# HG changeset patch
# User Matt Johnston <matt@ucc.asn.au>
# Date 1648615892 -28800
# Node ID ff8a81386a2bf63fc031519cbc48360ba20b3aab
# Parent  863f31b4cf3cbd12e461ae293d0adf1e1f52eef7
Disable dh-group1 KEX by default

Add comments for SK keys

diff -r 863f31b4cf3c -r ff8a81386a2b default_options.h
--- a/default_options.h	Wed Mar 30 12:03:50 2022 +0800
+++ b/default_options.h	Wed Mar 30 12:51:32 2022 +0800
@@ -134,10 +134,12 @@
  * code (either ECDSA or ECDH) increases binary size - around 30kB
  * on x86-64 */
 #define DROPBEAR_ECDSA 1
-#define DROPBEAR_SK_ECDSA 1
 /* Ed25519 is faster than ECDSA. Compiling in Ed25519 code increases
    binary size - around 7,5kB on x86-64 */
 #define DROPBEAR_ED25519 1
+/* SK_ECDSA/SK_ED25519 allows u2f security keys for public key auth.
+ * This is currently server-only. */
+#define DROPBEAR_SK_ECDSA 1
 #define DROPBEAR_SK_ED25519 1
 
 /* RSA must be >=1024 */
@@ -178,7 +180,7 @@
 #define DROPBEAR_DH_GROUP16 0
 #define DROPBEAR_CURVE25519 1
 #define DROPBEAR_ECDH 1
-#define DROPBEAR_DH_GROUP1 1
+#define DROPBEAR_DH_GROUP1 0
 
 /* When group1 is enabled it will only be allowed by Dropbear client
 not as a server, due to concerns over its strength. Set to 0 to allow