From 881cdf88bbf4fd192ae2694b2c5accb4939b02d3 Mon Sep 17 00:00:00 2001 From: networkException Date: Mon, 9 Jun 2025 14:34:15 +0200 Subject: [PATCH] feat: enable `mlkem768x25519-sha256` by default for builtin ssh (#8115) This pull request enables the `mlkem768x25519-sha256` key exchange algorithm by default. Support for this has landed in go 1.24 and crypto/ssh 0.39.0 respectively. Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/8115 Reviewed-by: Gusted Co-authored-by: networkException Co-committed-by: networkException --- custom/conf/app.example.ini | 2 +- modules/setting/ssh.go | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/custom/conf/app.example.ini b/custom/conf/app.example.ini index da657df60c..1b8d4c6697 100644 --- a/custom/conf/app.example.ini +++ b/custom/conf/app.example.ini @@ -183,7 +183,7 @@ RUN_USER = ; git ;; ;; For the built-in SSH server, choose the key exchange algorithms to support for SSH connections, ;; for system SSH this setting has no effect -;SSH_SERVER_KEY_EXCHANGES = curve25519-sha256, ecdh-sha2-nistp256, ecdh-sha2-nistp384, ecdh-sha2-nistp521, diffie-hellman-group14-sha256, diffie-hellman-group14-sha1 +;SSH_SERVER_KEY_EXCHANGES = mlkem768x25519-sha256, curve25519-sha256, ecdh-sha2-nistp256, ecdh-sha2-nistp384, ecdh-sha2-nistp521, diffie-hellman-group14-sha256, diffie-hellman-group14-sha1 ;; ;; For the built-in SSH server, choose the MACs to support for SSH connections, ;; for system SSH this setting has no effect diff --git a/modules/setting/ssh.go b/modules/setting/ssh.go index 86193bddb9..1ad826a17a 100644 --- a/modules/setting/ssh.go +++ b/modules/setting/ssh.go @@ -56,7 +56,7 @@ var SSH = struct { Domain: "", Port: 22, ServerCiphers: []string{"chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-gcm@openssh.com", "aes256-gcm@openssh.com"}, - ServerKeyExchanges: []string{"curve25519-sha256", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1"}, + ServerKeyExchanges: []string{"mlkem768x25519-sha256", "curve25519-sha256", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1"}, ServerMACs: []string{"hmac-sha2-256-etm@openssh.com", "hmac-sha2-256", "hmac-sha1"}, KeygenPath: "", MinimumKeySizeCheck: true,