1296781Sdes/* $OpenBSD: myproposal.h,v 1.50 2016/02/09 05:30:04 djm Exp $ */ 2224638Sbrooks/* $FreeBSD: stable/10/crypto/openssh/myproposal.h 323124 2017-09-01 22:52:18Z des $ */ 376259Sgreen 465668Skris/* 565668Skris * Copyright (c) 2000 Markus Friedl. All rights reserved. 665668Skris * 765668Skris * Redistribution and use in source and binary forms, with or without 865668Skris * modification, are permitted provided that the following conditions 965668Skris * are met: 1065668Skris * 1. Redistributions of source code must retain the above copyright 1165668Skris * notice, this list of conditions and the following disclaimer. 1265668Skris * 2. Redistributions in binary form must reproduce the above copyright 1365668Skris * notice, this list of conditions and the following disclaimer in the 1465668Skris * documentation and/or other materials provided with the distribution. 1565668Skris * 1665668Skris * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 1765668Skris * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 1865668Skris * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 1965668Skris * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 2065668Skris * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 2165668Skris * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 2265668Skris * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 2365668Skris * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 2465668Skris * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 2565668Skris * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 2665668Skris */ 27162856Sdes 28162856Sdes#include <openssl/opensslv.h> 29162856Sdes 30255767Sdes/* conditional algorithm support */ 31255767Sdes 32221420Sdes#ifdef OPENSSL_HAS_ECC 33262566Sdes#ifdef OPENSSL_HAS_NISTP521 34221420Sdes# define KEX_ECDH_METHODS \ 35221420Sdes "ecdh-sha2-nistp256," \ 36221420Sdes "ecdh-sha2-nistp384," \ 37221420Sdes "ecdh-sha2-nistp521," 38221420Sdes# define HOSTKEY_ECDSA_CERT_METHODS \ 39221420Sdes "ecdsa-sha2-nistp256-cert-v01@openssh.com," \ 40221420Sdes "ecdsa-sha2-nistp384-cert-v01@openssh.com," \ 41221420Sdes "ecdsa-sha2-nistp521-cert-v01@openssh.com," 42221420Sdes# define HOSTKEY_ECDSA_METHODS \ 43221420Sdes "ecdsa-sha2-nistp256," \ 44221420Sdes "ecdsa-sha2-nistp384," \ 45221420Sdes "ecdsa-sha2-nistp521," 46221420Sdes#else 47262566Sdes# define KEX_ECDH_METHODS \ 48262566Sdes "ecdh-sha2-nistp256," \ 49262566Sdes "ecdh-sha2-nistp384," 50262566Sdes# define HOSTKEY_ECDSA_CERT_METHODS \ 51262566Sdes "ecdsa-sha2-nistp256-cert-v01@openssh.com," \ 52262566Sdes "ecdsa-sha2-nistp384-cert-v01@openssh.com," 53262566Sdes# define HOSTKEY_ECDSA_METHODS \ 54262566Sdes "ecdsa-sha2-nistp256," \ 55262566Sdes "ecdsa-sha2-nistp384," 56262566Sdes#endif 57262566Sdes#else 58221420Sdes# define KEX_ECDH_METHODS 59221420Sdes# define HOSTKEY_ECDSA_CERT_METHODS 60221420Sdes# define HOSTKEY_ECDSA_METHODS 61221420Sdes#endif 62221420Sdes 63255767Sdes#ifdef OPENSSL_HAVE_EVPGCM 64255767Sdes# define AESGCM_CIPHER_MODES \ 65295367Sdes ",aes128-gcm@openssh.com,aes256-gcm@openssh.com" 66255767Sdes#else 67255767Sdes# define AESGCM_CIPHER_MODES 68255767Sdes#endif 69255767Sdes 70255767Sdes#ifdef HAVE_EVP_SHA256 71323124Sdes# define KEX_SHA2_METHODS \ 72323124Sdes "diffie-hellman-group-exchange-sha256," \ 73323124Sdes "diffie-hellman-group16-sha512," \ 74323124Sdes "diffie-hellman-group18-sha512," 75323124Sdes# define KEX_SHA2_GROUP14 \ 76323124Sdes "diffie-hellman-group14-sha256," 77255767Sdes#define SHA2_HMAC_MODES \ 78255767Sdes "hmac-sha2-256," \ 79255767Sdes "hmac-sha2-512," 80162856Sdes#else 81323124Sdes# define KEX_SHA2_METHODS 82323124Sdes# define KEX_SHA2_GROUP14 83255767Sdes# define SHA2_HMAC_MODES 84221420Sdes#endif 85221420Sdes 86295367Sdes#ifdef WITH_OPENSSL 87295367Sdes# ifdef HAVE_EVP_SHA256 88295367Sdes# define KEX_CURVE25519_METHODS "curve25519-sha256@libssh.org," 