head 1.6; access; symbols netbsd-11-0-RELEASE:1.2.2.1 netbsd-11-0-RC7:1.2.2.1 netbsd-11-0-RC6:1.2.2.1 netbsd-11-0-RC5:1.2.2.1 netbsd-11-0-RC4:1.2.2.1 v103-20260402:1.1.1.3 netbsd-11-0-RC3:1.2 netbsd-11-0-RC2:1.2 netbsd-11-0-RC1:1.2 v102-20251010:1.1.1.2 v102-20251006:1.1.1.2 perseant-exfatfs:1.2.0.4 perseant-exfatfs-base-20250801:1.2 netbsd-11:1.2.0.2 netbsd-11-base:1.2 v100-20250409:1.1.1.2 v99-20240919:1.1.1.1 OPENSSH:1.1.1; locks; strict; comment @# @; 1.6 date 2026.10.07.17.32.07; author christos; state dead; branches; next 1.5; commitid bfGeT3ACqbH0ozYG; 1.5 date 2026.09.21.21.32.20; author christos; state Exp; branches; next 1.4; commitid eEPTXbwxyzRoexWG; 1.4 date 2026.09.21.21.31.00; author christos; state dead; branches; next 1.3; commitid d6hfTIGni5ORdxWG; 1.3 date 2026.04.08.18.58.40; author christos; state Exp; branches; next 1.2; commitid JcrdmlmM2ospIbBG; 1.2 date 2024.10.29.03.20.32; author rin; state Exp; branches 1.2.2.1 1.2.4.1; next 1.1; commitid TRyaAV1tkTibqvvF; 1.1 date 2024.09.24.21.28.09; author christos; state Exp; branches 1.1.1.1; next ; commitid zXrtOPLOGCBbz6rF; 1.2.2.1 date 2026.05.07.17.49.24; author martin; state Exp; branches; next ; commitid FKLgTPSjEn4GoUEG; 1.2.4.1 date 2024.10.29.03.20.32; author perseant; state dead; branches; next 1.2.4.2; commitid 23j6GFaDws3O875G; 1.2.4.2 date 2025.08.02.05.18.46; author perseant; state Exp; branches; next ; commitid 23j6GFaDws3O875G; 1.1.1.1 date 2024.09.24.21.28.09; author christos; state Exp; branches; next 1.1.1.2; commitid zXrtOPLOGCBbz6rF; 1.1.1.2 date 2025.04.09.15.41.14; author christos; state Exp; branches; next 1.1.1.3; commitid IvbeLEblpqXpjoQF; 1.1.1.3 date 2026.04.08.18.54.49; author christos; state Exp; branches; next ; commitid nKXy8zwlgGoAGbBG; desc @@ 1.6 log @Merge changes between OpenSSH-10.5 and OpenSSH-10.6 @ text @#!/bin/sh # $OpenBSD: mlkem768.sh,v 1.5 2025/11/13 05:13:06 djm Exp $ # Placed in the Public Domain. # #WANT_LIBCRUX_REVISION="origin/main" WANT_LIBCRUX_REVISION="core-models-v0.0.4" BASE="libcrux/libcrux-ml-kem/extracts/c_header_only/generated" FILES=" $BASE/eurydice_glue.h $BASE/libcrux_mlkem_core.h $BASE/libcrux_ct_ops.h $BASE/libcrux_sha3_portable.h $BASE/libcrux_mlkem768_portable.h " START="$PWD" die() { echo "$@@" 1>&2 exit 1 } set -xeuo pipefail test -d libcrux || git clone https://github.com/cryspen/libcrux cd libcrux test `git diff | wc -l` -ne 0 && die "tree has unstaged changes" git fetch git checkout -B extract 1>&2 git reset --hard $WANT_LIBCRUX_REVISION 1>&2 LIBCRUX_REVISION=`git rev-parse HEAD` set +x cd $START ( printf '/* $Open'; printf 'BSD$ */\n' # Sigh echo echo "/* Extracted from libcrux revision $LIBCRUX_REVISION */" echo echo '/*' cat libcrux/LICENSE-MIT | sed 's/^/ * /;s/ *$//' echo ' */' echo LSHIFT="<<" cat << _EOF #if !defined(__GNUC__) || (__GNUC__ < 2) # define __attribute__(x) #endif #define KRML_MUSTINLINE inline #define KRML_NOINLINE __attribute__((noinline, unused)) #define KRML_HOST_EPRINTF(...) #define KRML_HOST_EXIT(x) fatal_f("internal error") static inline void store64_le(uint8_t dst[8], uint64_t src) { dst[0] = src & 0xff; dst[1] = (src >> 8) & 0xff; dst[2] = (src >> 16) & 0xff; dst[3] = (src >> 24) & 0xff; dst[4] = (src >> 32) & 0xff; dst[5] = (src >> 40) & 0xff; dst[6] = (src >> 48) & 0xff; dst[7] = (src >> 56) & 0xff; } static inline void store32_le(uint8_t dst[4], uint32_t src) { dst[0] = src & 0xff; dst[1] = (src >> 8) & 0xff; dst[2] = (src >> 16) & 0xff; dst[3] = (src >> 24) & 0xff; } static inline void store32_be(uint8_t dst[4], uint32_t src) { dst[0] = (src >> 24) & 0xff; dst[1] = (src >> 16) & 0xff; dst[2] = (src >> 8) & 0xff; dst[3] = src & 0xff; } static inline uint64_t load64_le(uint8_t src[8]) { return (uint64_t)(src[0]) | ((uint64_t)(src[1]) $LSHIFT 8) | ((uint64_t)(src[2]) $LSHIFT 16) | ((uint64_t)(src[3]) $LSHIFT 24) | ((uint64_t)(src[4]) $LSHIFT 32) | ((uint64_t)(src[5]) $LSHIFT 40) | ((uint64_t)(src[6]) $LSHIFT 48) | ((uint64_t)(src[7]) $LSHIFT 56); } static inline uint32_t load32_le(uint8_t src[4]) { return (uint32_t)(src[0]) | ((uint32_t)(src[1]) $LSHIFT 8) | ((uint32_t)(src[2]) $LSHIFT 16) | ((uint32_t)(src[3]) $LSHIFT 24); } #ifdef MISSING_BUILTIN_POPCOUNT static inline unsigned int __builtin_popcount(unsigned int num) { const int v[16] = { 0, 1, 1, 2, 1, 2, 2, 3, 1, 2, 2, 3, 2, 3, 3, 4 }; return v[num & 0xf] + v[(num >> 4) & 0xf]; } #endif _EOF for i in $FILES; do echo "/* from $i */" # Changes to all files: # - remove all includes, we inline everything required. # - cleanup whitespace sed -e "/#include/d" \ -e 's/[ ]*$//' \ $i | \ case "$i" in */eurydice_glue.h) # Replace endian function for consistency. perl -0777 -pe 's/(static inline void core_num__u32__to_be_bytes.*\n)([^}]*\n)/\1 store32_be(dst, src);\n/' ;; # Default: pass through. *) cat ;; esac echo done echo echo '/* rename some types to be a bit more ergonomic */' echo '#define libcrux_mlkem768_keypair libcrux_ml_kem_mlkem768_MlKem768KeyPair_s' echo '#define libcrux_mlkem768_pk libcrux_ml_kem_types_MlKemPublicKey_30_s' echo '#define libcrux_mlkem768_sk libcrux_ml_kem_types_MlKemPrivateKey_d9_s' echo '#define libcrux_mlkem768_ciphertext libcrux_ml_kem_mlkem768_MlKem768Ciphertext_s' echo '#define libcrux_mlkem768_enc_result tuple_c2_s' ) > libcrux_mlkem768_sha3.h_new # Do some checks on the resultant file cat > libcrux_mlkem768_sha3_check.c << _EOF #include #include #include #include #include #include #include #include #include "crypto_api.h" #define fatal_f(x) exit(1) #include "libcrux_mlkem768_sha3.h_new" int main(void) { struct libcrux_mlkem768_keypair keypair = {0}; struct libcrux_mlkem768_pk pk = {0}; struct libcrux_mlkem768_sk sk = {0}; struct libcrux_mlkem768_ciphertext ct = {0}; struct libcrux_mlkem768_enc_result enc_result = {0}; uint8_t kp_seed[64] = {0}, enc_seed[32] = {0}; uint8_t shared_key[crypto_kem_mlkem768_BYTES]; if (sizeof(keypair.pk.value) != crypto_kem_mlkem768_PUBLICKEYBYTES) errx(1, "keypair.pk bad"); if (sizeof(keypair.sk.value) != crypto_kem_mlkem768_SECRETKEYBYTES) errx(1, "keypair.sk bad"); if (sizeof(pk.value) != crypto_kem_mlkem768_PUBLICKEYBYTES) errx(1, "pk bad"); if (sizeof(sk.value) != crypto_kem_mlkem768_SECRETKEYBYTES) errx(1, "sk bad"); if (sizeof(ct.value) != crypto_kem_mlkem768_CIPHERTEXTBYTES) errx(1, "ct bad"); if (sizeof(enc_result.fst.value) != crypto_kem_mlkem768_CIPHERTEXTBYTES) errx(1, "enc_result ct bad"); if (sizeof(enc_result.snd) != crypto_kem_mlkem768_BYTES) errx(1, "enc_result shared key bad"); keypair = libcrux_ml_kem_mlkem768_portable_generate_key_pair(kp_seed); if (!libcrux_ml_kem_mlkem768_portable_validate_public_key(&keypair.pk)) errx(1, "valid smoke failed"); enc_result = libcrux_ml_kem_mlkem768_portable_encapsulate(&keypair.pk, enc_seed); libcrux_ml_kem_mlkem768_portable_decapsulate(&keypair.sk, &enc_result.fst, shared_key); if (memcmp(shared_key, enc_result.snd, sizeof(shared_key)) != 0) errx(1, "smoke failed"); return 0; } _EOF cc -Wall -Wextra -Wno-unused-parameter -I . -o libcrux_mlkem768_sha3_check \ libcrux_mlkem768_sha3_check.c ./libcrux_mlkem768_sha3_check # Extract PRNG inputs; there's no nice #defines for these key_pair_rng_len=`grep '^libcrux_ml_kem_mlkem768_portable_generate_key_pair.*randomness' libcrux_mlkem768_sha3.h_new | sed 's/.*randomness[[]//;s/\].*//'` enc_rng_len=`sed -e '/^static inline tuple_c2 libcrux_ml_kem_mlkem768_portable_encapsulate[(]$/,/[)] {$/!d' < libcrux_mlkem768_sha3.h_new | grep 'uint8_t randomness\[[0-9]*U\][)]' | sed 's/.*randomness\[\([0-9]*\)U\].