.BlockSize, streamCipherMode(0, newAESCTR)},
102-
"aes192-ctr": {24, aes.BlockSize, streamCipherMode(0, newAESCTR)},
103-
"aes256-ctr": {32, aes.BlockSize, streamCipherMode(0, newAESCTR)},
101+
CipherAES128CTR: {16, aes.BlockSize, streamCipherMode(0, newAESCTR)},
102+
CipherAES192CTR: {24, aes.BlockSize, streamCipherMode(0, newAESCTR)},
103+
CipherAES256CTR: {32, aes.BlockSize, streamCipherMode(0, newAESCTR)},
104104

105105
// Ciphers from RFC 4345, which introduces security-improved arcfour ciphers.
106106
// They are defined in the order specified in the RFC.
107-
"arcfour128": {16, 0, streamCipherMode(1536, newRC4)},
108-
"arcfour256": {32, 0, streamCipherMode(1536, newRC4)},
107+
InsecureCipherRC4128: {16, 0, streamCipherMode(1536, newRC4)},
108+
InsecureCipherRC4256: {32, 0, streamCipherMode(1536, newRC4)},
109109

110110
// Cipher defined in RFC 4253, which describes SSH Transport Layer Protocol.
111111
// Note that this cipher is not safe, as stated in RFC 4253: "Arcfour (and
112112
// RC4) has problems with weak keys, and should be used with caution."
113113
// RFC 4345 introduces improved versions of Arcfour.
114-
"arcfour": {16, 0, streamCipherMode(0, newRC4)},
114+
InsecureCipherRC4: {16, 0, streamCipherMode(0, newRC4)},
115115

116116
// AEAD ciphers
117-
gcm128CipherID: {16, 12, newGCMCipher},
118-
gcm256CipherID: {32, 12, newGCMCipher},
119-
chacha20Poly1305ID: {64, 0, newChaCha20Cipher},
117+
CipherAES128GCM: {16, 12, newGCMCipher},
118+
CipherAES256GCM: {32, 12, newGCMCipher},
119+
CipherChaCha20Poly1305: {64, 0, newChaCha20Cipher},
120120

121121
// CBC mode is insecure and so is not included in the default config.
122122
// (See https://www.ieee-security.org/TC/SP2013/papers/4977a526.pdf). If absolutely
123123
// needed, it's possible to specify a custom Config to enable it.
124124
// You should expect that an active attacker can recover plaintext if
125125
// you do.
126-
aes128cbcID: {16, aes.BlockSize, newAESCBCCipher},
126+
InsecureCipherAES128CBC: {16, aes.BlockSize, newAESCBCCipher},
127127

128128
// 3des-cbc is insecure and is not included in the default
129129
// config.
130-
tripledescbcID: {24, des.BlockSize, newTripleDESCBCCipher},
130+
InsecureCipherTripleDESCBC: {24, des.BlockSize, newTripleDESCBCCipher},
131131
}
132132

133133
// prefixLen is the length of the packet prefix that contains the packet length
@@ -635,8 +635,6 @@ func (c *cbcCipher) writeCipherPacket(seqNum uint32, w io.Writer, rand io.Reader
635635
return nil
636636
}
637637

638-
const chacha20Poly1305ID = "[email protected]"
639-
640638
// chacha20Poly1305Cipher implements the [email protected]
641639
// AEAD, which is described here:
642640
//

‎ssh/cipher_test.go

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -22,16 +22,16 @@ func TestDefaultCiphersExist(t *testing.T) {
2222
t.Errorf("supported cipher %q is unknown", cipherAlgo)
2323
}
2424
}
25-
for _, cipherAlgo := range preferredCiphers {
25+
for _, cipherAlgo := range defaultCiphers {
2626
if _, ok := cipherModes[cipherAlgo]; !ok {
2727
t.Errorf("preferred cipher %q is unknown", cipherAlgo)
2828
}
2929
}
3030
}
3131

