diff options
| author | djm@openbsd.org <djm@openbsd.org> | 2020-12-29 01:59:15 +0100 |
|---|---|---|
| committer | Damien Miller <djm@mindrot.org> | 2020-12-29 02:38:53 +0100 |
| commit | 2c71cec020219d69df84055c59eba5799a1233ec (patch) | |
| tree | 7d8a80e1ae15d16ae7d186da0fb50c80d2933c7b /ssh-keyscan.c | |
| parent | upstream: tweak the description of KnownHostsCommand in ssh_conf.5, (diff) | |
| download | openssh-2c71cec020219d69df84055c59eba5799a1233ec.tar.xz openssh-2c71cec020219d69df84055c59eba5799a1233ec.zip | |
upstream: Update/replace the experimental post-quantim hybrid key
exchange method based on Streamlined NTRU Prime (coupled with X25519).
The previous sntrup4591761x25519-sha512@tinyssh.org method is
replaced with sntrup761x25519-sha512@openssh.com. Per the authors,
sntrup4591761 was replaced almost two years ago by sntrup761.
The sntrup761 implementaion, like sntrup4591761 before it, is public
domain code extracted from the SUPERCOP cryptography benchmark
suite (https://bench.cr.yp.to/supercop.html).
Thanks for Daniel J Bernstein for guidance on algorithm selection.
Patch from Tobias Heider; feedback & ok markus@ and myself
(note this both the updated method and the one that it replaced are
disabled by default)
OpenBSD-Commit-ID: 2bf582b772d81ee24e911bb6f4b2aecfd39338ae
Diffstat (limited to 'ssh-keyscan.c')
| -rw-r--r-- | ssh-keyscan.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/ssh-keyscan.c b/ssh-keyscan.c index e01b6dd4d..ab71adf9f 100644 --- a/ssh-keyscan.c +++ b/ssh-keyscan.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssh-keyscan.c,v 1.137 2020/10/19 08:07:08 djm Exp $ */ +/* $OpenBSD: ssh-keyscan.c,v 1.138 2020/12/29 00:59:15 djm Exp $ */ /* * Copyright 1995, 1996 by David Mazieres <dm@lcs.mit.edu>. * @@ -293,7 +293,7 @@ keygrab_ssh2(con *c) # endif #endif c->c_ssh->kex->kex[KEX_C25519_SHA256] = kex_gen_client; - c->c_ssh->kex->kex[KEX_KEM_SNTRUP4591761X25519_SHA512] = kex_gen_client; + c->c_ssh->kex->kex[KEX_KEM_SNTRUP761X25519_SHA512] = kex_gen_client; ssh_set_verify_host_key_callback(c->c_ssh, key_print_wrapper); /* * do the key-exchange until an error occurs or until |