From 6068a2e6cfdc895ce524b6d2bdc8ea0cea8ea0e8 Mon Sep 17 00:00:00 2001 From: Roland Shoemaker Date: Wed, 2 Mar 2022 08:24:15 -0800 Subject: ssh: ignore MAC if AEAD ciphers negotiated If the server/client cipher chosen is one of the two AEAD ciphers that we support (aes128-gcm@openssh.com and chacha20-poly1305@openssh.com), don't attempt to find a common MAC algorithm in findAgreedAlgorithms. Similarly in newPacketCipher, don't attempt to generate a MAC key if we are using a AEAD cipher. Fixes golang/go#51406 Change-Id: Id48ae72f052cb0a0c597b32e9901a0f218e4161f Reviewed-on: https://go-review.googlesource.com/c/crypto/+/389214 Trust: Roland Shoemaker Run-TryBot: Roland Shoemaker TryBot-Result: Gopher Robot Reviewed-by: Filippo Valsorda --- ssh/common.go | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-) (limited to 'ssh/common.go') diff --git a/ssh/common.go b/ssh/common.go index 5ae2275..ec1f839 100644 --- a/ssh/common.go +++ b/ssh/common.go @@ -152,6 +152,11 @@ func (a *directionAlgorithms) rekeyBytes() int64 { return 1 << 30 } +var aeadCiphers = map[string]bool{ + gcmCipherID: true, + chacha20Poly1305ID: true, +} + type algorithms struct { kex string hostKey string @@ -187,14 +192,18 @@ func findAgreedAlgorithms(isClient bool, clientKexInit, serverKexInit *kexInitMs return } - ctos.MAC, err = findCommon("client to server MAC", clientKexInit.MACsClientServer, serverKexInit.MACsClientServer) - if err != nil { - return + if !aeadCiphers[ctos.Cipher] { + ctos.MAC, err = findCommon("client to server MAC", clientKexInit.MACsClientServer, serverKexInit.MACsClientServer) + if err != nil { + return + } } - stoc.MAC, err = findCommon("server to client MAC", clientKexInit.MACsServerClient, serverKexInit.MACsServerClient) - if err != nil { - return + if !aeadCiphers[stoc.Cipher] { + stoc.MAC, err = findCommon("server to client MAC", clientKexInit.MACsServerClient, serverKexInit.MACsServerClient) + if err != nil { + return + } } ctos.Compression, err = findCommon("client to server compression", clientKexInit.CompressionClientServer, serverKexInit.CompressionClientServer) -- cgit v1.3