From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Fri, 08 Jul 2022 11:09:30 +0200 Received: from metis.ext.pengutronix.de ([2001:67c:670:201:290:27ff:fe1d:cc33]) by lore.white.stw.pengutronix.de with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1o9jzK-00AJzb-OG for lore@lore.pengutronix.de; Fri, 08 Jul 2022 11:09:30 +0200 Received: from localhost ([127.0.0.1] helo=metis.ext.pengutronix.de) by metis.ext.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1o9jzN-00046n-FC; Fri, 08 Jul 2022 11:09:29 +0200 Received: from drehscheibe.grey.stw.pengutronix.de ([2a0a:edc0:0:c01:1d::a2]) by metis.ext.pengutronix.de with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1o9jyw-00043a-SZ; Fri, 08 Jul 2022 11:09:02 +0200 Received: from [2a0a:edc0:0:1101:1d::39] (helo=dude03.red.stw.pengutronix.de) by drehscheibe.grey.stw.pengutronix.de with esmtp (Exim 4.94.2) (envelope-from ) id 1o9jyr-0057wm-Um; Fri, 08 Jul 2022 11:09:01 +0200 Received: from mol by dude03.red.stw.pengutronix.de with local (Exim 4.94.2) (envelope-from ) id 1o9jyu-00HOxb-J9; Fri, 08 Jul 2022 11:09:00 +0200 Date: Fri, 8 Jul 2022 11:09:00 +0200 From: Michael Olbrich To: Ian Abbott Message-ID: Mail-Followup-To: Ian Abbott , ptxdist@pengutronix.de, Alexander Dahl , Bruno Thomsen References: <20220704121831.23787-1-ada@thorsis.com> <20220704121831.23787-7-ada@thorsis.com> <2c07edab-1c42-7fe3-29d7-ff8e401a40ca@mev.co.uk> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <2c07edab-1c42-7fe3-29d7-ff8e401a40ca@mev.co.uk> X-Sent-From: Pengutronix Hildesheim X-URL: http://www.pengutronix.de/ X-IRC: #ptxdist @freenode X-Accept-Language: de,en X-Accept-Content-Type: text/plain Subject: Re: [ptxdist] [PATCH 6/8] dropbear: Rework key exchange algorithm options X-BeenThere: ptxdist@pengutronix.de X-Mailman-Version: 2.1.29 Precedence: list List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: ptxdist@pengutronix.de Cc: Alexander Dahl , Bruno Thomsen , ptxdist@pengutronix.de Sender: "ptxdist" X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: ptxdist-bounces@pengutronix.de X-SA-Exim-Scanned: No (on metis.ext.pengutronix.de); SAEximRunCond expanded to false On Mon, Jul 04, 2022 at 01:31:10PM +0100, Ian Abbott wrote: > On 04/07/2022 13:18, Alexander Dahl wrote: > > The options for diffie-hellman key exchange were mixed up with message > > integrity hmacs. > > > > Signed-off-by: Alexander Dahl > > --- > > rules/dropbear.in | 43 +++++++++++++++++++++++++++++++++++++++++-- > > rules/dropbear.make | 36 ++++++++++++++++++++++++++++++++---- > > 2 files changed, 73 insertions(+), 6 deletions(-) > > > > diff --git a/rules/dropbear.in b/rules/dropbear.in > > index f7f96a762..043b0e76d 100644 > > --- a/rules/dropbear.in > > +++ b/rules/dropbear.in > [snip] > > config DROPBEAR_CURVE25519 > > bool > > - prompt "curve25519-donna" > > + prompt "curve25519" > > help > > Enable curve25519-donna for key exchange. > > The name in the prompt now differs from the name in the help text, which > might be confusing. I'll change the help to match the prompt when I apply this (unless my test builds find something else that require a v2). > > > This is another elliptic curve method with good security properties. > > This algorithm does not rely on NIST-based curves > > and gives us more security confidence against a possible > > backdoor in nistp-256 curve. > > + > > + Small systems should generally include either curve25519 or > > + ecdh for performance. > > + > > +config DROPBEAR_DH_GROUP1 > > + bool > > + prompt "group1 (legacy, client only)" > > + help > > + 1024 bit, sha1. > > + is too small for security though is necessary if you need > > + compatibility with some implementations such as Dropbear > > + versions < 0.53. > > + Client only! > > Missing word "This"? I'll add it. Michael > > -- > -=( Ian Abbott || MEV Ltd. is a company )=- > -=( registered in England & Wales. Regd. number: 02862268. )=- > -=( Regd. addr.: S11 & 12 Building 67, Europa Business Park, )=- > -=( Bird Hall Lane, STOCKPORT, SK3 0XA, UK. || www.mev.co.uk )=- > > -- Pengutronix e.K. | | Steuerwalder Str. 21 | http://www.pengutronix.de/ | 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 | Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |