All of lore.kernel.org
 help / color / mirror / Atom feed
From: Thomas De Schampheleire <thomas.de_schampheleire@nokia.com>
To: buildroot@busybox.net
Subject: [Buildroot] [PATCH 4/5] dropbear: add option to disable CBC mode ciphers
Date: Wed, 4 Jul 2018 10:47:18 +0200	[thread overview]
Message-ID: <20180704084718.GD8766@australia.be.alcatel-lucent.com> (raw)
In-Reply-To: <20180704073057.dr3qp4t34daf434s@sapphire.tkos.co.il>

Hi Baruch,

On Wed, Jul 04, 2018 at 10:30:58AM +0300, Baruch Siach wrote:
> Hi Thomas,
> 
> On Wed, Jul 04, 2018 at 09:07:38AM +0200, Thomas De Schampheleire wrote:
> > CBC mode ciphers are considered insecure. Add an option to disable it.
> 
> We have a patch from Stefan S?rensen to disable all weak algorithms by 
> default:
> 
>   http://patchwork.ozlabs.org/patch/938595/
> 
> I prefer Stefan's patch over this and the next patch.
> 
> Stefan's patch doesn't deal with the MD5 HMAC as the next patch does. But I 
> find it highly unlikely that upstream would enable MD5 by default ever again. 
> Upstream commit 34ee32607598 adds this code in sysoptions.h:
> 
> /* might be needed for compatibility with very old implementations */
> #ifndef DROPBEAR_MD5_HMAC
> #define DROPBEAR_MD5_HMAC 0
> #endif
> 
> default_options.h doesn't mention MD5 at all.


Thanks for this info. I'm perfectly fine with Stefan's patch instead of these
two.

/Thomas

  reply	other threads:[~2018-07-04  8:47 UTC|newest]

Thread overview: 14+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-07-04  7:07 [Buildroot] [PATCH 0/5] misc. patches from Nokia Thomas De Schampheleire
2018-07-04  7:07 ` [Buildroot] [PATCH 1/5] linux: automatically set CONFIG_PERF_EVENTS when perf is enabled Thomas De Schampheleire
2018-07-04 19:52   ` Thomas Petazzoni
2018-07-04  7:07 ` [Buildroot] [PATCH 2/5] pigz: new package Thomas De Schampheleire
2018-07-04  9:51   ` Thomas Petazzoni
2018-07-04 20:30   ` Thomas Petazzoni
2018-07-05  8:00     ` Thomas De Schampheleire
2018-07-04  7:07 ` [Buildroot] [PATCH 3/5] host zstd: additionally build binary and make selectable Thomas De Schampheleire
2018-07-04 20:00   ` Thomas Petazzoni
2018-07-04  7:07 ` [Buildroot] [PATCH 4/5] dropbear: add option to disable CBC mode ciphers Thomas De Schampheleire
2018-07-04  7:30   ` Baruch Siach
2018-07-04  8:47     ` Thomas De Schampheleire [this message]
2018-07-04 19:44   ` Thomas Petazzoni
2018-07-04  7:07 ` [Buildroot] [PATCH 5/5] dropbear: add option to disable weak HMAC algorithms Thomas De Schampheleire

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20180704084718.GD8766@australia.be.alcatel-lucent.com \
    --to=thomas.de_schampheleire@nokia.com \
    --cc=buildroot@busybox.net \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.