*/\1/'` test -z "$key_pair_rng_len" && die "couldn't find size of libcrux_ml_kem_mlkem768_portable_kyber_generate_key_pair randomness argument" test -z "$enc_rng_len" && die "couldn't find size of libcrux_ml_kem_mlkem768_portable_kyber_encapsulate randomness argument" ( echo "/* defines for PRNG inputs */" echo "#define LIBCRUX_ML_KEM_KEY_PAIR_PRNG_LEN $key_pair_rng_len" echo "#define LIBCRUX_ML_KEM_ENC_PRNG_LEN $enc_rng_len" ) >> libcrux_mlkem768_sha3.h_new mv libcrux_mlkem768_sha3.h_new libcrux_mlkem768_sha3.h rm libcrux_mlkem768_sha3_check libcrux_mlkem768_sha3_check.c echo 1>&2 echo "libcrux_mlkem768_sha3.h OK" 1>&2 @ 1.5 log @put back removed files @ text @@ 1.4 log @Merge conflicts between 10.3 and 10.5 @ text @@ 1.3 log @Merge changes between OpenSSH-10.2 and 10.3 @ text @@ 1.2 log @openssh: Fix mlkem768x25519-sha256 KEX algorithm for big-endian machines Tested for macppc. This KEX algorithm has been added to OpenSSH 9.9, and no release branches are affected. Cherry-picked from upstream: (1/2) https://github.com/openbsd/src/commit/66207d7b19f fix ML-KEM768x25519 KEX on big-endian systems; spotted by jsg@@ feedback/ok deraadt@@ (2/2) https://github.com/openbsd/src/commit/c42fee07eda explicitly include endian.h @ text @d2 1 a2 1 # $OpenBSD: mlkem768.sh,v 1.3 2024/10/27 02:06:01 djm Exp $ d7 1 a7 1 WANT_LIBCRUX_REVISION="84c5d87b3092c59294345aa269ceefe0eb97cc35" d9 1 d11 5 a15 5 libcrux/libcrux-ml-kem/cg/eurydice_glue.h libcrux/libcrux-ml-kem/cg/libcrux_core.h libcrux/libcrux-ml-kem/cg/libcrux_ct_ops.h libcrux/libcrux-ml-kem/cg/libcrux_sha3_portable.h libcrux/libcrux-ml-kem/cg/libcrux_mlkem768_portable.h d44 74 a117 8 echo '#if !defined(__GNUC__) || (__GNUC__ < 2)' echo '# define __attribute__(x)' echo '#endif' echo '#define KRML_MUSTINLINE inline' echo '#define KRML_NOINLINE __attribute__((noinline, unused))' echo '#define KRML_HOST_EPRINTF(...)' echo '#define KRML_HOST_EXIT(x) fatal_f("internal error")' echo d128 3 a130 5 */libcrux-ml-kem/cg/eurydice_glue.h) # Replace endian functions with versions that work. perl -0777 -pe 's/(static inline void core_num__u64_9__to_le_bytes.*\n)([^}]*\n)/\1 v = htole64(v);\n\2/' | perl -0777 -pe 's/(static inline uint64_t core_num__u64_9__from_le_bytes.*?)return v;/\1return le64toh(v);/s' | perl -0777 -pe 's/(static inline uint32_t core_num__u32_8__from_le_bytes.*?)return v;/\1return le32toh(v);/s' d143 2 a144 3 echo '#define libcrux_mlkem768_pk_valid_result Option_92_s' echo '#define libcrux_mlkem768_pk libcrux_ml_kem_types_MlKemPublicKey_15_s' echo '#define libcrux_mlkem768_sk libcrux_ml_kem_types_MlKemPrivateKey_55_s' d146 1 a146 1 echo '#define libcrux_mlkem768_enc_result tuple_3c_s' d199 1 a199 1 cc -Wall -Wextra -Wno-unused-parameter -o libcrux_mlkem768_sha3_check \ d204 2 a205 2 key_pair_rng_len=`sed -e '/^libcrux_ml_kem_mlkem768_portable_kyber_generate_key_pair[(]$/,/[)] {$/!d' < libcrux_mlkem768_sha3.h_new | grep 'uint8_t randomness\[[0-9]*U\][)]' | sed 's/.*randomness\[\([0-9]*\)U\].*/\1/'` enc_rng_len=`sed -e '/^static inline tuple_3c libcrux_ml_kem_mlkem768_portable_kyber_encapsulate[(]$/,/[)] {$/!d' < libcrux_mlkem768_sha3.h_new | grep 'uint8_t randomness\[[0-9]*U\][)]' | sed 's/.*randomness\[\([0-9]*\)U\].*/\1/'` @ 1.2.2.1 log @Pull up the following, requested by christos in ticket #271: crypto/external/bsd/openssh/dist/ed25519-openssl.c up to 1.1.1.1 crypto/external/bsd/openssh/dist/ssherr-libcrypto.c up to 1.1.1.1 crypto/external/bsd/openssh/dist/ssherr-nolibcrypto.c up to 1.1.1.1 crypto/external/bsd/openssh/dist/hash.c delete crypto/external/bsd/openssh/dist/PROTOCOL up to 1.26 crypto/external/bsd/openssh/dist/addr.c up to 1.9 crypto/external/bsd/openssh/dist/addr.h up to 1.1.1.4 crypto/external/bsd/openssh/dist/addrmatch.c up to 1.16 crypto/external/bsd/openssh/dist/auth-bsdauth.c up to 1.10 crypto/external/bsd/openssh/dist/auth-krb5.c up to 1.20 crypto/external/bsd/openssh/dist/auth.c up to 1.40 crypto/external/bsd/openssh/dist/auth.h up to 1.26 crypto/external/bsd/openssh/dist/auth2-chall.c up to 1.22 crypto/external/bsd/openssh/dist/auth2-gss.c up to 1.19 crypto/external/bsd/openssh/dist/auth2-hostbased.c up to 1.26 crypto/external/bsd/openssh/dist/auth2-pubkey.c up to 1.38 crypto/external/bsd/openssh/dist/auth2-pubkeyfile.c up to 1.5 crypto/external/bsd/openssh/dist/auth2.c up to 1.35 crypto/external/bsd/openssh/dist/authfd.c up to 1.29 crypto/external/bsd/openssh/dist/authfd.h up to 1.19 crypto/external/bsd/openssh/dist/authfile.c up to 1.31 crypto/external/bsd/openssh/dist/bcrypt_pbkdf.c up to 1.5 crypto/external/bsd/openssh/dist/canohost.c up to 1.17 crypto/external/bsd/openssh/dist/channels.c up to 1.48 crypto/external/bsd/openssh/dist/channels.h up to 1.31 crypto/external/bsd/openssh/dist/cipher-aesctr.c up to 1.3 crypto/external/bsd/openssh/dist/cipher-chachapoly-libcrypto.c up to 1.4 crypto/external/bsd/openssh/dist/cipher.c up to 1.27 crypto/external/bsd/openssh/dist/clientloop.c up to 1.45 crypto/external/bsd/openssh/dist/clientloop.h up to 1.20 crypto/external/bsd/openssh/dist/compat.c up to 1.27 crypto/external/bsd/openssh/dist/crypto_api.h up to 1.8 crypto/external/bsd/openssh/dist/dh.c up to 1.22 crypto/external/bsd/openssh/dist/digest-libc.c up to 1.12 crypto/external/bsd/openssh/dist/dispatch.c up to 1.13 crypto/external/bsd/openssh/dist/dispatch.h up to 1.9 crypto/external/bsd/openssh/dist/dns.c up to 1.25 crypto/external/bsd/openssh/dist/gss-genr.c up to 1.16 crypto/external/bsd/openssh/dist/gss-serv-krb5.c up to 1.13 crypto/external/bsd/openssh/dist/gss-serv.c up to 1.18 crypto/external/bsd/openssh/dist/hmac.c up to 1.10 crypto/external/bsd/openssh/dist/hostfile.c up to 1.25 crypto/external/bsd/openssh/dist/kex-names.c up to 1.5 crypto/external/bsd/openssh/dist/kex.c up to 1.40 crypto/external/bsd/openssh/dist/kex.h up to 1.29 crypto/external/bsd/openssh/dist/kexdh.c up to 1.12 crypto/external/bsd/openssh/dist/kexecdh.c up to 1.10 crypto/external/bsd/openssh/dist/kexgen.c up to 1.9 crypto/external/bsd/openssh/dist/kexgex.c up to 1.8 crypto/external/bsd/openssh/dist/kexgexc.c up to 1.19 crypto/external/bsd/openssh/dist/kexgexs.c up to 1.26 crypto/external/bsd/openssh/dist/krl.c up to 1.27 crypto/external/bsd/openssh/dist/krl.h up to 1.7 crypto/external/bsd/openssh/dist/libcrux_mlkem768_sha3.h up to 1.3 crypto/external/bsd/openssh/dist/log.c up to 1.34 crypto/external/bsd/openssh/dist/mac.c up to 1.18 crypto/external/bsd/openssh/dist/mac.h up to 1.9 crypto/external/bsd/openssh/dist/misc-agent.c up to 1.3 crypto/external/bsd/openssh/dist/misc.c up to 1.41 crypto/external/bsd/openssh/dist/misc.h up to 1.33 crypto/external/bsd/openssh/dist/mlkem768.sh up to 1.3 crypto/external/bsd/openssh/dist/moduli.c up to 1.19 crypto/external/bsd/openssh/dist/monitor.c up to 1.51 crypto/external/bsd/openssh/dist/monitor.h up to 1.16 crypto/external/bsd/openssh/dist/monitor_fdpass.c up to 1.10 crypto/external/bsd/openssh/dist/monitor_wrap.c up to 1.38 crypto/external/bsd/openssh/dist/monitor_wrap.h up to 1.27 crypto/external/bsd/openssh/dist/msg.c up to 1.13 crypto/external/bsd/openssh/dist/mux.c up to 1.40 crypto/external/bsd/openssh/dist/myproposal.h up to 1.27 crypto/external/bsd/openssh/dist/nchan.c up to 1.17 crypto/external/bsd/openssh/dist/packet.c up to 1.57 crypto/external/bsd/openssh/dist/packet.h up to 1.30 crypto/external/bsd/openssh/dist/progressmeter.c up to 1.18 crypto/external/bsd/openssh/dist/readconf.c up to 1.51 crypto/external/bsd/openssh/dist/readconf.h up to 1.38 