[openssh-commits] [openssh] branch master updated: upstream: ssh(1): add a warning when the connection negotiates a
git+noreply at mindrot.org
git+noreply at mindrot.org
Mon Aug 11 21:03:41 AEST 2025
This is an automated email from the git hooks/post-receive script.
djm pushed a commit to branch master
in repository openssh.
The following commit(s) were added to refs/heads/master by this push:
new 0e1b8aa27 upstream: ssh(1): add a warning when the connection negotiates a
0e1b8aa27 is described below
commit 0e1b8aa27f7c86d412c9e54ad9e2cae30d9ddab4
Author: djm at openbsd.org <djm at openbsd.org>
AuthorDate: Mon Aug 11 10:55:38 2025 +0000
upstream: ssh(1): add a warning when the connection negotiates a
non-post quantum safe key agreement algorithm.
Controlled via a new WarnWeakCrypto ssh_config option, defaulting
to on. This option might grow additional weak crypto warnings in
the future.
More details at https://openssh.com/pq.html
mostly by deraadt@ feedback dtucker@ ok deraadt@
OpenBSD-Commit-ID: 974ff243a1eccceac6a1a9d8fab3bcc89d74a2a4
---
kex-names.c | 45 ++++++++++++++++++++++++++++-----------------
kex.c | 6 +++---
kex.h | 7 ++++++-
readconf.c | 24 ++++++++++++++++++++++--
readconf.h | 4 +++-
ssh_config.5 | 18 ++++++++++++++++--
sshconnect.c | 14 +++++++++++++-
7 files changed, 91 insertions(+), 27 deletions(-)
diff --git a/kex-names.c b/kex-names.c
index ec840c1f9..96deb8817 100644
--- a/kex-names.c
+++ b/kex-names.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: kex-names.c,v 1.4 2024/09/09 02:39:57 djm Exp $ */
+/* $OpenBSD: kex-names.c,v 1.5 2025/08/11 10:55:38 djm Exp $ */
/*
* Copyright (c) 2000, 2001 Markus Friedl. All rights reserved.
*
@@ -50,44 +50,45 @@ struct kexalg {
u_int type;
int ec_nid;
int hash_alg;
+ int pq_alg;
};
static const struct kexalg kexalgs[] = {
#ifdef WITH_OPENSSL
- { KEX_DH1, KEX_DH_GRP1_SHA1, 0, SSH_DIGEST_SHA1 },
- { KEX_DH14_SHA1, KEX_DH_GRP14_SHA1, 0, SSH_DIGEST_SHA1 },
- { KEX_DH14_SHA256, KEX_DH_GRP14_SHA256, 0, SSH_DIGEST_SHA256 },
- { KEX_DH16_SHA512, KEX_DH_GRP16_SHA512, 0, SSH_DIGEST_SHA512 },
- { KEX_DH18_SHA512, KEX_DH_GRP18_SHA512, 0, SSH_DIGEST_SHA512 },
- { KEX_DHGEX_SHA1, KEX_DH_GEX_SHA1, 0, SSH_DIGEST_SHA1 },
+ { KEX_DH1, KEX_DH_GRP1_SHA1, 0, SSH_DIGEST_SHA1, KEX_NOT_PQ },
+ { KEX_DH14_SHA1, KEX_DH_GRP14_SHA1, 0, SSH_DIGEST_SHA1, KEX_NOT_PQ },
+ { KEX_DH14_SHA256, KEX_DH_GRP14_SHA256, 0, SSH_DIGEST_SHA256, KEX_NOT_PQ },
+ { KEX_DH16_SHA512, KEX_DH_GRP16_SHA512, 0, SSH_DIGEST_SHA512, KEX_NOT_PQ },
+ { KEX_DH18_SHA512, KEX_DH_GRP18_SHA512, 0, SSH_DIGEST_SHA512, KEX_NOT_PQ },
+ { KEX_DHGEX_SHA1, KEX_DH_GEX_SHA1, 0, SSH_DIGEST_SHA1, KEX_NOT_PQ },
#ifdef HAVE_EVP_SHA256
- { KEX_DHGEX_SHA256, KEX_DH_GEX_SHA256, 0, SSH_DIGEST_SHA256 },
+ { KEX_DHGEX_SHA256, KEX_DH_GEX_SHA256, 0, SSH_DIGEST_SHA256, KEX_NOT_PQ },
#endif /* HAVE_EVP_SHA256 */
#ifdef OPENSSL_HAS_ECC
