[ptxdist] [PATCH] dropbear: stronger default MAC algorithms

[ptxdist] [PATCH] dropbear: stronger default MAC algorithms

[Bruno Thomsen]

Disable SHA1-96 since it gets flagged by Nessus security scanner.
Disable SHA1 since it's no longer recommended for cryotography,
and Google, Mozilla, Microsoft & NIST have all announced deprecation of it.

Tenable Network Security - Nessus:
http://www.tenable.com/plugins/index.php?view=single&id=71049

Signed-off-by: Bruno Thomsen <bth@kamstrup.com>
---
 rules/dropbear.in | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/rules/dropbear.in b/rules/dropbear.in
index 1c1d813..db4a8ab 100644
--- a/rules/dropbear.in
+++ b/rules/dropbear.in
@@ -224,7 +224,6 @@ comment "Integrity, at least one required --- RFC Draft requires sha1-hmac and r
 config DROPBEAR_SHA1
 	bool
 	prompt "sha1"
-	default y
 	help
 	  The Secure Hash Algorithm (SHA) was developed by NIST and
 	  is specified in the Secure Hash Standard (SHS, FIPS 180).
@@ -237,7 +236,6 @@ config DROPBEAR_SHA1
 config DROPBEAR_SHA1_96
 	bool
 	prompt "sha1-96"
-	default y
 	help
 	  The Secure Hash Algorithm (SHA) was developed by NIST and
 	  is specified in the Secure Hash Standard (SHS, FIPS 180).
@@ -250,6 +248,7 @@ config DROPBEAR_SHA1_96
 config DROPBEAR_SHA256
 	bool
 	prompt "sha256"
+	default y
 	help
 	  SHA-2 is a set of cryptographic hash functions (SHA-224, SHA-256,
 	  SHA-384, SHA-512) designed by the National Security Agency (NSA)
@@ -262,6 +261,7 @@ config DROPBEAR_SHA256
 config DROPBEAR_SHA512
 	bool
 	prompt "sha512"
+	default y
 	help
 	  SHA-2 is a set of cryptographic hash functions (SHA-224, SHA-256,
 	  SHA-384, SHA-512) designed by the National Security Agency (NSA)
-- 
1.9.1


-- 
ptxdist mailing list
ptxdist@pengutronix.de