On Mon, Feb 16, 2015 at 04:47:09PM +0100, Bruno Thomsen wrote: > The new version contain options to enable/disable cipher modes. > Keeping today's default cipher mode. > In a secure solution one would disable CBC and enable CTR. > > Signed-off-by: Bruno Thomsen <[email protected]> > --- > rules/dropbear.in | 15 +++++++++++++++ > rules/dropbear.make | 18 ++++++++++++++++-- > 2 files changed, 31 insertions(+), 2 deletions(-) > > diff --git a/rules/dropbear.in b/rules/dropbear.in > index fe2ada3..79aad57 100644 > --- a/rules/dropbear.in > +++ b/rules/dropbear.in > @@ -203,6 +203,21 @@ config DROPBEAR_TWOFISH256 > bijective f function made by four key-dependent > 8x8-bit S-boxes. > > +config DROPBEAR_CBC_CIPHERS > + bool > + prompt "CBC mode ciphers" > + default y > + help > + Enable CBC mode for ciphers. This has security issues though > + is the most compatible with older SSH implementations.
In that case, shouldn't this be off by default? Those that still need it can enable it. Michael > + > +config DROPBEAR_CTR_CIPHERS > + bool > + prompt "Counter mode ciphers" > + help > + Enable "Counter Mode" for ciphers. This is more secure than normal > + CBC mode against certain attacks. This adds around 1kB to binary > + size and is recommended for most cases. > > comment "Integrity, at least one required --- RFC Draft requires sha1-hmac > and recommends sha1-96" > > diff --git a/rules/dropbear.make b/rules/dropbear.make > index f03d0fc..ab9da5d 100644 > --- a/rules/dropbear.make > +++ b/rules/dropbear.make > @@ -18,8 +18,8 @@ PACKAGES-$(PTXCONF_DROPBEAR) += dropbear > # > # Paths and names > # > -DROPBEAR_VERSION := 2014.65 > -DROPBEAR_MD5 := 1918604238817385a156840fa2c39490 > +DROPBEAR_VERSION := 2015.67 > +DROPBEAR_MD5 := e967e320344cd4bfebe321e3ab8514d6 > DROPBEAR := dropbear-$(DROPBEAR_VERSION) > DROPBEAR_SUFFIX := tar.bz2 > DROPBEAR_URL := > http://matt.ucc.asn.au/dropbear/releases/$(DROPBEAR).$(DROPBEAR_SUFFIX) > @@ -163,7 +163,21 @@ else > @$(call disable_c, $(DROPBEAR_DIR)/options.h,DROPBEAR_TWOFISH128) > endif > > +ifdef PTXCONF_DROPBEAR_CBC_CIPHERS > + @echo "ptxdist: enabling cbc ciphers" > + @$(call enable_c, $(DROPBEAR_DIR)/options.h,DROPBEAR_ENABLE_CBC_MODE) > +else > + @echo "ptxdist: disabling cbc ciphers" > + @$(call disable_c, $(DROPBEAR_DIR)/options.h,DROPBEAR_ENABLE_CBC_MODE) > +endif > > +ifdef PTXCONF_DROPBEAR_CTR_CIPHERS > + @echo "ptxdist: enabling ctr ciphers" > + @$(call enable_c, $(DROPBEAR_DIR)/options.h,DROPBEAR_ENABLE_CTR_MODE) > +else > + @echo "ptxdist: disabling ctr ciphers" > + @$(call disable_c, $(DROPBEAR_DIR)/options.h,DROPBEAR_ENABLE_CTR_MODE) > +endif > > ifdef PTXCONF_DROPBEAR_SHA1 > @echo "ptxdist: enabling sha1" > -- > 1.9.1 > > > -- > ptxdist mailing list > [email protected] > -- Pengutronix e.K. | | Industrial Linux Solutions | http://www.pengutronix.de/ | Peiner Str. 6-8, 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 | Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 | -- ptxdist mailing list [email protected]
