FelipeMdeO opened a new pull request, #3664: URL: https://github.com/apache/nuttx-apps/pull/3664
## Summary Replace Dropbear's bundled libtomcrypt `chacha20-poly1305` implementation with an adapter that drives the NuttX crypto device (`/dev/crypto`). The SSH `[email protected]` construction maps onto `CRYPTO_CHACHA20_DJB` (the original 64-bit counter/nonce ChaCha20 parameterization the protocol uses) for the packet-length and payload keystreams, and onto `CRYPTO_POLY1305` for the authentication tag. Plain (non-HMAC) MACs are driven in two steps through `/dev/crypto`: `COP_FLAG_UPDATE` feeds the data, then a final call retrieves the tag. The bundled `chachapoly.c` is dropped from the build. This is the successor to the merged `hmac-sha2-256` adapter (#3640). ## Impact - **Users**: none unless `NETUTILS_DROPBEAR` is enabled; then the `[email protected]` cipher runs through `/dev/crypto` instead of the bundled libtomcrypt code. - **Build**: `NETUTILS_DROPBEAR` now depends on the cryptodev options above. ## Testing Tested on the NuttX simulator (`sim:dropbear`) and on real **STM32F746G-DISCO** hardware. A host OpenSSH client connects forcing `[email protected]`, so the new adapter (cipher + embedded Poly1305 tag) runs on every packet. ### STM32F746G-DISCO (software `/dev/crypto` backend) Board side (serial console): ``` NuttShell (NSH) NuttX-13.0.0 nsh> [4] Jan 14 00:00:05 using NuttX passwd auth at /data/passwd dropbear: listening on port 2222 nsh> useradd admin Felipe123! nsh> ifconfig eth0 Link encap:Ethernet HWaddr 00:e0:de:ad:be:ef at RUNNING mtu 1486 inet addr:192.168.15.155 DRaddr:192.168.15.1 Mask:255.255.255.0 nsh> [4] Jan 14 00:01:04 Password auth succeeded for 'admin' from 192.168.15.8:39594 [4] Jan 14 00:01:05 NSH PTY session started [4] Jan 14 00:01:05 Exit (admin) from <192.168.15.8:39594>: Disconnect received ``` PC side (note `cipher: [email protected]` negotiated in both directions): ``` $ ssh -v -c [email protected] -p 2222 [email protected] debug1: Remote protocol version 2.0, remote software version dropbear_2026.91 debug1: kex: algorithm: curve25519-sha256 debug1: kex: host key algorithm: ecdsa-sha2-nistp256 debug1: kex: server->client cipher: [email protected] MAC: <implicit> compression: none debug1: kex: client->server cipher: [email protected] MAC: <implicit> compression: none Authenticated to 192.168.15.155 ([192.168.15.155]:2222) using "password". nsh> uname -a NuttX stntest 13.0.0 2099ceda33 Jul 24 2026 20:05:23 arm stm32f746g-disco nsh> free total used free maxused maxfree nused nfree name 283788 145108 138680 145736 135800 117 8 Umem nsh> uptime 00:01:05 up 0:01, load average: 0.00, 0.00, 0.00 nsh> exit Connection to 192.168.15.155 closed. ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