crypto/external/bsd/openssh/dist/readpass.c up to 1.21 crypto/external/bsd/openssh/dist/rijndael.c up to 1.3 crypto/external/bsd/openssh/dist/scp.c up to 1.45 crypto/external/bsd/openssh/dist/servconf.c up to 1.52 crypto/external/bsd/openssh/dist/servconf.h up to 1.34 crypto/external/bsd/openssh/dist/serverloop.c up to 1.40 crypto/external/bsd/openssh/dist/session.c up to 1.45 crypto/external/bsd/openssh/dist/sftp-client.c up to 1.39 crypto/external/bsd/openssh/dist/sftp-client.h up to 1.20 crypto/external/bsd/openssh/dist/sftp-common.c up to 1.15 crypto/external/bsd/openssh/dist/sftp-common.h up to 1.9 crypto/external/bsd/openssh/dist/sftp-server.c up to 1.33 crypto/external/bsd/openssh/dist/sftp.c up to 1.44 crypto/external/bsd/openssh/dist/sntrup761.c up to 1.5 crypto/external/bsd/openssh/dist/sntrup761.sh up to 1.1.1.4 crypto/external/bsd/openssh/dist/srclimit.c up to 1.8 crypto/external/bsd/openssh/dist/srclimit.h up to 1.1.1.4 crypto/external/bsd/openssh/dist/ssh-add.1 up to 1.22 crypto/external/bsd/openssh/dist/ssh-add.c up to 1.34 crypto/external/bsd/openssh/dist/ssh-agent.c up to 1.44 crypto/external/bsd/openssh/dist/ssh-ecdsa-sk.c up to 1.6 crypto/external/bsd/openssh/dist/ssh-ecdsa.c up to 1.18 crypto/external/bsd/openssh/dist/ssh-ed25519-sk.c up to 1.6 crypto/external/bsd/openssh/dist/ssh-ed25519.c up to 1.12 crypto/external/bsd/openssh/dist/ssh-keygen.1 up to 1.42 crypto/external/bsd/openssh/dist/ssh-keygen.c up to 1.51 crypto/external/bsd/openssh/dist/ssh-keysign.c up to 1.29 crypto/external/bsd/openssh/dist/ssh-pkcs11-client.c up to 1.22 crypto/external/bsd/openssh/dist/ssh-pkcs11-helper.c up to 1.25 crypto/external/bsd/openssh/dist/ssh-pkcs11.c up to 1.31 crypto/external/bsd/openssh/dist/ssh-pkcs11.h up to 1.11 crypto/external/bsd/openssh/dist/ssh-rsa.c up to 1.22 crypto/external/bsd/openssh/dist/ssh-sk-client.c up to 1.9 crypto/external/bsd/openssh/dist/ssh.1 up to 1.43 crypto/external/bsd/openssh/dist/ssh.c up to 1.49 crypto/external/bsd/openssh/dist/ssh_api.c up to 1.20 crypto/external/bsd/openssh/dist/ssh_config.5 up to 1.46 crypto/external/bsd/openssh/dist/sshbuf-getput-basic.c up to 1.13 crypto/external/bsd/openssh/dist/sshbuf-misc.c up to 1.16 crypto/external/bsd/openssh/dist/sshbuf.c up to 1.16 crypto/external/bsd/openssh/dist/sshbuf.h up to 1.23 crypto/external/bsd/openssh/dist/sshconnect.c up to 1.42 crypto/external/bsd/openssh/dist/sshconnect.h up to 1.20 crypto/external/bsd/openssh/dist/sshconnect2.c up to 1.53 crypto/external/bsd/openssh/dist/sshd-auth.c up to 1.5 crypto/external/bsd/openssh/dist/sshd-session.c up to 1.12 crypto/external/bsd/openssh/dist/sshd.c up to 1.57 crypto/external/bsd/openssh/dist/sshd_config.5 up to 1.49 crypto/external/bsd/openssh/dist/ssherr.c up to 1.11 crypto/external/bsd/openssh/dist/ssherr.h up to 1.5 crypto/external/bsd/openssh/dist/sshkey.c up to 1.37 crypto/external/bsd/openssh/dist/sshkey.h up to 1.26 crypto/external/bsd/openssh/dist/sshlogin.c up to 1.14 crypto/external/bsd/openssh/dist/sshpty.c up to 1.9 crypto/external/bsd/openssh/dist/sshsig.c up to 1.17 crypto/external/bsd/openssh/dist/ttymodes.c up to 1.13 crypto/external/bsd/openssh/dist/uidswap.c up to 1.11 crypto/external/bsd/openssh/dist/umac.c up to 1.24 crypto/external/bsd/openssh/dist/version.h up to 1.53 crypto/external/bsd/openssh/dist/moduli-gen/moduli.2048 up to 1.22 crypto/external/bsd/openssh/dist/moduli-gen/moduli.3072 up to 1.24 crypto/external/bsd/openssh/dist/moduli-gen/moduli.4096 up to 1.24 crypto/external/bsd/openssh/dist/moduli-gen/moduli.6144 up to 1.24 crypto/external/bsd/openssh/dist/moduli-gen/moduli.7680 up to 1.24 crypto/external/bsd/openssh/dist/moduli-gen/moduli.8192 up to 1.24 crypto/external/bsd/openssh/lib/Makefile up to 1.49 crypto/external/bsd/openssh/lib/shlib_version up to 1.42 crypto/external/bsd/openssh/lib/ssh.expsym up to 1.5 crypto/external/bsd/openssh/libexec/Makefile up to 1.4 Update OpenSSH to 10.3. @ text @d2 1 a2 1 # $OpenBSD: mlkem768.sh,v 1.5 2025/11/13 05:13:06 djm Exp $ d7 1 a7 1 WANT_LIBCRUX_REVISION="core-models-v0.0.4" a8 1 BASE="libcrux/libcrux-ml-kem/extracts/c_header_only/generated" d10 5 a14 5 $BASE/eurydice_glue.h $BASE/libcrux_mlkem_core.h $BASE/libcrux_ct_ops.h $BASE/libcrux_sha3_portable.h $BASE/libcrux_mlkem768_portable.h d43 8 a50 74 LSHIFT="<<" cat << _EOF #if !defined(__GNUC__) || (__GNUC__ < 2) # define __attribute__(x) #endif #define KRML_MUSTINLINE inline #define KRML_NOINLINE __attribute__((noinline, unused)) #define KRML_HOST_EPRINTF(...) #define KRML_HOST_EXIT(x) fatal_f("internal error") static inline void store64_le(uint8_t dst[8], uint64_t src) { dst[0] = src & 0xff; dst[1] = (src >> 8) & 0xff; dst[2] = (src >> 16) & 0xff; dst[3] = (src >> 24) & 0xff; dst[4] = (src >> 32) & 0xff; dst[5] = (src >> 40) & 0xff; dst[6] = (src >> 48) & 0xff; dst[7] = (src >> 56) & 0xff; } static inline void store32_le(uint8_t dst[4], uint32_t src) { dst[0] = src & 0xff; dst[1] = (src >> 8) & 0xff; dst[2] = (src >> 16) & 0xff; dst[3] = (src >> 24) & 0xff; } static inline void store32_be(uint8_t dst[4], uint32_t src) { dst[0] = (src >> 24) & 0xff; dst[1] = (src >> 16) & 0xff; dst[2] = (src >> 8) & 0xff; dst[3] = src & 0xff; } static inline uint64_t load64_le(uint8_t src[8]) { return (uint64_t)(src[0]) | ((uint64_t)(src[1]) $LSHIFT 8) | ((uint64_t)(src[2]) $LSHIFT 16) | ((uint64_t)(src[3]) $LSHIFT 24) | ((uint64_t)(src[4]) $LSHIFT 32) | ((uint64_t)(src[5]) $LSHIFT 40) | ((uint64_t)(src[6]) $LSHIFT 48) | ((uint64_t)(src[7]) $LSHIFT 56); } static inline uint32_t load32_le(uint8_t src[4]) { return (uint32_t)(src[0]) | ((uint32_t)(src[1]) $LSHIFT 8) | ((uint32_t)(src[2]) $LSHIFT 16) | ((uint32_t)(src[3]) $LSHIFT 24); } #ifdef MISSING_BUILTIN_POPCOUNT static inline unsigned int __builtin_popcount(unsigned int num) { const int v[16] = { 0, 1, 1, 2, 1, 2, 2, 3, 1, 2, 2, 3, 2, 3, 3, 4 }; return v[num & 0xf] + v[(num >> 4) & 0xf]; } #endif _EOF d61 5 a65 3 */eurydice_glue.h) # Replace endian function for consistency. perl -0777 -pe 's/(static inline void core_num__u32__to_be_bytes.*\n)([^}]*\n)/\1 store32_be(dst, src);\n/' d78 3 a80 2 echo '#define libcrux_mlkem768_pk libcrux_ml_kem_types_MlKemPublicKey_30_s' echo '#define libcrux_mlkem768_sk libcrux_ml_kem_types_MlKemPrivateKey_d9_s' d82 1 a82 1 echo '#define libcrux_mlkem768_enc_result tuple_c2_s' d135 1 a135 1 cc -Wall -Wextra -Wno-unused-parameter -I . -o libcrux_mlkem768_sha3_check \ d140 2 a141 2 key_pair_rng_len=`grep '^libcrux_ml_kem_mlkem768_portable_generate_key_pair.*randomness' libcrux_mlkem768_sha3.h_new | sed 's/.*randomness[[]//;s/\].*//'` enc_rng_len=`sed -e '/^static inline tuple_c2 libcrux_ml_kem_mlkem768_portable_encapsulate[(]$/,/[)] {$/!d' < libcrux_mlkem768_sha3.h_new | grep 'uint8_t randomness\[[0-9]*U\][)]' | sed 's/.*randomness\[\([0-9]*\)U\].*/\1/'` @ 1.2.4.1 log @file mlkem768.sh was added on branch perseant-exfatfs on 2025-08-02 05:18:46 +0000 @ text @d1 155 @ 1.2.4.2 log @Sync with HEAD @ text @a0 155 #!