Home | History | Annotate | Line # | Download | only in dist 
      1 /*	$NetBSD: myproposal.h,v 1.27 2026/04/08 18:58:41 christos Exp $	*/
      2 /* $OpenBSD: myproposal.h,v 1.78 2026/02/05 22:05:49 djm Exp $ */
      3 
      4 /*
      5  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
      6  *
      7  * Redistribution and use in source and binary forms, with or without
      8  * modification, are permitted provided that the following conditions
      9  * are met:
     10  * 1. Redistributions of source code must retain the above copyright
     11  *    notice, this list of conditions and the following disclaimer.
     12  * 2. Redistributions in binary form must reproduce the above copyright
     13  *    notice, this list of conditions and the following disclaimer in the
     14  *    documentation and/or other materials provided with the distribution.
     15  *
     16  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
     17  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
     18  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
     19  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
     20  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
     21  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
     22  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
     23  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
     24  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
     25  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     26  */
     27 
     28 #define KEX_SERVER_KEX	\
     29 	"mlkem768x25519-sha256," \
     30 	"sntrup761x25519-sha512," \
     31 	"sntrup761x25519-sha512 (at) openssh.com," \
     32 	"curve25519-sha256," \
     33 	"curve25519-sha256 (at) libssh.org," \
     34 	"ecdh-sha2-nistp256," \
     35 	"ecdh-sha2-nistp384," \
     36 	"ecdh-sha2-nistp521" \
     37 
     38 #define KEX_CLIENT_KEX KEX_SERVER_KEX "," \
     39 	"diffie-hellman-group-exchange-sha256," \
     40 	"diffie-hellman-group16-sha512," \
     41 	"diffie-hellman-group18-sha512," \
     42 	"diffie-hellman-group14-sha256"
     43 
     44 #define	KEX_DEFAULT_PK_ALG	\
     45 	"ssh-ed25519-cert-v01 (at) openssh.com," \
     46 	"ecdsa-sha2-nistp256-cert-v01 (at) openssh.com," \
     47 	"ecdsa-sha2-nistp384-cert-v01 (at) openssh.com," \
     48 	"ecdsa-sha2-nistp521-cert-v01 (at) openssh.com," \
     49 	"sk-ssh-ed25519-cert-v01 (at) openssh.com," \
     50 	"sk-ecdsa-sha2-nistp256-cert-v01 (at) openssh.com," \
     51 	"webauthn-sk-ecdsa-sha2-nistp256-cert-v01 (at) openssh.com," \
     52 	"rsa-sha2-512-cert-v01 (at) openssh.com," \
     53 	"rsa-sha2-256-cert-v01 (at) openssh.com," \
     54 	"ssh-ed25519," \
     55 	"ecdsa-sha2-nistp256," \
     56 	"ecdsa-sha2-nistp384," \
     57 	"ecdsa-sha2-nistp521," \
     58 	"sk-ssh-ed25519 (at) openssh.com," \
     59 	"sk-ecdsa-sha2-nistp256 (at) openssh.com," \
     60 	"webauthn-sk-ecdsa-sha2-nistp256 (at) openssh.com," \
     61 	"rsa-sha2-512," \
     62 	"rsa-sha2-256"
     63 
     64 #define	KEX_SERVER_ENCRYPT \
     65 	"chacha20-poly1305 (at) openssh.com," \
     66 	"aes128-gcm (at) openssh.com,aes256-gcm (at) openssh.com," \
     67 	"aes128-ctr,aes192-ctr,aes256-ctr"
     68 
     69 #define KEX_CLIENT_ENCRYPT KEX_SERVER_ENCRYPT
     70 
     71 #define	KEX_SERVER_MAC \
     72 	"umac-64-etm (at) openssh.com," \
     73 	"umac-128-etm (at) openssh.com," \
     74 	"hmac-sha2-256-etm (at) openssh.com," \
     75 	"hmac-sha2-512-etm (at) openssh.com," \
     76 	"hmac-sha1-etm (at) openssh.com," \
     77 	"umac-64 (at) openssh.com," \
     78 	"umac-128 (at) openssh.com," \
     79 	"hmac-sha2-256," \
     80 	"hmac-sha2-512," \
     81 	"hmac-sha1"
     82 
     83 #define KEX_CLIENT_MAC KEX_SERVER_MAC
     84 
     85 /* Not a KEX value, but here so all the algorithm defaults are together */
     86 #define	SSH_ALLOWED_CA_SIGALGS	\
     87 	"ssh-ed25519," \
     88 	"ecdsa-sha2-nistp256," \
     89 	"ecdsa-sha2-nistp384," \
     90 	"ecdsa-sha2-nistp521," \
     91 	"sk-ssh-ed25519 (at) openssh.com," \
     92 	"sk-ecdsa-sha2-nistp256 (at) openssh.com," \
     93 	"webauthn-sk-ecdsa-sha2-nistp256 (at) openssh.com," \
     94 	"rsa-sha2-512," \
     95 	"rsa-sha2-256"
     96 
     97 #define KEX_CLIENT_ENCRYPT_INCLUDE_NONE KEX_CLIENT_ENCRYPT \
     98 	",none"
     99 #define KEX_SERVER_ENCRYPT_INCLUDE_NONE KEX_SERVER_ENCRYPT \
    100 	",none"
    101 
    102 #define	KEX_DEFAULT_COMP	"none,zlib (at) openssh.com"
    103 #define	KEX_DEFAULT_LANG	""
    104 
    105 #define KEX_CLIENT \
    106 	KEX_CLIENT_KEX, \
    107 	KEX_DEFAULT_PK_ALG, \
    108 	KEX_CLIENT_ENCRYPT_INCLUDE_NONE, \
    109 	KEX_CLIENT_ENCRYPT_INCLUDE_NONE, \
    110 	KEX_CLIENT_MAC, \
    111 	KEX_CLIENT_MAC, \
    112 	KEX_DEFAULT_COMP, \
    113 	KEX_DEFAULT_COMP, \
    114 	KEX_DEFAULT_LANG, \
    115 	KEX_DEFAULT_LANG
    116 
    117 #define KEX_SERVER \
    118 	KEX_SERVER_KEX, \
    119 	KEX_DEFAULT_PK_ALG, \
    120 	KEX_SERVER_ENCRYPT_INCLUDE_NONE, \
    121 	KEX_SERVER_ENCRYPT_INCLUDE_NONE, \
    122 	KEX_SERVER_MAC, \
    123 	KEX_SERVER_MAC, \
    124 	KEX_DEFAULT_COMP, \
    125 	KEX_DEFAULT_COMP, \
    126 	KEX_DEFAULT_LANG, \
    127 	KEX_DEFAULT_LANG
    128