From: Nikos Mavrogiannopoulos Date: Thu, 13 Nov 2003 07:24:47 +0000 (+0000) Subject: Added the RIPEMD ciphersuites defined in draft-ietf-tls-openpgp-keys-04. X-Git-Tag: gnutls_0_9_98~19 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=5d8a897fc424c028f86629c86dbfec00e3b67474;p=thirdparty%2Fgnutls.git Added the RIPEMD ciphersuites defined in draft-ietf-tls-openpgp-keys-04. --- diff --git a/NEWS b/NEWS index de32590675..df2f6fd4a2 100644 --- a/NEWS +++ b/NEWS @@ -1,6 +1,7 @@ Version 0.9.98 - The openssl compatibility layer was moved to gnutls-openssl library instead of being included in the gnutls-extra library. +- Added the RIPEMD ciphersuites defined in draft-ietf-tls-openpgp-keys-04. Version 0.9.97 (11/11/2003) - The certtool utility can now generate PKCS #12 structures diff --git a/configure.in b/configure.in index a95260510d..33c689d687 100644 --- a/configure.in +++ b/configure.in @@ -12,7 +12,7 @@ AC_DEFINE_UNQUOTED(T_OS, "$target_os", [OS name]) dnl Gnutls Version GNUTLS_MAJOR_VERSION=0 GNUTLS_MINOR_VERSION=9 -GNUTLS_MICRO_VERSION=97 +GNUTLS_MICRO_VERSION=98 GNUTLS_VERSION=$GNUTLS_MAJOR_VERSION.$GNUTLS_MINOR_VERSION.$GNUTLS_MICRO_VERSION AC_DEFINE_UNQUOTED(GNUTLS_VERSION, "$GNUTLS_VERSION", [version of gnutls]) diff --git a/lib/gnutls.h.in.in b/lib/gnutls.h.in.in index 3494d95b24..1e3aa24807 100644 --- a/lib/gnutls.h.in.in +++ b/lib/gnutls.h.in.in @@ -63,7 +63,9 @@ typedef enum gnutls_kx_algorithm { GNUTLS_KX_RSA=1, GNUTLS_KX_DHE_DSS, typedef enum gnutls_credentials_type { GNUTLS_CRD_CERTIFICATE=1, GNUTLS_CRD_ANON, GNUTLS_CRD_SRP } gnutls_credentials_type; -typedef enum gnutls_mac_algorithm { GNUTLS_MAC_NULL=1, GNUTLS_MAC_MD5, GNUTLS_MAC_SHA } gnutls_mac_algorithm; +typedef enum gnutls_mac_algorithm { GNUTLS_MAC_NULL=1, + GNUTLS_MAC_MD5, GNUTLS_MAC_SHA, GNUTLS_MAC_RMD160 +} gnutls_mac_algorithm; /* The enumerations here should have the same value with gnutls_mac_algorithm. */ diff --git a/lib/gnutls_algorithms.c b/lib/gnutls_algorithms.c index e7759385d6..4d02e14fe0 100644 --- a/lib/gnutls_algorithms.c +++ b/lib/gnutls_algorithms.c @@ -163,6 +163,7 @@ typedef struct gnutls_hash_entry gnutls_hash_entry; static const gnutls_hash_entry hash_algorithms[] = { {"SHA", GNUTLS_MAC_SHA, 20}, {"MD5", GNUTLS_MAC_MD5, 16}, + {"RIPEMD160", GNUTLS_MAC_RMD160, 20}, {"NULL", GNUTLS_MAC_NULL, 0}, {0, 0, 0} }; @@ -313,20 +314,35 @@ typedef struct { #define GNUTLS_DHE_DSS_3DES_EDE_CBC_SHA { 0x00, 0x13 } + /* gnutls private extensions: */ #define