/bin/sh # $OpenBSD: mlkem768.sh,v 1.3 2024/10/27 02:06:01 djm Exp $ # Placed in the Public Domain. # #WANT_LIBCRUX_REVISION="origin/main" WANT_LIBCRUX_REVISION="84c5d87b3092c59294345aa269ceefe0eb97cc35" FILES=" libcrux/libcrux-ml-kem/cg/eurydice_glue.h libcrux/libcrux-ml-kem/cg/libcrux_core.h libcrux/libcrux-ml-kem/cg/libcrux_ct_ops.h libcrux/libcrux-ml-kem/cg/libcrux_sha3_portable.h libcrux/libcrux-ml-kem/cg/libcrux_mlkem768_portable.h " START="$PWD" die() { echo "$@@" 1>&2 exit 1 } set -xeuo pipefail test -d libcrux || git clone https://github.com/cryspen/libcrux cd libcrux test `git diff | wc -l` -ne 0 && die "tree has unstaged changes" git fetch git checkout -B extract 1>&2 git reset --hard $WANT_LIBCRUX_REVISION 1>&2 LIBCRUX_REVISION=`git rev-parse HEAD` set +x cd $START ( printf '/* $Open'; printf 'BSD$ */\n' # Sigh echo echo "/* Extracted from libcrux revision $LIBCRUX_REVISION */" echo echo '/*' cat libcrux/LICENSE-MIT | sed 's/^/ * /;s/ *$//' echo ' */' echo echo '#if !defined(__GNUC__) || (__GNUC__ < 2)' echo '# define __attribute__(x)' echo '#endif' echo '#define KRML_MUSTINLINE inline' echo '#define KRML_NOINLINE __attribute__((noinline, unused))' echo '#define KRML_HOST_EPRINTF(...)' echo '#define KRML_HOST_EXIT(x) fatal_f("internal error")' echo for i in $FILES; do echo "/* from $i */" # Changes to all files: # - remove all includes, we inline everything required. # - cleanup whitespace sed -e "/#include/d" \ -e 's/[ ]*$//' \ $i | \ case "$i" in */libcrux-ml-kem/cg/eurydice_glue.h) # Replace endian functions with versions that work. perl -0777 -pe 's/(static inline void core_num__u64_9__to_le_bytes.*\n)([^}]*\n)/\1 v = htole64(v);\n\2/' | perl -0777 -pe 's/(static inline uint64_t core_num__u64_9__from_le_bytes.*?)return v;/\1return le64toh(v);/s' | perl -0777 -pe 's/(static inline uint32_t core_num__u32_8__from_le_bytes.*?)return v;/\1return le32toh(v);/s' ;; # Default: pass through. *) cat ;; esac echo done echo echo '/* rename some types to be a bit more ergonomic */' echo '#define libcrux_mlkem768_keypair libcrux_ml_kem_mlkem768_MlKem768KeyPair_s' echo '#define libcrux_mlkem768_pk_valid_result Option_92_s' echo '#define libcrux_mlkem768_pk libcrux_ml_kem_types_MlKemPublicKey_15_s' echo '#define libcrux_mlkem768_sk libcrux_ml_kem_types_MlKemPrivateKey_55_s' echo '#define libcrux_mlkem768_ciphertext libcrux_ml_kem_mlkem768_MlKem768Ciphertext_s' echo '#define libcrux_mlkem768_enc_result tuple_3c_s' ) > libcrux_mlkem768_sha3.h_new # Do some checks on the resultant file cat > libcrux_mlkem768_sha3_check.c << _EOF #include #include #include #include #include #include #include #include #include "crypto_api.h" #define fatal_f(x) exit(1) #include "libcrux_mlkem768_sha3.h_new" int main(void) { struct libcrux_mlkem768_keypair keypair = {0}; struct libcrux_mlkem768_pk pk = {0}; struct libcrux_mlkem768_sk sk = {0}; struct libcrux_mlkem768_ciphertext ct = {0}; struct libcrux_mlkem768_enc_result enc_result = {0}; uint8_t kp_seed[64] = {0}, enc_seed[32] = {0}; uint8_t shared_key[crypto_kem_mlkem768_BYTES]; if (sizeof(keypair.pk.value) != crypto_kem_mlkem768_PUBLICKEYBYTES) errx(1, "keypair.pk bad"); if (sizeof(keypair.sk.value) != crypto_kem_mlkem768_SECRETKEYBYTES) errx(1, "keypair.sk bad"); if (sizeof(pk.value) != crypto_kem_mlkem768_PUBLICKEYBYTES) errx(1, "pk bad"); if (sizeof(sk.value) != crypto_kem_mlkem768_SECRETKEYBYTES) errx(1, "sk bad"); if (sizeof(ct.value) != crypto_kem_mlkem768_CIPHERTEXTBYTES) errx(1, "ct bad"); if (sizeof(enc_result.fst.value) != crypto_kem_mlkem768_CIPHERTEXTBYTES) errx(1, "enc_result ct bad"); if (sizeof(enc_result.snd) != crypto_kem_mlkem768_BYTES) errx(1, "enc_result shared key bad"); keypair = libcrux_ml_kem_mlkem768_portable_generate_key_pair(kp_seed); if (!libcrux_ml_kem_mlkem768_portable_validate_public_key(&keypair.pk)) errx(1, "valid smoke failed"); enc_result = libcrux_ml_kem_mlkem768_portable_encapsulate(&keypair.pk, enc_seed); libcrux_ml_kem_mlkem768_portable_decapsulate(&keypair.sk, &enc_result.fst, shared_key); if (memcmp(shared_key, enc_result.snd, sizeof(shared_key)) != 0) errx(1, "smoke failed"); return 0; } _EOF cc -Wall -Wextra -Wno-unused-parameter -o libcrux_mlkem768_sha3_check \ libcrux_mlkem768_sha3_check.c ./libcrux_mlkem768_sha3_check # Extract PRNG inputs; there's no nice #defines for these key_pair_rng_len=`sed -e '/^libcrux_ml_kem_mlkem768_portable_kyber_generate_key_pair[(]$/,/[)] {$/!d' < libcrux_mlkem768_sha3.h_new | grep 'uint8_t randomness\[[0-9]*U\][)]' | sed 's/.*randomness\[\([0-9]*\)U\].*/\1/'` enc_rng_len=`sed -e '/^static inline tuple_3c libcrux_ml_kem_mlkem768_portable_kyber_encapsulate[(]$/,/[)] {$/!d' < libcrux_mlkem768_sha3.h_new | grep 'uint8_t randomness\[[0-9]*U\][)]' | sed 's/.*randomness\[\([0-9]*\)U\].*/\1/'` test -z "$key_pair_rng_len" && die "couldn't find size of libcrux_ml_kem_mlkem768_portable_kyber_generate_key_pair randomness argument" test -z "$enc_rng_len" && die "couldn't find size of libcrux_ml_kem_mlkem768_portable_kyber_encapsulate randomness argument" ( echo "/* defines for PRNG inputs */" echo "#define LIBCRUX_ML_KEM_KEY_PAIR_PRNG_LEN $key_pair_rng_len" echo "#define LIBCRUX_ML_KEM_ENC_PRNG_LEN $enc_rng_len" ) >> libcrux_mlkem768_sha3.h_new mv libcrux_mlkem768_sha3.h_new libcrux_mlkem768_sha3.h rm libcrux_mlkem768_sha3_check libcrux_mlkem768_sha3_check.c echo 1>&2 echo "libcrux_mlkem768_sha3.h OK" 1>&2 @ 1.1 log @Initial revision @ text @d2 1 a2 1 # $OpenBSD: mlkem768.sh,v 1.2 2024/09/04 05:11:33 djm Exp $ d6 2 a7 1 WANT_LIBCRUX_REVISION="origin/main" d51 1 d61 6 a66 1 # XXX per-file handling goes here. d69 2 a70 2 cat ;; @ 1.1.1.1 log @Import OpenSSH-9.9 (previous was 9.8) Changes: Future deprecation notice ========================= OpenSSH plans to remove support for the DSA signature algorithm in early 2025. This release disables DSA by default at compile time. DSA, as specified in the SSHv2 protocol, is inherently weak - being limited to a 160 bit private key and use of the SHA1 digest. Its estimated security level is only 80 bits symmetric equivalent. OpenSSH has disabled DSA keys by default since 2015 but has retained run-time optional support for them. DSA was the only mandatory-to- implement algorithm in the SSHv2 RFCs, mostly because alternative algorithms were encumbered by patents when the SSHv2 protocol was specified. This has not been the case for decades at this point and better algorithms are well supported by all actively-maintained SSH implementations. We do not consider the costs of maintaining DSA in OpenSSH to be justified and hope that removing it from OpenSSH can accelerate its wider deprecation in supporting cryptography libraries. Currently DSA is disabled at compile time. The final step of removing DSA support entirely is planned for the first OpenSSH release of 2025. DSA support may be re-enabled on OpenBSD by setting "DSAKEY=yes" in Makefile.inc. To enable DSA support in portable OpenSSH, pass the "--enable-dsa-keys" option to configure. Potentially-incompatible changes -------------------------------- * ssh(1): remove support for pre-authentication compression. OpenSSH has only supported post-authentication compression in the server for some years. Compression before authentication significantly increases the attack surface of SSH servers and risks creating oracles that reveal information about information sent during authentication. * ssh(1), sshd(8): processing of the arguments to the "Match" configuration directive now follows more shell-like rules for quoted strings, including allowing nested quotes and \-escaped characters. If configurations contained workarounds for the previous simplistic quote handling then they may need to be adjusted. If this is the case, it's most likely to be in the arguments to a "Match exec" confition. In this case, moving the command to be evaluated from the Match line to an external shell script is easiest way to preserve compatibility with both the old and new versions. Changes since OpenSSH 9.8 ========================= This release