Dmitry Belyavskiy

TLS 1.3 по ГОСТ в openssl - roadmap

22

1. Добавить в уже существующую провайдерную сборку MGM-шифры - done #414 2. Спортировать в апстрим те патчи, которые добавляют собственно шифронаборы. На этом этапе получаем возможность российских шифронаборов с западным...

Wrap ciphers magma_kexp15 and kuznyechik_kexp15 are implemented only partially: they don't allow encryption. It should be fixed.

We need to have tests for all Magma cipher modes.

Pkcs11 Edwards support

27

This patch provides basic support of Ed25519 keys via PKCS#11 tokens

Coverity fixes

7

This is a set of patches fixing the issues found during the coverity scan of the openssh 8.5.

Modern OpenSSL versions support ed25519 keys. These patches add the detection of the necessary functions and uses them for import of ed25519 keys to OpenSSH

Providing MinRSABits option to limit RSA key length

4

There is a need to increase RSA key requirements to make the installations more secure. Just updating the default compiled-in value isn't an option because it may significantly break legacy...

Better emulation of old scp behavior

1

When we use scp in SFTP mode, we try to create a non-existent directory to better emulate the old SCP behavior

Fix Windows-generated fingerprint output

5

ssh-keygen -l mangles the output for the keys generated on Windows machine because of '\r' EOL. This patch fixes it.

Provide a system-wide kill switch for SCP protocol

1

As we use SFTP by default, and SCP is considered insecure, we may want to disable it totally. As scp utility doesn't use the system-wide config, we suggest implementing it...