GNUTLS_DHE_DSS_TWOFISH_128_CBC_SHA { 0xFF, 0x54 } + +/* draft-ietf-tls-openpgp-keys-04: + */ +#define GNUTLS_DHE_DSS_3DES_EDE_CBC_RMD { 0x00, 0x72 } +#define GNUTLS_DHE_RSA_3DES_EDE_CBC_RMD { 0x00, 0x77 } +#define GNUTLS_DHE_DSS_AES_256_CBC_RMD { 0x00, 0x73 } +#define GNUTLS_DHE_DSS_AES_128_CBC_RMD { 0x00, 0x74 } +#define GNUTLS_DHE_RSA_AES_128_CBC_RMD { 0x00, 0x78 } +#define GNUTLS_DHE_RSA_AES_256_CBC_RMD { 0x00, 0x79 } +#define GNUTLS_RSA_3DES_EDE_CBC_RMD { 0x00, 0x7C } +#define GNUTLS_RSA_AES_128_CBC_RMD { 0x00, 0x7D } +#define GNUTLS_RSA_AES_256_CBC_RMD { 0x00, 0x7E } + + /* draft-ietf-tls-56-bit-ciphersuites-01: */ #define GNUTLS_DHE_DSS_ARCFOUR_SHA { 0x00, 0x66 } + /* rfc3268: */ #define GNUTLS_DHE_DSS_AES_256_CBC_SHA { 0x00, 0x38 } #define GNUTLS_DHE_DSS_AES_128_CBC_SHA { 0x00, 0x32 } - /** DHE RSA **/ #define GNUTLS_DHE_RSA_3DES_EDE_CBC_SHA { 0x00, 0x16 } @@ -411,7 +427,15 @@ static const gnutls_cipher_suite_entry cs_algorithms[] = { GNUTLS_CIPHER_SUITE_ENTRY(GNUTLS_DHE_DSS_AES_256_CBC_SHA, GNUTLS_CIPHER_AES_256_CBC, GNUTLS_KX_DHE_DSS, GNUTLS_MAC_SHA, GNUTLS_SSL3), - + GNUTLS_CIPHER_SUITE_ENTRY(GNUTLS_DHE_DSS_3DES_EDE_CBC_RMD, + GNUTLS_CIPHER_3DES_CBC, GNUTLS_KX_DHE_DSS, + GNUTLS_MAC_RMD160, GNUTLS_TLS1), + GNUTLS_CIPHER_SUITE_ENTRY(GNUTLS_DHE_DSS_AES_128_CBC_RMD, + GNUTLS_CIPHER_AES_128_CBC, GNUTLS_KX_DHE_DSS, + GNUTLS_MAC_RMD160, GNUTLS_TLS1), + GNUTLS_CIPHER_SUITE_ENTRY(GNUTLS_DHE_DSS_AES_256_CBC_RMD, + GNUTLS_CIPHER_AES_256_CBC, GNUTLS_KX_DHE_DSS, + GNUTLS_MAC_RMD160, GNUTLS_TLS1), /* DHE_RSA */ GNUTLS_CIPHER_SUITE_ENTRY(GNUTLS_DHE_RSA_TWOFISH_128_CBC_SHA, GNUTLS_CIPHER_TWOFISH_128_CBC, GNUTLS_KX_DHE_RSA, @@ -425,7 +449,15 @@ static const gnutls_cipher_suite_entry cs_algorithms[] = { GNUTLS_CIPHER_SUITE_ENTRY(GNUTLS_DHE_RSA_AES_256_CBC_SHA, GNUTLS_CIPHER_AES_256_CBC, GNUTLS_KX_DHE_RSA, GNUTLS_MAC_SHA, GNUTLS_SSL3), - + GNUTLS_CIPHER_SUITE_ENTRY(GNUTLS_DHE_RSA_3DES_EDE_CBC_RMD, + GNUTLS_CIPHER_3DES_CBC, GNUTLS_KX_DHE_RSA, + GNUTLS_MAC_RMD160, GNUTLS_TLS1), + GNUTLS_CIPHER_SUITE_ENTRY(GNUTLS_DHE_RSA_AES_128_CBC_RMD, + GNUTLS_CIPHER_AES_128_CBC, GNUTLS_KX_DHE_RSA, + GNUTLS_MAC_RMD160, GNUTLS_TLS1), + GNUTLS_CIPHER_SUITE_ENTRY(GNUTLS_DHE_RSA_AES_256_CBC_RMD, + GNUTLS_CIPHER_AES_256_CBC, GNUTLS_KX_DHE_RSA, + GNUTLS_MAC_RMD160, GNUTLS_TLS1), /* RSA */ GNUTLS_CIPHER_SUITE_ENTRY(GNUTLS_RSA_NULL_MD5, GNUTLS_CIPHER_NULL, @@ -453,7 +485,15 @@ static const gnutls_cipher_suite_entry