contains a number of new features and bugfixes. New features ------------ * ssh(1), sshd(8): add support for a new hybrid post-quantum key exchange based on the FIPS 203 Module-Lattice Key Enapsulation mechanism (ML-KEM) combined with X25519 ECDH as described by https://datatracker.ietf.org/doc/html/draft-kampanakis-curdle-ssh-pq-ke-03 This algorithm "mlkem768x25519-sha256" is available by default. * ssh(1): the ssh_config "Include" directive can now expand environment as well as the same set of %-tokens "Match Exec" supports. * sshd(8): add a sshd_config "RefuseConnection" option that, if set will terminate the connection at the first authentication request. * sshd(8): add a "refuseconnection" penalty class to sshd_config PerSourcePenalties that is applied when a connection is dropped by the new RefuseConnection keyword. * sshd(8): add a "Match invalid-user" predicate to sshd_config Match options that matches when the target username is not valid on the server. * ssh(1), sshd(8): update the Streamlined NTRUPrime code to a substantially faster implementation. * ssh(1), sshd(8): the hybrid Streamlined NTRUPrime/X25519 key exchange algorithm now has an IANA-assigned name in addition to the "@@openssh.com" vendor extension name. This algorithm is now also available under this name "sntrup761x25519-sha512" * ssh(1), sshd(8), ssh-agent(1): prevent private keys from being included in core dump files for most of their lifespans. This is in addition to pre-existing controls in ssh-agent(1) and sshd(8) that prevented coredumps. This feature is supported on OpenBSD, Linux and FreeBSD. * All: convert key handling to use the libcrypto EVP_PKEY API, with the exception of DSA. * sshd(8): add a random amount of jitter (up to 4 seconds) to the grace login time to make its expiry unpredictable. Bugfixes -------- * sshd(8): relax absolute path requirement back to what it was prior to OpenSSH 9.8, which incorrectly required that sshd was started with an absolute path in inetd mode. bz3717 * sshd(8): fix regression introduced in openssh-9.8 that swapped the order of source and destination addresses in some sshd log messages. * sshd(8): do not apply authorized_keys options when signature verification fails. Prevents more restrictive key options being incorrectly applied to subsequent keys in authorized_keys. bz3733 * ssh-keygen(1): include pathname in some of ssh-keygen's passphrase prompts. Helps the user know what's going on when ssh-keygen is invoked via other tools. Requested in GHPR503 * ssh(1), ssh-add(1): make parsing user@@host consistently look for the last '@@' in the string rather than the first. This makes it possible to more consistently use usernames that contain '@@' characters. * ssh(1), sshd(8): be more strict in parsing key type names. Only allow short names (e.g "rsa") in user-interface code and require full SSH protocol names (e.g. "ssh-rsa") everywhere else. bz3725 * regress: many performance and correctness improvements to the re-keying regression test. * ssh-keygen(1): clarify that ed25519 is the default key type generated and clarify that rsa-sha2-512 is the default signature scheme when RSA is in use. GHPR505 * sshd(8): fix minor memory leak in Subsystem option parsing; GHPR515 * All: additional hardening and consistency checks for the sshbuf code. * sshd(8): reduce default logingrace penalty to ensure that a single forgotton login that times out will be below the penalty threshold. * ssh(1): fix proxy multiplexing (-O proxy) bug. If a mux started with ControlPersist then later has a forwarding added using mux proxy connection and the forwarding was used, then when the mux proxy session terminated, the mux master process would issue a bad message that terminated the connection. Portability ----------- * sync contrib/ssh-copy-id to the latest upstream version. * regress: improve portablility for some awk(1) usage (e.g. Solaris) * In the contrib/redhat RPM spec file, without_openssl was previously incorrectly enabled unconditionally. * sshd(8) restore audit call before exit that regressed in openssh-9.8 Fixes an issue where the SSH_CONNECTION_ABANDON event was not recorded. * sshd(8): add support for class-imposed loging restrictions on FreeBSD. Allowing auth_hostok(3) and auth_timeok(3) to control logins. * Build fixes for Musl libc. * Fix detection of setres*id on GNU/Hurd @ text @@ 1.1.1.2 log @Import OpenSSH-10.0 (Previous one was 9.9) Potentially-incompatible changes -------------------------------- * This release removes support for the weak DSA signature algorithm, completing the deprecation process that began in 2015 (when DSA was disabled by default) and repeatedly warned over the last 12 months. * scp(1), sftp(1): pass "ControlMaster no" to ssh when invoked by scp & sftp. This disables implicit session creation by these tools when ControlMaster was set to yes/auto by configuration, which some users found surprising. This change will not prevent scp/sftp from using an existing multiplexing session if one had already been created. GHPR557 * This release has the version number 10.0 and announces itself as "SSH-2.0-OpenSSH_10.0". Software that naively matches versions using patterns like "OpenSSH_1*" may be confused by this. * sshd(8): this release removes the code responsible for the user authentication phase of the protocol from the per- connection sshd-session binary to a new sshd-auth binary. Splitting this code into a separate binary ensures that the crucial pre-authentication attack surface has an entirely disjoint address space from the code used for the rest of the connection. It also yields a small runtime memory saving as the authentication code will be unloaded after the authentication phase completes. This change should be largely invisible to users, though some log messages may now come from "sshd-auth" instead of "sshd-session". Downstream distributors of OpenSSH will need to package the sshd-auth binary. * sshd(8): this release disables finite field (a.k.a modp) Diffie-Hellman key exchange in sshd by default. Specifically, this removes the "diffie-hellman-group*" and "diffie-hellman-group-exchange-*" methods from the default KEXAlgorithms list. The client is unchanged and continues to support these methods by default. Finite field Diffie Hellman is slow and computationally expensive for the same security level as Elliptic Curve DH or PQ key agreement while offering no redeeming advantages. ECDH has been specified for the SSH protocol for 15 years and some form of ECDH has been the default key exchange in OpenSSH for the last 14 years. * sshd(8): this release removes the implicit fallback to compiled- in groups for Diffie-Hellman Group Exchange KEX when the moduli file exists but does not contain moduli within the client- requested range. The fallback behaviour remains for the case where the moduli file does not exist at all. This allows administrators more explicit control over which DH groups will be selected, but can lead to connection failures if the moduli file is edited incorrectly. bz#2793 Changes since OpenSSH 9.9 ========================= This release contains a minor security fix as well as a number of feature improvements and bugfixes. Security ======== * sshd(8): fix the DisableForwarding directive, which was failing to disable X11 forwarding and agent forwarding as documented. X11 forwarding is disabled by default in the server and agent forwarding is off by default in the client. New features ------------ * ssh(1): the hybrid post-quantum algorithm mlkem768x25519-sha256 is now used by default for key agreement. This algorithm is considered to be safe against attack by quantum computers, is guaranteed to be no less strong than the popular curve25519-sha256 algorithm, has been standardised by NIST and is considerably faster than the previous default. * ssh(1): prefer AES-GCM to AES-CTR mode when selecting a cipher for the connection. The default cipher preference list is now Chacha20/Poly1305, AES-GCM (128/256) followed by AES-CTR (128/192/256). * ssh(1): add %-token and environment variable expansion to the ssh_config SetEnv directive. * ssh(1): allow %-token and environment variable expansion in the ssh_config User directive, with the exception of %r and %C which would be self-referential. bz#3477 * ssh(1), sshd(8): add "Match version" support to ssh_config and sshd_config. Allows matching on the local version of OpenSSH, e.g. "Match version OpenSSH_10.