Thomas Wolf 8edde18c8c sshd: implement server-sig-algs SSH extension (client side) ... Apache MINA sshd has an implementation of this, but it doesn't comply to RFC 8308 [1] and it is buggy. (See SSHD-1141 [2].) Add a simpler KexExtensionHandler and if the server sends extension server-sig-algs, use its value to re-order the chosen signature algorithms such that the algorithms the server announced as supported are at the front. If the server didn't tell us anything, don't do anything. RFC 8308 suggests for RSA to default to ssh-rsa, but says once rsa-sha2-* was "widely enough" adopted, defaulting to that might be OK. Currently we seem to be in a transition phase; Fedora 33 has already disabled ssh-rsa by default, and openssh is about to do so. Whatever we might do without info from the server, it'd be good for some servers and bad for others. So don't do anything and let the user re-order via ssh config PubkeyAcceptedAlgorithms on a case-by-case basis. [1] https://tools.ietf.org/html/rfc8308 [2] https://issues.apache.org/jira/browse/SSHD-1141 Bug: 572056 Change-Id: I59aa691a030ffe0fae54289df00ca5c6e165817b Signed-off-by: Thomas Wolf <thomas.wolf@paranor.ch>		2021-04-01 19:01:02 +02:00
..
MANIFEST.MF	sshd: implement server-sig-algs SSH extension (client side)	2021-04-01 19:01:02 +02:00
SOURCE-MANIFEST.MF	Prepare 5.12.0-SNAPSHOT builds	2021-03-10 16:34:28 +01:00