GUACAMOLE-1669: Include ext-info-c in preferred KEX algorithms to ensure RSA key upgrades can happen.
This commit is contained in:
parent
4d211e0c9e
commit
b096e47f57
@ -49,9 +49,12 @@ GCRY_THREAD_OPTION_PTHREAD_IMPL;
|
||||
|
||||
/**
|
||||
* A list of all key exchange algorithms that are both FIPS-compliant, and
|
||||
* OpenSSL-supported.
|
||||
* OpenSSL-supported. Note that "ext-info-c" is also included. While not a key
|
||||
* exchange algorithm per se, it must be in the list to ensure that the server
|
||||
* will send a SSH_MSG_EXT_INFO response, which is required to perform RSA key
|
||||
* upgrades.
|
||||
*/
|
||||
#define FIPS_COMPLIANT_KEX_ALGORITHMS "diffie-hellman-group-exchange-sha256"
|
||||
#define FIPS_COMPLIANT_KEX_ALGORITHMS "diffie-hellman-group-exchange-sha256,ext-info-c"
|
||||
|
||||
/**
|
||||
* A list of ciphers that are both FIPS-compliant, and OpenSSL-supported.
|
||||
|
Loading…
Reference in New Issue
Block a user