*". * ssh(1): add support for "Match sessiontype" to ssh_config. Allows matching on the type of session initially requested, either "shell" for interactive sessions, "exec" for command execution sessions, "subsystem" for subsystem requests, such as sftp, or "none" for transport/forwarding-only sessions. * ssh(1): add support for "Match command ..." support to ssh_config, allowing matching on the remote command as specified on the command-line. * ssh(1): allow 'Match tagged ""' and 'Match command ""' to match empty tag and command values respectively. * sshd(8): allow glob(3) patterns to be used in sshd_config AuthorizedKeysFile and AuthorizedPrincipalsFile directives. bz2755 * sshd(1): support the VersionAddendum in the client, mirroring the option of the same name in the server; bz2745 * ssh-agent(1): the agent will now delete all loaded keys when signaled with SIGUSR1. This allows deletion of keys without having access to $SSH_AUTH_SOCK. * Portable OpenSSH, ssh-agent(1): support systemd-style socket activation in ssh-agent using the LISTEN_PID/LISTEN_FDS mechanism. Activated when these environment variables are set, the agent is started with the -d or -D option and no socket path is set. GHPR502 * ssh-keygen(1): support FIDO tokens that return no attestation data, e.g. recent WinHello. GHPR542 * ssh-agent(1): add a "-Owebsafe-allow=..." option to allow the default FIDO application ID allow-list to be overridden. * Add a work-in-progress tool to verify FIDO attestation blobs that ssh-keygen can optionally write when enrolling FIDO keys. This tool is available under regress/misc/ssh-verify-attestation for experimentation but is not installed by "make install". * ssh-keygen(1): allow "-" as output file for moduli screening. GHPR393 Bugfixes -------- * sshd(8): remove assumption that the sshd_config and any configs it includes can fit in a (possibly enlarged) socket buffer. Previously it was possible to create a sufficiently large configuration that could cause sshd to fail to accept any connection. sshd(8) will now actively manage sending its config to the sshd-session sub-process. * ssh(1): don't start the ObscureKeystrokeTiming mitigations if there has been traffic on a X11 forwarding channel recently. Should fix X11 forwarding performance problems when this setting is enabled. bz3655 * ssh(1): prohibit the comma character in hostnames accepted, but allow an underscore as the first character in a hostname. * sftp(1): set high-water when resuming a "put". Prevents bogus "server reordered acks" debug message. * ssh(1), sshd(8): fix regression in openssh-9.8, which would fail to accept "Match criteria=argument" as well as the documented "Match criteria argument" syntax in ssh_config and sshd_config. bz3739 * sftp(1), ssh(1): fix a number possible NULL dereference bugs, including Coverity CIDs 405019 and 477813. * sshd(8): fix PerSourcePenalty incorrectly using "crash" penalty when LoginGraceTime was exceeded. bz3797 * sshd(8): fix "Match invalid-user" from incorrectly being activated in initial configuration pass when no other predicates were present on the match line * sshd(8): fix debug logging of user specific delay. GHPR#552 * sshd(8): improve debug logging across sub-process boundaries. Previously some log messages were lost early in the sshd-auth and sshd-session processes' life. * ssh(1): require control-escape character sequences passed via the '-e ^x' command-line to be exactly two characters long. Avoids one byte out-of-bounds read if ssh is invoked as "ssh -e^ ..." GHPR368 * ssh(1), sshd(8): prevent integer overflow in x11 port handling. These are theoretically possible if the admin misconfigured X11DisplayOffset or the user misconfigures their own $DISPLAY, but don't happen in normal operation. bz#3730 * ssh-keygen(1): don't mess up ssh-keygen -l output when the file contains CR characters; GHPR236 bz3385. * sshd(8): add rate limits to logging of connections dropped by PerSourcePenalties. Previously these could be noisy in logs. * ssh(1): fix argument of "Compression" directive in ssh -G config dump, which regressed in openssh-9.8. * sshd(8): fix a corner-case triggered by UpdateHostKeys when sshd refuses to accept the signature returned by an agent holding host keys during the hostkey rotation sub-protocol. This situation could occur in situations where a PKCS#11 smartcard that lacked support for particular signature algorithms was used to store host keys. * ssh-keygen(1): when using RSA keys to sign messages with "ssh-keygen -Y", select the signature algorithm based on the requested hash algorithm ("-Ohashalg=xxx"). This allows using something other than the default of rsa-sha2-512, which may not be supported on all signing backends, e.g. some smartcards only support SHA256. * ssh(1), sshd(8), ssh-keyscan(1): fix ML-KEM768x25519 KEX on big-endian systems. * Many regression and interop test improvements. Portability ----------- * All: add support for AWS-LC (AWS libcrypto). bz3784 * sshd(8): add wtmpdb support as a Y2038 safe wtmp replacement. * sshd(8): add support for locking sshd into memory, enabled with the --with-linux-memlock-onfault configure flag. * Add support for building a standalone sk-libfido2 library, enabled by --with-security-key-standalone * ssh(1), sshd(8), ssh-keyscan(1): include __builtin_popcount replacement function. for compilers that lack it. * All: Check for and replace le32toh, le64toh, htole64 separately. It appears that at least some versions of endian.h in glibc do not have the latter two. bz#3794 * Remove ancient RHL 6.x config in RPM spec. @ text @d2 1 a2 1 # $OpenBSD: mlkem768.sh,v 1.3 2024/10/27 02:06:01 djm Exp $ d6 1 a6 2 #WANT_LIBCRUX_REVISION="origin/main" WANT_LIBCRUX_REVISION="84c5d87b3092c59294345aa269ceefe0eb97cc35" a49 1 d59 1 a59 6 */libcrux-ml-kem/cg/eurydice_glue.h) # Replace endian functions with versions that work. perl -0777 -pe 's/(static inline void core_num__u64_9__to_le_bytes.*\n)([^}]*\n)/\1 v = htole64(v);\n\2/' | perl -0777 -pe 's/(static inline uint64_t core_num__u64_9__from_le_bytes.*?)return v;/\1return le64toh(v);/s' | perl -0777 -pe 's/(static inline uint32_t core_num__u32_8__from_le_bytes.