{ KEX_ECDH_SHA2_NISTP256, KEX_ECDH_SHA2,
- NID_X9_62_prime256v1, SSH_DIGEST_SHA256 },
+ NID_X9_62_prime256v1, SSH_DIGEST_SHA256, KEX_NOT_PQ },
{ KEX_ECDH_SHA2_NISTP384, KEX_ECDH_SHA2, NID_secp384r1,
- SSH_DIGEST_SHA384 },
+ SSH_DIGEST_SHA384, KEX_NOT_PQ },
# ifdef OPENSSL_HAS_NISTP521
{ KEX_ECDH_SHA2_NISTP521, KEX_ECDH_SHA2, NID_secp521r1,
- SSH_DIGEST_SHA512 },
+ SSH_DIGEST_SHA512, KEX_NOT_PQ },
# endif /* OPENSSL_HAS_NISTP521 */
#endif /* OPENSSL_HAS_ECC */
#endif /* WITH_OPENSSL */
#if defined(HAVE_EVP_SHA256) || !defined(WITH_OPENSSL)
- { KEX_CURVE25519_SHA256, KEX_C25519_SHA256, 0, SSH_DIGEST_SHA256 },
- { KEX_CURVE25519_SHA256_OLD, KEX_C25519_SHA256, 0, SSH_DIGEST_SHA256 },
+ { KEX_CURVE25519_SHA256, KEX_C25519_SHA256, 0, SSH_DIGEST_SHA256, KEX_NOT_PQ },
+ { KEX_CURVE25519_SHA256_OLD, KEX_C25519_SHA256, 0, SSH_DIGEST_SHA256, KEX_NOT_PQ },
#ifdef USE_SNTRUP761X25519
{ KEX_SNTRUP761X25519_SHA512, KEX_KEM_SNTRUP761X25519_SHA512, 0,
- SSH_DIGEST_SHA512 },
+ SSH_DIGEST_SHA512, KEX_IS_PQ },
{ KEX_SNTRUP761X25519_SHA512_OLD, KEX_KEM_SNTRUP761X25519_SHA512, 0,
- SSH_DIGEST_SHA512 },
+ SSH_DIGEST_SHA512, KEX_IS_PQ },
#endif
#ifdef USE_MLKEM768X25519
{ KEX_MLKEM768X25519_SHA256, KEX_KEM_MLKEM768X25519_SHA256, 0,
- SSH_DIGEST_SHA256 },
+ SSH_DIGEST_SHA256, KEX_IS_PQ },
#endif
#endif /* HAVE_EVP_SHA256 || !WITH_OPENSSL */
- { NULL, 0, -1, -1},
+ { NULL, 0, -1, -1, 0 },
};
char *
@@ -130,6 +131,16 @@ kex_name_valid(const char *name)
return kex_alg_by_name(name) != NULL;
}
+int
+kex_is_pq_from_name(const char *name)
+{
+ const struct kexalg *k;
+
+ if ((k = kex_alg_by_name(name)) == NULL)
+ return 0;
+ return k->pq_alg == KEX_IS_PQ;
+}
+
u_int
kex_type_from_name(const char *name)
{
diff --git a/kex.c b/kex.c
index 6b957e5e1..f8eaa8c97 100644
--- a/kex.c
+++ b/kex.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: kex.c,v 1.187 2024/08/23 04:51:00 deraadt Exp $ */
+/* $OpenBSD: kex.c,v 1.188 2025/08/11 10:55:38 djm Exp $ */
/*
* Copyright (c) 2000, 2001 Markus Friedl. All rights reserved.
*
@@ -563,8 +563,6 @@ kex_input_newkeys(int type, u_int32_t seq, struct ssh *ssh)
kex->flags &= ~KEX_INITIAL;
sshbuf_reset(kex->peer);
kex->flags &= ~KEX_INIT_SENT;
- free(kex->name);
- kex->name = NULL;
return 0;
}
@@ -620,6 +618,8 @@ kex_input_kexinit(int type, u_int32_t seq, struct ssh *ssh)
error_f("no kex");
return SSH_ERR_INTERNAL_ERROR;
}
+ free(kex->name);
+ kex->name = NULL;
ssh_dispatch_set(ssh, SSH2_MSG_KEXINIT, &kex_protocol_error);
ptr = sshpkt_ptr(ssh, &dlen);
if ((r = sshbuf_put(kex->peer, ptr, dlen)) != 0)
diff --git a/kex.h b/kex.h
index d08988b3e..55baa6a1e 100644
--- a/kex.h
+++ b/kex.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: kex.h,v 1.126 2024/09/02 12:13:56 djm Exp $ */
+/* $OpenBSD: kex.h,v 1.127 2025/08/11 10:55:38 djm Exp $ */
/*
* Copyright (c) 2000, 2001 Markus Friedl. All rights reserved.
