diff --git a/README.md b/README.md index b5fbee5..e41d38a 100644 --- a/README.md +++ b/README.md @@ -256,6 +256,7 @@ For convenience, a web front-end on top of the command-line tool is available at ### v3.9.1-dev - Added support for Python 3.15. - Fixed a perhaps rare crash when performing connection rate tests during standard audits. + - No longer mark `kexguess2@matt.ucc.asn.au` (pseudo-kex used by Dropbear) as not PQ-safe. - Added `-V`/`--version` flag to print version and terminate; credit [Christian Krause](https://github.com/wookietreiber). ### v3.9.0 (2026-07-04) diff --git a/src/ssh_audit/ssh2_kexdb.py b/src/ssh_audit/ssh2_kexdb.py index 65688df..6ddb053 100644 --- a/src/ssh_audit/ssh2_kexdb.py +++ b/src/ssh_audit/ssh2_kexdb.py @@ -80,6 +80,7 @@ class SSH2_KexDB: # pylint: disable=too-few-public-methods INFO_WITHDRAWN_PQ_ALG = 'the sntrup4591761 algorithm was withdrawn, as it may not provide strong post-quantum security' INFO_EXTENSION_NEGOTIATION = 'pseudo-algorithm that denotes the peer supports RFC8308 extensions' INFO_STRICT_KEX = 'pseudo-algorithm that denotes the peer supports a stricter key exchange method as a counter-measure to the Terrapin attack (CVE-2023-48795)' + INFO_KEXGUESS2 = 'pseudo-algorithm used by Dropbear to enable kex guessing' # NIST PQC security levels: https://blog.cloudflare.com/pq-2025/ INFO_NIST_PQC_LEVEL_2 = 'rated at NIST PQC level 2 (at least as hard to break as SHA256)' @@ -196,7 +197,7 @@ class SSH2_KexDB: # pylint: disable=too-few-public-methods 'kexAlgoECDH256': [[], [FAIL_NSA_BACKDOORED_CURVE], [WARN_NOT_PQ_SAFE]], 'kexAlgoECDH384': [[], [FAIL_NSA_BACKDOORED_CURVE], [WARN_NOT_PQ_SAFE]], 'kexAlgoECDH521': [[], [FAIL_NSA_BACKDOORED_CURVE], [WARN_NOT_PQ_SAFE]], - 'kexguess2@matt.ucc.asn.au': [['d2013.57'], [], [WARN_NOT_PQ_SAFE]], + 'kexguess2@matt.ucc.asn.au': [['d2013.57'], [], [], [INFO_KEXGUESS2]], 'm383-sha384@libassh.org': [[], [FAIL_UNPROVEN], [WARN_NOT_PQ_SAFE]], 'm511-sha512@libassh.org': [[], [FAIL_UNPROVEN], [WARN_NOT_PQ_SAFE]], 'mlkem768x25519-sha256': [['9.9'], [], [], [INFO_DEFAULT_OPENSSH_KEX_100, INFO_HYBRID_PQ_X25519_KEX]], diff --git a/test/test_ssh2_kexdb.py b/test/test_ssh2_kexdb.py index 237b212..ca593b8 100644 --- a/test/test_ssh2_kexdb.py +++ b/test/test_ssh2_kexdb.py @@ -46,6 +46,7 @@ class Test_SSH2_KexDB: "ecdh-nistp521-kyber-1024r3-sha512-d00@openquantumsafe.org", "ext-info-c", "ext-info-s", + "kexguess2@matt.ucc.asn.au", "kex-strict-c-v00@openssh.com", "kex-strict-s-v00@openssh.com", "mlkem768x25519-sha256",