*?)return v;/\1return le32toh(v);/s' ;; d62 2 a63 2 cat ;; @ 1.1.1.3 log @Import OpenSSH-10.3 (previous was 10.2) OpenSSH 10.3 was released on 2026-04-02. It is available from the mirrors listed at https://www.openssh.com/. OpenSSH is a 100% complete SSH protocol 2.0 implementation and includes sftp client and server support. Once again, we would like to thank the OpenSSH community for their continued support of the project, especially those who contributed code or patches, reported bugs, tested snapshots or donated to the project. More information on donations may be found at: https://www.openssh.com/donations.html Potentially-incompatible changes -------------------------------- * ssh(1), sshd(8): remove bug compatibility for implementations that don't support rekeying. If such an implementation tries to interoperate with OpenSSH, it will now eventually fail when the transport needs rekeying. * sshd(8): prior to this release, a certificate that had an empty principals section would be treated as matching any principal (i.e. as a wildcard) when used via authorized_keys principals="" option. This was intentional, but created a surprising and potentially risky situation if a CA accidentally issued a certificate with an empty principals section: instead of being useless as one might expect, it could be used to authenticate as any user who trusted the CA via authorized_keys. [Note that this condition did not apply to CAs trusted via the sshd_config(5) TrustedUserCAKeys option.] This release treats an empty principals section as never matching any principal, and also fixes interpretation of wildcard characters in certificate principals. Now they are consistently implemented for host certificates and not supported for user certificates. * ssh(1): the -J and equivalent -oProxyJump="..." options now validate user and host names for ProxyJump/-J options passed via the command-line (no such validation is performed for this option in configuration files). This prevents shell injection in situations where these were directly exposed to adversarial input, which would have been a terrible idea to begin with. Reported by rabbit. Changes since OpenSSH 10.2 ========================== This release contains some relatively minor security fixes as well as a number of feature improvements and general bugfixes. Security ======== * ssh(1): validation of shell metacharacters in user names supplied on the command-line was performed too late to prevent some situations where they could be expanded from %-tokens in ssh_config. For certain configurations, such as those that use a "%u" token in a "Match exec" block, an attacker who can control the user name passed to ssh(1) could potentially execute arbitrary shell commands. Reported by Florian Kohnhäuser. We continue to recommend against directly exposing ssh(1) and other tools' command-lines to untrusted input. Mitigations such as this can not be absolute given the variety of shells and user configurations in use. * sshd(8): when matching an authorized_keys principals="" option against a list of principals in a certificate, an incorrect algorithm was used that could allow inappropriate matching in cases where a principal name in the certificate contains a comma character. Exploitation of the condition requires an authorized_keys principals="" option that lists more than one principal *and* a CA that will issue a certificate that encodes more than one of these principal names separated by a comma (typical CAs stronly constrain which principal names they will place in a certificate). This condition only applies to user- trusted CA keys in authorized_keys, the main certificate authentication path (TrustedUserCAKeys/AuthorizedPrincipalsFile) is not affected. Reported by Vladimir Tokarev. * scp(1): when downloading files as root in legacy (-O) mode and without the -p (preserve modes) flag set, scp did not clear setuid/setgid bits from downloaded files as one might typically expect. This bug dates back to the original Berkeley rcp program. Reported by Christos Papakonstantinou of Cantina and Spearbit. * sshd(8): fix incomplete application of PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms with regard to ECDSA keys. Previously if one of these directives contains any ECDSA algorithm name (say "ecdsa-sha2-nistp384"), then any other ECDSA algorithm would be accepted in its place regardless of whether it was listed or not. Reported by Christos Papakonstantinou of Cantina and Spearbit. * ssh(1): connection multiplexing confirmation (requested using "ControlMaster ask/autoask") was not being tested for proxy mode multiplexing sessions (i.e. "ssh -O proxy ..."). Reported by Michalis Vasileiadis. New features ------------ * ssh(1), sshd(8): support IANA-assigned codepoints for SSH agent forwarding, as per draft-ietf-sshm-ssh-agent. Support for the new names is advertised via the EXT_INFO message. If a server offers support for the new names, then they are used preferentially. Support for the pre-standardisation "@@openssh.com" extensions for agent forwarding remains supported. * ssh-agent(1): implement support for draft-ietf-sshm-ssh-agent "query" extension. * ssh-add(1): support querying the protocol extensions via the agent "query" extension with a new -Q flag. * ssh(1): support multiple files in a ssh_config RevokedHostKeys directive. bz3918 * sshd(8): support multiple files in a sshd_config RevokedKeys directive bz3918 * ssh(1): add a ~I escape option that shows information about the current SSH connection. * ssh(1): add an "ssh -Oconninfo user@@host" multiplexing command that shows connection information, similar to the ~I escapechar. * ssh(1): add an "ssh -O channels user@@host" multiplexing command to get a running mux process to show information about what channels are currently open. * sshd(8): add 'invaliduser' penalty to PerSourcePenalties, which is applied to login attempts for usernames that do not match real accounts. Defaults to 5s to match 'authfail' but allows administrators to block such attempts for longer if desired. * sshd(8): add a GSSAPIDelegateCredentials option for the server, controlling whether it accepts delegated credentials offered by the client. This option mirrors the same option in ssh_config. GHPR614 * ssh(1), sshd(8): support the VA DSCP codepoint in the IPQoS directive. * sshd(8): convert PerSourcePenalties to using floating point time, allowing penalties to be less than a second. This is useful if you need to penalise things you expect to occur at >=1 QPS. * ssh-keygen(1): support writing ED25519 keys in PKCS8 format. GHPR570 * Support the ed25519 signature scheme via libcrypto. Bugfixes -------- * sshd(8): make IPQoS first-match-wins in sshd_config, like other configuration directives. bz3924 * sshd(8): fix potential crash when MaxStartups is using a single argument (i.e. not using the MaxStartps x:y:z form) to a value below 10. bz3941 * sshd(8): fix a potential hang during key exchange if needed DH group values were missing from /etc/moduli. * ssh-agent(1): fix return values from extensions to be correct wrt draft-ietf-sshm-ssh-agent: extension requests should indicate failure using SSH_AGENT_EXTENSION_FAILURE rather than the generic SSH_AGENT_FAILURE error code. This allows the client to discern between "the request failed" and "the agent doesn't support this extension". * ssh(1): use fmprintf for showing challenge-response name and info to preserve UTF-8 characters where appropriate. Prompted by GitHub PR#452. * scp(1): when uploading a directory using sftp/sftp (e.g. during a recursive transfer), don't clobber the remote directory permissions unless either we created the directory during the transfer or the -p flag was set. bz3925 * All: implement missing pieces of FIDO/webauthn signature support, mostly related to certificate handling and enable acceptance of this signature