@@ -115,6 +115,10 @@ enum kex_exchange {
#define KEX_HAS_PING 0x0020
#define KEX_HAS_EXT_INFO_IN_AUTH 0x0040
+/* kex->pq */
+#define KEX_NOT_PQ 0
+#define KEX_IS_PQ 1
+
struct sshenc {
char *name;
const struct sshcipher *cipher;
@@ -189,6 +193,7 @@ int kex_name_valid(const char *);
u_int kex_type_from_name(const char *);
int kex_hash_from_name(const char *);
int kex_nid_from_name(const char *);
+int kex_is_pq_from_name(const char *);
int kex_names_valid(const char *);
char *kex_alg_list(char);
char *kex_names_cat(const char *, const char *);
diff --git a/readconf.c b/readconf.c
index 781e5b004..c7701d8c2 100644
--- a/readconf.c
+++ b/readconf.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: readconf.c,v 1.404 2025/08/05 09:08:16 job Exp $ */
+/* $OpenBSD: readconf.c,v 1.405 2025/08/11 10:55:38 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -180,7 +180,7 @@ typedef enum {
oPubkeyAcceptedAlgorithms, oCASignatureAlgorithms, oProxyJump,
oSecurityKeyProvider, oKnownHostsCommand, oRequiredRSASize,
oEnableEscapeCommandline, oObscureKeystrokeTiming, oChannelTimeout,
- oVersionAddendum, oRefuseConnection,
+ oVersionAddendum, oRefuseConnection, oWarnWeakCrypto,
oIgnore, oIgnoredUnknownOption, oDeprecated, oUnsupported
} OpCodes;
@@ -333,6 +333,7 @@ static struct {
{ "channeltimeout", oChannelTimeout },
{ "versionaddendum", oVersionAddendum },
{ "refuseconnection", oRefuseConnection },
+ { "warnweakcrypto", oWarnWeakCrypto },
{ NULL, oBadOption }
};
@@ -1101,6 +1102,15 @@ static const struct multistate multistate_compression[] = {
{ "no", COMP_NONE },
{ NULL, -1 }
};
+/* XXX this will need to be replaced with a bitmask if we add more flags */
+static const struct multistate multistate_warnweakcrypto[] = {
+ { "true", 1 },
+ { "false", 0 },
+ { "yes", 1 },
+ { "no", 0 },
+ { "no-pq-kex", 0 },
+ { NULL, -1 }
+};
static int
parse_multistate_value(const char *arg, const char *filename, int linenum,
@@ -2427,6 +2437,11 @@ parse_pubkey_algos:
intptr = &options->required_rsa_size;
goto parse_int;
+ case oWarnWeakCrypto:
+ intptr = &options->warn_weak_crypto;
+ multistate_ptr = multistate_warnweakcrypto;
+ goto parse_multistate;
+
case oObscureKeystrokeTiming:
value = -1;
while ((arg = argv_next(&ac, &av)) != NULL) {
@@ -2786,6 +2801,7 @@ initialize_options(Options * options)
options->pubkey_accepted_algos = NULL;
options->known_hosts_command = NULL;
options->required_rsa_size = -1;
+ options->warn_weak_crypto = -1;
options->enable_escape_commandline = -1;
options->obscure_keystroke_timing_interval = -1;
options->tag = NULL;
@@ -2989,6 +3005,8 @@ fill_default_options(Options * options)
#endif
if (options->required_rsa_size == -1)
options->required_rsa_size = SSH_RSA_MINIMUM_MODULUS_SIZE;
+ if (options->warn_weak_crypto == -1)
+ options->warn_weak_crypto = 1;
if (options->enable_escape_commandline == -1)
options->enable_escape_commandline = 0;
if (options->obscure_keystroke_timing_interval == -1) {
@@ -3016,6 +3034,7 @@ fill_default_options(Options * options)
goto fail; \
} \
} while (0)
+ options->kex_algorithms_set = options->kex_algorithms != NULL;
ASSEMBLE(ciphers, def_cipher, all_cipher);
ASSEMBLE(macs, def_mac, all_mac);
ASSEMBLE(kex_algorithms, def_kex, all_kex);
@@ -3703,6 +3722,7 @@ dump_client_config(Options *o, const char *host)
dump_cfg_fmtint(oVisualHostKey, o->visual_host_key);
dump_cfg_fmtint(oUpdateHostkeys, o->update_hostkeys);
dump_cfg_fmtint(oEnableEscapeCommandline, o->enable_escape_commandline);
+ dump_cfg_fmtint(oWarnWeakCrypto, o->warn_weak_crypto);
/* Integer options */
dump_cfg_int(oCanonicalizeMaxDots, o->canonicalize_max_dots);
diff --git a/readconf.h b/readconf.h
index 153fa6226..942149f9a 100644