3232
func TestPacketCiphers(t *testing.T) {
33-
defaultMac := "hmac-sha2-256"
34-
defaultCipher := "aes128-ctr"
33+
defaultMac := HMACSHA256
34+
defaultCipher := CipherAES128CTR
3535
for cipher := range cipherModes {
3636
t.Run("cipher="+cipher,
3737
func(t *testing.T) { testPacketCipher(t, cipher, defaultMac) })
@@ -47,7 +47,7 @@ func testPacketCipher(t *testing.T, cipher, mac string) {
4747
algs := directionAlgorithms{
4848
Cipher: cipher,
4949
MAC: mac,
50-
Compression: "none",
50+
Compression: compressionNone,
5151
}
5252
client, err := newPacketCipher(clientKeys, algs, kr)
5353
if err != nil {
@@ -78,9 +78,9 @@ func testPacketCipher(t *testing.T, cipher, mac string) {
7878
func TestCBCOracleCounterMeasure(t *testing.T) {
7979
kr := &kexResult{Hash: crypto.SHA1}
8080
algs := directionAlgorithms{
81-
Cipher: aes128cbcID,
82-
MAC: "hmac-sha1",
83-
Compression: "none",
81+
Cipher: InsecureCipherAES128CBC,
82+
MAC: HMACSHA1,
83+
Compression: compressionNone,
8484
}
8585
client, err := newPacketCipher(clientKeys, algs, kr)
8686
if err != nil {
@@ -141,7 +141,7 @@ func TestCVE202143565(t *testing.T) {
141141
constructPacket func(packetCipher) io.Reader
142142
}{
143143
{
144-
cipher: gcm128CipherID,
144+
cipher: CipherAES128GCM,
145145
constructPacket: func(client packetCipher) io.Reader {
146146
internalCipher := client.(*gcmCipher)
147147
b := &bytes.Buffer{}
@@ -159,7 +159,7 @@ func TestCVE202143565(t *testing.T) {
159159
},
160160
},
161161
{
162-
cipher: chacha20Poly1305ID,
162+
cipher: CipherChaCha20Poly1305,
163163
constructPacket: func(client packetCipher) io.Reader {
164164
internalCipher := client.(*chacha20Poly1305Cipher)
165165
b := &bytes.Buffer{}
@@ -201,13 +201,13 @@ func TestCVE202143565(t *testing.T) {
201201
}
202202

203203
for _, tc := range tests {
204-
mac := "hmac-sha2-256"
204+
mac := HMACSHA256
205205

206206
kr := &kexResult{Hash: crypto.SHA1}
207207
algs := directionAlgorithms{
208208
Cipher: tc.cipher,
209209
MAC: mac,
210-
Compression: "none",
210+
Compression: compressionNone,
211211
}
212212
client, err := newPacketCipher(clientKeys, algs, kr)
213213
if err != nil {

‎ssh/client_auth_test.go

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -324,6 +324,9 @@ func TestMethodInvalidAlgorithm(t *testing.T) {
324324
}
325325

326326
func TestClientHMAC(t *testing.T) {
327+
supportedAlgos := SupportedAlgorithms()
328+
insecureAlgos := InsecureAlgorithms()
329+
supportedMACs := append(supportedAlgos.MACs, insecureAlgos.MACs...)
327330
for _, mac := range supportedMACs {
328331
config := &ClientConfig{
329332
User: "testuser",
@@ -349,7 +352,7 @@ func TestClientUnsupportedCipher(t *testing.T) {
349352
PublicKeys(),
350353
},
351354
Config: Config{
352-
Ciphers: []string{"aes128-cbc"}, // not currently supported
355+
Ciphers: []string{"unsupported-cipher"}, // not currently supported
353356
},
354357
}
355358
if err := tryAuth(t, config); err == nil {

‎ssh/client_test.go

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -292,7 +292,7 @@ func TestUnsupportedAlgorithm(t *testing.T) {
292292
{
293293
"unsupported and supported KEXs",
294294
Config{
295-
KeyExchanges: []string{"unsupported", kexAlgoCurve25519SHA256},
295+
KeyExchanges: []string{"unsupported", KeyExchangeCurve25519},
296296
},
297297
"",
298298
},
@@ -306,7 +306,7 @@ func TestUnsupportedAlgorithm(t *testing.T) {
306306
{
307307
"unsupported and supported ciphers",
308308
Config{
309-
Ciphers: []string{"unsupported", chacha20Poly1305ID},
309+
Ciphers: []string{"unsupported", CipherChaCha20Poly1305},
310310
},
311311
"",
312312
},
@@ -315,16 +315,16 @@ func TestUnsupportedAlgorithm(t *testing.T) {
315315
Config{
316316
MACs: []string{"unsupported"},
317317
// MAC is used for non AAED ciphers.
318-
Ciphers: []string{"aes256-ctr"},
318+
Ciphers: []string{CipherAES256CTR},
319319
},
320320
"no common algorithm",
321321
},
322322
{
323323
"unsupported and supported MACs",
324324
Config{
325-
MACs: []string{"unsupported", "[email protected]"},
325+
MACs: []string{"unsupported", HMACSHA256ETM},
326326
// MAC is used for non AAED ciphers.
327-
Ciphers: []string{"aes256-ctr"},
327+
Ciphers: []string{CipherAES256CTR},
328328
},
329329
"",
330330
},

0 commit comments

Comments
 (0)