89295367Sdes# else 90295367Sdes# define KEX_CURVE25519_METHODS "" 91295367Sdes# endif 92295367Sdes#define KEX_COMMON_KEX \ 93262566Sdes KEX_CURVE25519_METHODS \ 94221420Sdes KEX_ECDH_METHODS \ 95323124Sdes KEX_SHA2_METHODS 96295367Sdes 97295367Sdes#define KEX_SERVER_KEX KEX_COMMON_KEX \ 98323124Sdes KEX_SHA2_GROUP14 \ 99295367Sdes "diffie-hellman-group14-sha1" \ 100295367Sdes 101295367Sdes#define KEX_CLIENT_KEX KEX_COMMON_KEX \ 102162856Sdes "diffie-hellman-group-exchange-sha1," \ 103323124Sdes KEX_SHA2_GROUP14 \ 104295367Sdes "diffie-hellman-group14-sha1" 105162856Sdes 106215116Sdes#define KEX_DEFAULT_PK_ALG \ 107221420Sdes HOSTKEY_ECDSA_CERT_METHODS \ 108262566Sdes "ssh-ed25519-cert-v01@openssh.com," \ 109221420Sdes "ssh-rsa-cert-v01@openssh.com," \ 110221420Sdes "ssh-dss-cert-v01@openssh.com," \ 111221420Sdes HOSTKEY_ECDSA_METHODS \ 112262566Sdes "ssh-ed25519," \ 113296781Sdes "rsa-sha2-512," \ 114296781Sdes "rsa-sha2-256," \ 115221420Sdes "ssh-rsa," \ 116221420Sdes "ssh-dss" 117192595Sdes 118255767Sdes/* the actual algorithms */ 119255767Sdes 120295367Sdes#define KEX_SERVER_ENCRYPT \ 121295367Sdes "chacha20-poly1305@openssh.com," \ 122295367Sdes "aes128-ctr,aes192-ctr,aes256-ctr" \ 123296781Sdes AESGCM_CIPHER_MODES \ 124296781Sdes ",aes128-cbc,aes192-cbc,aes256-cbc" 125295367Sdes 126295367Sdes#define KEX_CLIENT_ENCRYPT KEX_SERVER_ENCRYPT "," \ 127296781Sdes "3des-cbc" 128255767Sdes 129295367Sdes#define KEX_SERVER_MAC \ 130248619Sdes "umac-64-etm@openssh.com," \ 131248619Sdes "umac-128-etm@openssh.com," \ 132248619Sdes "hmac-sha2-256-etm@openssh.com," \ 133248619Sdes "hmac-sha2-512-etm@openssh.com," \ 134295367Sdes "hmac-sha1-etm@openssh.com," \ 135295367Sdes "umac-64@openssh.com," \ 136295367Sdes "umac-128@openssh.com," \ 137295367Sdes "hmac-sha2-256," \ 138295367Sdes "hmac-sha2-512," \ 139295367Sdes "hmac-sha1" 140295367Sdes 141296781Sdes#define KEX_CLIENT_MAC KEX_SERVER_MAC 142226046Sdes 143296781Sdes#else /* WITH_OPENSSL */ 144295367Sdes 145295367Sdes#define KEX_SERVER_KEX \ 146295367Sdes "curve25519-sha256@libssh.org" 147295367Sdes#define KEX_DEFAULT_PK_ALG \ 148295367Sdes "ssh-ed25519-cert-v01@openssh.com," \ 149295367Sdes "ssh-ed25519" 150295367Sdes#define KEX_SERVER_ENCRYPT \ 151295367Sdes "chacha20-poly1305@openssh.com," \ 152295367Sdes "aes128-ctr,aes192-ctr,aes256-ctr" 153295367Sdes#define KEX_SERVER_MAC \ 154295367Sdes "umac-64-etm@openssh.com," \ 155295367Sdes "umac-128-etm@openssh.com," \ 156295367Sdes "hmac-sha2-256-etm@openssh.com," \ 157295367Sdes "hmac-sha2-512-etm@openssh.com," \ 158295367Sdes "hmac-sha1-etm@openssh.com," \ 159295367Sdes "umac-64@openssh.com," \ 160295367Sdes "umac-128@openssh.com," \ 161295367Sdes "hmac-sha2-256," \ 162295367Sdes "hmac-sha2-512," \ 163295367Sdes "hmac-sha1" 164295367Sdes 165295367Sdes#define KEX_CLIENT_KEX KEX_SERVER_KEX 166295367Sdes#define KEX_CLIENT_ENCRYPT KEX_SERVER_ENCRYPT 167295367Sdes#define KEX_CLIENT_MAC KEX_SERVER_MAC 168295367Sdes 169295367Sdes#endif /* WITH_OPENSSL */ 170295367Sdes 171149753Sdes#define KEX_DEFAULT_COMP "none,zlib@openssh.com,zlib" 17260573Skris#define KEX_DEFAULT_LANG "" 17360573Skris 174295367Sdes#define KEX_CLIENT \ 175295367Sdes KEX_CLIENT_KEX, \ 176295367Sdes KEX_DEFAULT_PK_ALG, \ 177295367Sdes KEX_CLIENT_ENCRYPT, \ 178295367Sdes KEX_CLIENT_ENCRYPT, \ 179295367Sdes KEX_CLIENT_MAC, \ 180295367Sdes KEX_CLIENT_MAC, \ 181295367Sdes KEX_DEFAULT_COMP, \ 182295367Sdes KEX_DEFAULT_COMP, \ 183295367Sdes KEX_DEFAULT_LANG, \ 184295367Sdes KEX_DEFAULT_LANG 18560573Skris 186295367Sdes#define KEX_SERVER \ 187295367Sdes KEX_SERVER_KEX, \ 188295367Sdes KEX_DEFAULT_PK_ALG, \ 189295367Sdes KEX_SERVER_ENCRYPT, \ 190295367Sdes KEX_SERVER_ENCRYPT, \ 191295367Sdes KEX_SERVER_MAC, \ 192295367Sdes KEX_SERVER_MAC, \ 193295367Sdes KEX_DEFAULT_COMP, \ 194295367Sdes KEX_DEFAULT_COMP, \ 195295367Sdes KEX_DEFAULT_LANG, \ 19660573Skris KEX_DEFAULT_LANG 197295367Sdes 198