--- a/readconf.h
+++ b/readconf.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: readconf.h,v 1.160 2025/07/31 11:23:39 job Exp $ */
+/* $OpenBSD: readconf.h,v 1.161 2025/08/11 10:55:38 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
@@ -67,6 +67,7 @@ typedef struct {
char *macs; /* SSH2 macs in order of preference. */
char *hostkeyalgorithms; /* SSH2 server key types in order of preference. */
char *kex_algorithms; /* SSH2 kex methods in order of preference. */
+ int kex_algorithms_set; /* KexAlgorithms was set by the user */
char *ca_sign_algorithms; /* Allowed CA signature algorithms */
char *hostname; /* Real host to connect. */
char *tag; /* Configuration tag name. */
@@ -180,6 +181,7 @@ typedef struct {
int required_rsa_size; /* minimum size of RSA keys */
int enable_escape_commandline; /* ~C commandline */
int obscure_keystroke_timing_interval;
+ int warn_weak_crypto;
char **channel_timeouts; /* inactivity timeout by channel type */
u_int num_channel_timeouts;
diff --git a/ssh_config.5 b/ssh_config.5
index f1673e014..4cbe98631 100644
--- a/ssh_config.5
+++ b/ssh_config.5
@@ -33,8 +33,8 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
-.\" $OpenBSD: ssh_config.5,v 1.417 2025/08/05 09:08:16 job Exp $
-.Dd $Mdocdate: August 5 2025 $
+.\" $OpenBSD: ssh_config.5,v 1.418 2025/08/11 10:55:38 djm Exp $
+.Dd $Mdocdate: August 11 2025 $
.Dt SSH_CONFIG 5
.Os
.Sh NAME
@@ -2229,6 +2229,20 @@ If this flag is set to
(the default),
no fingerprint strings are printed at login and
only the fingerprint string will be printed for unknown host keys.
+.It Cm WarnWeakCrypto
+controls whether the user is warned when the cryptographic algorithms
+negotiated for the connection are weak or otherwise recommended against.
+Warnings may be disabled by turning off a specific warning or by disabling
+all warnings.
+Warnings that the connection is using a non-post quantum safe key exchange
+may be disabled using the
+.Cm no-pq-kex
+flag.
+.Cm no
+will disable all warnings.
+The default, equivalent to
+.Cm yes ,
+is to enable all warnings.
.It Cm XAuthLocation
Specifies the full pathname of the
.Xr xauth 1
diff --git a/sshconnect.c b/sshconnect.c
index a90167fd6..09e937c9e 100644
--- a/sshconnect.c
+++ b/sshconnect.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshconnect.c,v 1.371 2025/05/24 09:46:16 djm Exp $ */
+/* $OpenBSD: sshconnect.c,v 1.372 2025/08/11 10:55:38 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo at cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo at cs.hut.fi>, Espoo, Finland
@@ -1580,6 +1580,14 @@ out:
return r;
}
+static void
+warn_nonpq_kex(void)
+{
+ logit("** WARNING: connection is not using a post-quantum kex exchange algorithm.");
+ logit("** This session may be vulnerable to \"store now, decrypt later\" attacks.");
+ logit("** The server may need to be upgraded. See https://openssh.com/pq.html");
+}
+
/*
* Starts a dialog with the server, and authenticates the current user on the
* server. This does not need any extra privileges. The basic connection
@@ -1615,6 +1623,10 @@ ssh_login(struct ssh *ssh, Sensitive *sensitive, const char *orighost,
/* authenticate user */
debug("Authenticating to %s:%d as '%s'", host, port, server_user);
ssh_kex2(ssh, host, hostaddr, port, cinfo);
+ if (!options.kex_algorithms_set && ssh->kex != NULL &&
+ ssh->kex->name != NULL && options.warn_weak_crypto &&
+ !kex_is_pq_from_name(ssh->kex->name))
+ warn_nonpq_kex();
ssh_userauth2(ssh, local_user, server_user, host, sensitive);
free(local_user);
free(host);
--
To stop receiving notification emails like this one, please contact
djm at mindrot.org.
More information about the openssh-commits
mailing list