Mercurial > dropbear

comparison default_options.h @ 1659:d32bcb5c557d

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Add Ed25519 support (#91) * Add support for Ed25519 as a public key type Ed25519 is a elliptic curve signature scheme that offers better security than ECDSA and DSA and good performance. It may be used for both user and host keys. OpenSSH key import and fuzzer are not supported yet. Initially inspired by Peter Szabo. * Add curve25519 and ed25519 fuzzers * Add import and export of Ed25519 keys
author Vladislav Grishenko <themiron@users.noreply.github.com>
date Wed, 11 Mar 2020 21:09:45 +0500
parents aabde6f57fce
children 26e07f7f682a
comparison
equal deleted inserted replaced
1658:7402218141d4 1659:d32bcb5c557d
20 20
21 /* Default hostkey paths - these can be specified on the command line */ 21 /* Default hostkey paths - these can be specified on the command line */
22 #define DSS_PRIV_FILENAME "/etc/dropbear/dropbear_dss_host_key" 22 #define DSS_PRIV_FILENAME "/etc/dropbear/dropbear_dss_host_key"
23 #define RSA_PRIV_FILENAME "/etc/dropbear/dropbear_rsa_host_key" 23 #define RSA_PRIV_FILENAME "/etc/dropbear/dropbear_rsa_host_key"
24 #define ECDSA_PRIV_FILENAME "/etc/dropbear/dropbear_ecdsa_host_key" 24 #define ECDSA_PRIV_FILENAME "/etc/dropbear/dropbear_ecdsa_host_key"
25 #define ED25519_PRIV_FILENAME "/etc/dropbear/dropbear_ed25519_host_key"
25 26
26 /* Set NON_INETD_MODE if you require daemon functionality (ie Dropbear listens 27 /* Set NON_INETD_MODE if you require daemon functionality (ie Dropbear listens
27 * on chosen ports and keeps accepting connections. This is the default. 28 * on chosen ports and keeps accepting connections. This is the default.
28 * 29 *
29 * Set INETD_MODE if you want to be able to run Dropbear with inetd (or 30 * Set INETD_MODE if you want to be able to run Dropbear with inetd (or
114 #define DROPBEAR_DSS 1 115 #define DROPBEAR_DSS 1
115 /* ECDSA is significantly faster than RSA or DSS. Compiling in ECC 116 /* ECDSA is significantly faster than RSA or DSS. Compiling in ECC
116 * code (either ECDSA or ECDH) increases binary size - around 30kB 117 * code (either ECDSA or ECDH) increases binary size - around 30kB
117 * on x86-64 */ 118 * on x86-64 */
118 #define DROPBEAR_ECDSA 1 119 #define DROPBEAR_ECDSA 1
120 /* Ed25519 is faster than ECDSA. Compiling in Ed25519 code increases
121 binary size - around 7,5kB on x86-64 */
122 #define DROPBEAR_ED25519 1
119 123
120 /* RSA must be >=1024 */ 124 /* RSA must be >=1024 */
121 #define DROPBEAR_DEFAULT_RSA_SIZE 2048 125 #define DROPBEAR_DEFAULT_RSA_SIZE 2048
122 /* DSS is always 1024 */ 126 /* DSS is always 1024 */
123 /* ECDSA defaults to largest size configured, usually 521 */ 127 /* ECDSA defaults to largest size configured, usually 521 */
128 /* Ed25519 is always 256 */
124 129
125 /* Add runtime flag "-R" to generate hostkeys as-needed when the first 130 /* Add runtime flag "-R" to generate hostkeys as-needed when the first
126 connection using that key type occurs. 131 connection using that key type occurs.
127 This avoids the need to otherwise run "dropbearkey" and avoids some problems 132 This avoids the need to otherwise run "dropbearkey" and avoids some problems
128 with badly seeded /dev/urandom when systems first boot. */ 133 with badly seeded /dev/urandom when systems first boot. */
141 * group1 is too small for security though is necessary if you need 146 * group1 is too small for security though is necessary if you need
142 compatibility with some implementations such as Dropbear versions < 0.53 147 compatibility with some implementations such as Dropbear versions < 0.53
143 * group14 is supported by most implementations. 148 * group14 is supported by most implementations.
144 * group16 provides a greater strength level but is slower and increases binary size 149 * group16 provides a greater strength level but is slower and increases binary size
145 * curve25519 and ecdh algorithms are faster than non-elliptic curve methods 150 * curve25519 and ecdh algorithms are faster than non-elliptic curve methods
146 * curve25519 increases binary size by ~8kB on x86-64 151 * curve25519 increases binary size by ~2,5kB on x86-64
147 * including either ECDH or ECDSA increases binary size by ~30kB on x86-64 152 * including either ECDH or ECDSA increases binary size by ~30kB on x86-64
148 153
149 * Small systems should generally include either curve25519 or ecdh for performance. 154 * Small systems should generally include either curve25519 or ecdh for performance.
150 * curve25519 is less widely supported but is faster 155 * curve25519 is less widely supported but is faster
151 */ 156 */