mention sntrup761x25519-sha512 in manpages

Spotted by Colin Watson
support sntrup761x25519-sha512 alias
2025-08-13 09:18:20 +10:00 · 2025-08-11 16:08:30 +10:00 · 2023-07-27 02:46:45 +10:00 · 2023-07-26 09:20:15 +10:00 · 2023-07-26 09:14:27 +10:00 · 2023-07-20 09:53:28 +10:00
8 changed files with 20 additions and 12 deletions
@@ -43,7 +43,7 @@ jobs:
          - { target: ubuntu-20.04, config: gcc-11-Werror }
          - { target: ubuntu-20.04, config: pam }
          - { target: ubuntu-20.04, config: kitchensink }
-          - { target: ubuntu-20.04, config: hardenedmalloc }
+          - { target: ubuntu-22.04, config: hardenedmalloc }
          - { target: ubuntu-20.04, config: tcmalloc }
          - { target: ubuntu-20.04, config: musl }
          - { target: ubuntu-latest, config: libressl-master }
@@ -113,6 +113,8 @@ static const struct kexalg kexalgs[] = {
 	{ KEX_CURVE25519_SHA256, KEX_C25519_SHA256, 0, SSH_DIGEST_SHA256 },
 	{ KEX_CURVE25519_SHA256_OLD, KEX_C25519_SHA256, 0, SSH_DIGEST_SHA256 },
 #ifdef USE_SNTRUP761X25519
+	{ KEX_SNTRUP761X25519_SHA512_IANA, KEX_KEM_SNTRUP761X25519_SHA512, 0,
+	    SSH_DIGEST_SHA512 },
 	{ KEX_SNTRUP761X25519_SHA512, KEX_KEM_SNTRUP761X25519_SHA512, 0,
 	    SSH_DIGEST_SHA512 },
 #endif
@@ -63,6 +63,7 @@
 #define	KEX_CURVE25519_SHA256		"curve25519-sha256"
 #define	KEX_CURVE25519_SHA256_OLD	"[email protected]"
 #define	KEX_SNTRUP761X25519_SHA512	"[email protected]"
+#define	KEX_SNTRUP761X25519_SHA512_IANA	"sntrup761x25519-sha512"

 #define COMP_NONE	0
 /* pre-auth compression (COMP_ZLIB) is only supported in the client */
@@ -25,6 +25,7 @@
 */

 #define KEX_SERVER_KEX	\
+	"sntrup761x25519-sha512," \
 	"[email protected]," \
 	"curve25519-sha256," \
 	"[email protected]," \
@@ -55,7 +55,7 @@ EOF
 	if [ $r -ne 0 ]; then
 		fail "gdb failed: exit code $r"
 	fi
-	egrep 'ptrace: Operation not permitted.|procfs:.*Permission denied.|ttrace.*Permission denied.|procfs:.*: Invalid argument.|Unable to access task ' >/dev/null ${OBJ}/gdb.out
+	egrep 'Operation not permitted.|Permission denied.|Invalid argument.|Unable to access task|Inappropriate ioctl for device.' >/dev/null ${OBJ}/gdb.out
 	r=$?
 	rm -f ${OBJ}/gdb.out
 	if [ $r -ne 0 ]; then
@@ -24,22 +24,13 @@
 #include <stdio.h>
 #include <stddef.h>
 #include <stdarg.h>
-#ifdef HAVE_SHA2_H
-#include <sha2.h>
-#endif

 #include "crypto_api.h"
 #include "sk-api.h"

-#if defined(WITH_OPENSSL) && !defined(OPENSSL_HAS_ECC)
-# undef WITH_OPENSSL
-#endif
-
 #ifdef WITH_OPENSSL
-/* We don't use sha2 from OpenSSL and they can conflict with system sha2.h */
-#define OPENSSL_NO_SHA
-#define USE_LIBC_SHA2	/* NetBSD 9 */
 #include <openssl/opensslv.h>
+#include <openssl/sha.h>
 #include <openssl/crypto.h>
 #include <openssl/evp.h>
 #include <openssl/bn.h>
@@ -55,6 +46,15 @@
 		(*ps) = sig->s; \
 	} while (0)
 #endif
+
+/* Use OpenSSL SHA256 instead of libc */
+#define SHA256Init(x)		SHA256_Init(x)
+#define SHA256Update(x, y, z)	SHA256_Update(x, y, z)
+#define SHA256Final(x, y)	SHA256_Final(x, y)
+#define SHA2_CTX		SHA256_CTX
+
+#elif defined(HAVE_SHA2_H)
+#include <sha2.h>
 #endif /* WITH_OPENSSL */

 /* #define SK_DEBUG 1 */
@@ -1175,6 +1175,7 @@ character, then the specified algorithms will be placed at the head of the
 default set.
 The default is:
 .Bd -literal -offset indent
+sntrup761x25519-sha512,
 [email protected],
 curve25519-sha256,[email protected],
 ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,
@@ -1037,11 +1037,14 @@ ecdh-sha2-nistp384
 .It
 ecdh-sha2-nistp521
 .It
+sntrup761x25519-sha512
+.It
 [email protected]
 .El
 .Pp
 The default is:
 .Bd -literal -offset indent
+sntrup761x25519-sha512,
 [email protected],
 curve25519-sha256,[email protected],
 ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,
Author	SHA1	Message	Date
Damien Miller	73024dd5d7	mention sntrup761x25519-sha512 in manpages Spotted by Colin Watson	2025-08-13 09:18:20 +10:00
Damien Miller	4815c5d19a	support sntrup761x25519-sha512 alias OpenSSH 9.3 supports the [email protected] key agreement algorithm. As part of standardisation, this algorithm has been assigned the name sntrup761x25519-sha512. This commit enables the existing algorithm under this new name.	2025-08-11 16:08:30 +10:00
Darren Tucker	9855f9178b	Prefer OpenSSL's SHA256 in sk-dummy.so Previously sk-dummy.so used libc's (or compat's) SHA256 since it may be built without OpenSSL. In many cases, however, including both libc's and OpenSSL's headers together caused conflicting definitions. We tried working around this (on OpenSSL <1.1 you could define OPENSSL_NO_SHA, NetBSD had USE_LIBC_SHA2, various #define hacks) with varying levels of success. Since OpenSSL >=1.1 removed OPENSSL_NO_SHA and including most OpenSSL headers would bring sha.h in, even if it wasn't used directly this was a constant hassle. Admit defeat and use OpenSSL's SHA256 unless we aren't using OpenSSL at all. ok djm@	2023-07-27 02:46:45 +10:00
Darren Tucker	8fdca57039	Also look for gdb error message from OpenIndiana.	2023-07-26 09:20:15 +10:00
Darren Tucker	9ab0f5af2c	Prevent conflicts between Solaris SHA2 and OpenSSL. We used to prevent conflicts between native SHA2 headers and OpenSSL's by setting OPENSSL_NO_SHA but that was removed prior to OpenSSL 1.1.0	2023-07-26 09:14:27 +10:00
Darren Tucker	22caea4db2	Update runner OS version for hardenedmalloc test. Hardenedmalloc dropped support for "legacy glibc" versions in their 64dad0a69 so use a newer Ubuntu version for the runner for that test.	2023-07-20 09:53:28 +10:00