format by default. bz3748 GHPR624 GHPR625 * sshd_config(5): make it clear that DenyUsers/DenyGroups overrides AllowUsers/AllowGroups. Previously we specified the order in which the directives are processed but it was ambiguous as to what happened if both matched. * ssh(1): don't try to match certificates held in an agent to private keys. This matching is done to support certificates that were loaded without their private key material, but is unnecessary for agent-hosted certificate which always have private key material available in the agent. Worse, this matching would mess up the request sent to the agent in such a way as to break usage of these keys when the key usage was restricted in the agent. bz3752 * sftp(1): if editline has been switched to vi mode (i.e. via "bind -v" in .editrc), setup a keybinding so that command mode can be entered. * ssh(1), sshd(8): improve performance of keying the sntrup761 key agreement algorithm. * ssh(1), sshd(8): enforce maximum packet/block limit during pre-authentication phase. * sftp(1): don't misuse the sftp limits extension's open-handles field. This value is supposed to be the number of handles a server will allow to be opened and not a number of outstanding read/write requests that can be sent during an upload/download. * sshd(8): don't crash at connection time if the main sshd_config lacks any subsystem directive but one is defined in a Match block. bz3906 * sshd_config(5): add a warning next to the ForceCommand directive that forcing a command doesn't automatically disable forwarding. * sshd_config(5): add a warning that TOKENS are replaced without filtering or escaping and that it's the administrator's responsibility to ensure they are used safely in context. * scp(1): correctly quote filenames in verbose output for local-> local copies. bz3900 * sshd(8): don't mess up the PerSourceNetBlockSize IPv6 mask if sscanf didn't decode it. GHPR598 * ssh-add(1): when loading FIDO2 resident keys, set the comment to the FIDO application string. This matches the behaviour of ssh-keygen -K. GHPR608 * sshd(8): don't strnvis() log messages that are going to be logged by sshd-auth via its parent sshd-session process, as the parent will also run them though strnvis(). Prevents double-escaping of non-printing characters in some log messages. bz3896 * ssh-agent(1): escape SSH_AUTH_SOCK paths that are sent to the shell as setenv commands. Unbreaks ssh-agent for home directory paths that contain whitespace. bz3884 * All: Remove unnecessary checks for ECDSA public key validity. * sshd(8): activate UnusedConnectionTimeout only after the last channel has closed. Previously UnusedConnectionTimeout could fire early after a ChannelTimeout. This was not a problem for the OpenSSH client because it terminates once all channels have closed but could cause problems for other clients (e.g. API clients) that do things differently. bz3827 * All: fix PKCS#11 key PIN entry problems introduced in openssh-10.1/10.2. bz3879 * scp(1): when using the SFTP protocol for transfers, fix implicit destination path selection when source path ends with "..". bz3871 * sftp(1): when tab-completing a filename, ensure that the completed string does not end up mid-way through a multibyte character, as this will cause a fatal() later on. GHPR#587 * ssh-keygen(1): fix crash at exit (visible via ssh-keygen -D) when multiple keys loaded. * scp(1)/sftp(1): correctly display bandwidths >2GBps in the progress meter. Portability ----------- * sshd(8): fix condition intoduced in openssh 10.2p1 stable branch here a PAM module that changed the requested username between SSH_MSG_USERAUTH_REQUEST messages during authentication could confuse the PAM stack and let it proceed with a different understanding of the active username than the rest of sshd. Reported by Mike Damm. * sshd(8): immediately report interactive instructions to clients when using keyboard-interactive authentication with PAM. bz2876 * sshd(8): fix duplicate PAM messages under some situations. * sshd(8): don't leak PAM handle on repeat invocations. bz3882 * All: support linking libcrypto implementations (e.g. BoringSSL) that require libstdc++. * sshd(8): fix ut_type for btmp records, correctly using LOGIN_PROCESS and USER_PROCESS. * sshd(8): allow uname(3) in the seccomp sandbox. This is needed by zlib-ng on RISC-V platforms. * All: remove remaining OpenSSL_add_all_algorithms() calls. We already have OPENSSL_init_crypto() in the compat layer. Prompted by github PR#606 * All: fix builds on older Mac OS wrt nfds_t. * mdoc2man: several improvements including better support for Dl and Ns inside Ic. @ text @d2 1 a2 1 # $OpenBSD: mlkem768.sh,v 1.5 2025/11/13 05:13:06 djm Exp $ d7 1 a7 1 WANT_LIBCRUX_REVISION="core-models-v0.0.4" a8 1 BASE="libcrux/libcrux-ml-kem/extracts/c_header_only/generated" d10 5 a14 5 $BASE/eurydice_glue.h $BASE/libcrux_mlkem_core.h $BASE/libcrux_ct_ops.h $BASE/libcrux_sha3_portable.h $BASE/libcrux_mlkem768_portable.h d43 8 a50 74 LSHIFT="<<" cat << _EOF #if !defined(__GNUC__) || (__GNUC__ < 2) # define __attribute__(x) #endif #define KRML_MUSTINLINE inline #define KRML_NOINLINE __attribute__((noinline, unused)) #define KRML_HOST_EPRINTF(...) #define KRML_HOST_EXIT(x) fatal_f("internal error") static inline void store64_le(uint8_t dst[8], uint64_t src) { dst[0] = src & 0xff; dst[1] = (src >> 8) & 0xff; dst[2] = (src >> 16) & 0xff; dst[3] = (src >> 24) & 0xff; dst[4] = (src >> 32) & 0xff; dst[5] = (src >> 40) & 0xff; dst[6] = (src >> 48) & 0xff; dst[7] = (src >> 56) & 0xff; } static inline void store32_le(uint8_t dst[4], uint32_t src) { dst[0] = src & 0xff; dst[1] = (src >> 8) & 0xff; dst[2] = (src >> 16) & 0xff; dst[3] = (src >> 24) & 0xff; } static inline void store32_be(uint8_t dst[4], uint32_t src) { dst[0] = (src >> 24) & 0xff; dst[1] = (src >> 16) & 0xff; dst[2] = (src >> 8) & 0xff; dst[3] = src & 0xff; } static inline uint64_t load64_le(uint8_t src[8]) { return (uint64_t)(src[0]) | ((uint64_t)(src[1]) $LSHIFT 8) | ((uint64_t)(src[2]) $LSHIFT 16) | ((uint64_t)(src[3]) $LSHIFT 24) | ((uint64_t)(src[4]) $LSHIFT 32) | ((uint64_t)(src[5]) $LSHIFT 40) | ((uint64_t)(src[6]) $LSHIFT 48) | ((uint64_t)(src[7]) $LSHIFT 56); } static inline uint32_t load32_le(uint8_t src[4]) { return (uint32_t)(src[0]) | ((uint32_t)(src[1]) $LSHIFT 8) | ((uint32_t)(src[2]) $LSHIFT 16) | ((uint32_t)(src[3]) $LSHIFT 24); } #ifdef MISSING_BUILTIN_POPCOUNT static inline unsigned int __builtin_popcount(unsigned int num) { const int v[16] = { 0, 1, 1, 2, 1, 2, 2, 3, 1, 2, 2, 3, 2, 3, 3, 4 }; return v[num & 0xf] + v[(num >> 4) & 0xf]; } #endif _EOF d61 5 a65 3 */eurydice_glue.h) # Replace endian function for consistency. perl -0777 -pe 's/(static inline void core_num__u32__to_be_bytes.*\n)([^}]*\n)/\1 store32_be(dst, src);\n/' d78 3 a80 2 echo '#define libcrux_mlkem768_pk libcrux_ml_kem_types_MlKemPublicKey_30_s' echo '#define libcrux_mlkem768_sk libcrux_ml_kem_types_MlKemPrivateKey_d9_s' d82 1 a82 1 echo '#define libcrux_mlkem768_enc_result tuple_c2_s' d135 1 a135 1 cc -Wall -Wextra -Wno-unused-parameter -I . -o libcrux_mlkem768_sha3_check \ d140 2 a141 2 key_pair_rng_len=`grep '^libcrux_ml_kem_mlkem768_portable_generate_key_pair.*randomness' libcrux_mlkem768_sha3.h_new | sed 's/.*randomness[[]//;s/\].*//'` enc_rng_len=`sed -e '/^static inline tuple_c2 libcrux_ml_kem_mlkem768_portable_encapsulate[(]$/,/[)] {$/!d' < libcrux_mlkem768_sha3.h_new | grep 'uint8_t randomness\[[0-9]*U\][)]' | sed 's/.*randomness\[\([0-9]*\)U\].*/\1/'` @