This is an automated email from the ASF dual-hosted git repository.
twolf pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/mina-sshd.git
The following commit(s) were added to refs/heads/master by this push:
new 20464c4 Update CHANGES and README for chacha20 and openSSH certs
20464c4 is described below
commit 20464c49ab4275f01861078f3f6abd2cf5abbd50
Author: Thomas Wolf <tw...@apache.org>
AuthorDate: Thu Jul 8 21:19:02 2021 +0200
Update CHANGES and README for chacha20 and openSSH certs
Mention the Jira issues in CHANGES, mention the chacha20-poly1305
cipher in README.
---
CHANGES.md | 2 ++
README.md | 8 ++++----
2 files changed, 6 insertions(+), 4 deletions(-)
diff --git a/CHANGES.md b/CHANGES.md
index ce9fc83..33274e7 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -22,9 +22,11 @@
## Behavioral changes and enhancements
+* [SSHD-1017](https://issues.apache.org/jira/browse/SSHD-1017) Add support for
the chacha20-poly1...@openssh.com cipher
* [SSHD-1161](https://issues.apache.org/jira/browse/SSHD-1161) Support OpenSSH
client certificates for publickey authentication
* [SSHD-1163](https://issues.apache.org/jira/browse/SSHD-1163) Wrong server
key algorithm choose
* [SSHD-1164](https://issues.apache.org/jira/browse/SSHD-1164) Parsing of
~/.ssh/config Host patterns fails with extra whitespace
+* [SSHD-1166](https://issues.apache.org/jira/browse/SSHD-1166) Support
creating signed OpenSSH certificates
* [SSHD-1168](https://issues.apache.org/jira/browse/SSHD-1168) OpenSSH
certificates: check certificate type
* [SSHD-1171](https://issues.apache.org/jira/browse/SSHD-1171)
OpenSSHCertificatesTest: certificates expire in 2030
* [SSHD-1172](https://issues.apache.org/jira/browse/SSHD-1172) Expiration of
OpenSshCertificates needs to compare timestamps as unsigned long
diff --git a/README.md b/README.md
index 0d4297c..d7b9b87 100644
--- a/README.md
+++ b/README.md
@@ -58,7 +58,7 @@ based applications requiring SSH support.
## Implemented/available support
* **Ciphers**: aes128cbc, aes128ctr, aes192cbc, aes192ctr, aes256cbc,
aes256ctr, arcfour128, arcfour256, blowfishcbc, tripledescbc,
-aes128-...@openssh.com, aes256-...@openssh.com
+aes128-...@openssh.com, aes256-...@openssh.com, chacha20-poly1...@openssh.com
* **Digests**: md5, sha1, sha224, sha256, sha384, sha512
* **Macs**: hmacmd5, hmacmd596, hmacsha1, hmacsha196, hmacsha256, hmacsha512,
hmac-sha2-256-...@openssh.com
, hmac-sha2-512-...@openssh.com, hmac-sha1-...@openssh.com
@@ -81,12 +81,12 @@ the unsafe settings must do so **explicitly**. The
following settings have been
* [OpenSSH release notes](https://www.openssh.com/releasenotes.html) - usually
a good indicator of de-facto practices
* SHA-1 based key exchanges and signatures
* MD5-based and truncated HMAC algorithms
-* [RFC 8270 - Increase the Secure Shell Minimum Recommended Diffie-Hellman
Modulus Size to 2048 Bits](https://tools.ietf.org/html/rfc8270)
- **Note:** it still possible to use 1024 by initializing the value
*programmatically* or via system property -
+* [RFC 8270 - Increase the Secure Shell Minimum Recommended Diffie-Hellman
Modulus Size to 2048 Bits](https://tools.ietf.org/html/rfc8270)
+ **Note:** it still possible to use 1024 by initializing the value
*programmatically* or via system property -
see [Security providers
setup](./docs/security-providers.md#diff-hellman-group-exchange-configuration).
The code still contains moduli for 1024 and will use them if user
**explicitly** lowers the default minimum
to it.
-
+
**Caveat:**: According to [RFC 8332 - section
3.31](https://tools.ietf.org/html/rfc8332#section-3.3)
>>
>> Implementation experience has shown that there are servers that apply
>> authentication penalties to clients