cs_algorithms[] = { GNUTLS_CIPHER_SUITE_ENTRY(GNUTLS_RSA_TWOFISH_128_CBC_SHA, GNUTLS_CIPHER_TWOFISH_128_CBC, GNUTLS_KX_RSA, GNUTLS_MAC_SHA, GNUTLS_TLS1), - + GNUTLS_CIPHER_SUITE_ENTRY(GNUTLS_RSA_3DES_EDE_CBC_RMD, + GNUTLS_CIPHER_3DES_CBC, + GNUTLS_KX_RSA, GNUTLS_MAC_RMD160, GNUTLS_TLS1), + GNUTLS_CIPHER_SUITE_ENTRY(GNUTLS_RSA_AES_128_CBC_RMD, + GNUTLS_CIPHER_AES_128_CBC, GNUTLS_KX_RSA, + GNUTLS_MAC_RMD160, GNUTLS_TLS1), + GNUTLS_CIPHER_SUITE_ENTRY(GNUTLS_RSA_AES_256_CBC_RMD, + GNUTLS_CIPHER_AES_256_CBC, GNUTLS_KX_RSA, + GNUTLS_MAC_RMD160, GNUTLS_TLS1), {0, {{0,0}}, 0, 0, 0, 0} }; diff --git a/lib/gnutls_hash_int.c b/lib/gnutls_hash_int.c index 4f836108fb..8f3abcaf65 100644 --- a/lib/gnutls_hash_int.c +++ b/lib/gnutls_hash_int.c @@ -30,38 +30,38 @@ GNUTLS_HASH_HANDLE _gnutls_hash_init(gnutls_mac_algorithm algorithm) { - GNUTLS_MAC_HANDLE ret; + GNUTLS_MAC_HANDLE ret = NULL; gcry_error_t result; + ret = gnutls_malloc(sizeof(GNUTLS_MAC_HANDLE_INT)); + if (ret == NULL) { + gnutls_assert(); + return GNUTLS_HASH_FAILED; + } + + ret->algorithm = algorithm; + switch (algorithm) { case GNUTLS_MAC_SHA: - ret = gnutls_malloc(sizeof(GNUTLS_MAC_HANDLE_INT)); - if (ret == NULL) - return GNUTLS_HASH_FAILED; result = gcry_md_open( &ret->handle, GCRY_MD_SHA1, 0); - if (result) { - gnutls_free(ret); - ret = GNUTLS_HASH_FAILED; - } break; - case GNUTLS_MAC_MD5: - ret = gnutls_malloc(sizeof(GNUTLS_MAC_HANDLE_INT)); - if (ret == NULL) - return GNUTLS_HASH_FAILED; result = gcry_md_open( &ret->handle, GCRY_MD_MD5, 0); - if (result) { - gnutls_free(ret); - ret = GNUTLS_HASH_FAILED; - } break; - + case GNUTLS_MAC_RMD160: + result = gcry_md_open( &ret->handle, GCRY_MD_RMD160, 0); + break; default: + gnutls_assert(); + gnutls_free( ret); ret = GNUTLS_HASH_FAILED; break; } - if (ret != GNUTLS_HASH_FAILED) - ret->algorithm = algorithm; + if (result) { + gnutls_assert(); + gnutls_free(ret); + ret = GNUTLS_HASH_FAILED; + } return ret; } @@ -77,6 +77,9 @@ int _gnutls_hash_get_algo_len(gnutls_mac_algorithm algorithm) case GNUTLS_MAC_MD5: ret = gcry_md_get_algo_dlen(GCRY_MD_MD5); break; + case GNUTLS_MAC_RMD160: + ret = gcry_md_get_algo_dlen(GCRY_MD_MD5); + break; default: ret = 0; break; } @@ -140,31 +143,28 @@ GNUTLS_MAC_HANDLE _gnutls_hmac_init(gnutls_mac_algorithm algorithm, GNUTLS_MAC_HANDLE ret; gcry_error_t result; + ret = gnutls_malloc(sizeof(GNUTLS_MAC_HANDLE_INT)); + if (ret == NULL) + return GNUTLS_MAC_FAILED; + switch (algorithm) { case GNUTLS_MAC_SHA: - ret = gnutls_malloc(sizeof(GNUTLS_MAC_HANDLE_INT)); - if (ret == NULL) - return GNUTLS_MAC_FAILED; - result = gcry_md_open(&ret->handle, GCRY_MD_SHA1, GCRY_MD_FLAG_HMAC); - - if (result) - ret = GNUTLS_MAC_FAILED; break; case GNUTLS_MAC_MD5: - ret = gnutls_malloc(sizeof(GNUTLS_MAC_HANDLE_INT)); - if (ret == NULL) - return GNUTLS_MAC_FAILED; - result = gcry_md_open(&ret->handle, GCRY_MD_MD5, GCRY_MD_FLAG_HMAC); - - if (result) - ret = GNUTLS_MAC_FAILED; + break; + case GNUTLS_MAC_RMD160: + result = gcry_md_open(&ret->handle, GCRY_MD_RMD160, GCRY_MD_FLAG_HMAC); break; default: + gnutls_free(ret); ret = GNUTLS_MAC_FAILED; } + if (result) + ret = GNUTLS_MAC_FAILED; + if (ret != GNUTLS_MAC_FAILED) { gcry_md_setkey(ret->handle, key, keylen); @@ -173,8 +173,6 @@ GNUTLS_MAC_HANDLE _gnutls_hmac_init(gnutls_mac_algorithm algorithm, ret->keysize = keylen; } - - return ret; } @@ -210,6 +208,18 @@ void _gnutls_hmac_deinit(GNUTLS_MAC_HANDLE handle, void *digest) gnutls_free(handle); } +inline static int get_padsize( gnutls_mac_algorithm algorithm) +{ + switch (algorithm) { + case GNUTLS_MAC_MD5: + return 48; + case GNUTLS_MAC_SHA: + return 40; + default: + return 0; + } +} + GNUTLS_MAC_HANDLE _gnutls_mac_init_ssl3(gnutls_mac_algorithm algorithm, void *key, int keylen) { @@ -217,19 +227,14 @@ GNUTLS_MAC_HANDLE _gnutls_mac_init_ssl3(gnutls_mac_algorithm algorithm, void *ke char ipad[48]; int padsize; - switch (algorithm) { - case GNUTLS_MAC_MD5: - padsize = 48; - break; - case GNUTLS_MAC_SHA: - padsize = 40; - break; - default: - padsize = 0; - } - if (padsize > 0) { - memset(ipad, 0x36, padsize); + padsize = get_padsize( algorithm); + if (padsize == 0) { + gnutls_assert(); + return GNUTLS_MAC_FAILED; } + + memset(ipad, 0x36, padsize); + ret = _gnutls_hash_init(algorithm); if (ret != GNUTLS_HASH_FAILED) { ret->key = key; @@ -251,20 +256,14 @@ void _gnutls_mac_deinit_ssl3(GNUTLS_MAC_HANDLE handle, void *digest) int padsize; int block; - switch (handle->algorithm) { - case GNUTLS_MAC_MD5: - padsize = 48; - break; - case GNUTLS_MAC_SHA: - padsize = 40; - break; - default: - padsize = 0; - } - if (padsize > 0) { - memset(opad, 0x5C, padsize); + padsize = get_padsize( handle->algorithm); + if (padsize == 0) { + gnutls_assert(); + return; } + memset(opad, 0x5C, padsize); + td = _gnutls_hash_init(handle->algorithm); if (td != GNUTLS_MAC_FAILED) { if (handle->keysize > 0) @@ -290,21 +289,15 @@ void _gnutls_mac_deinit_ssl3_handshake(GNUTLS_MAC_HANDLE handle, int padsize; int block; - switch (handle->algorithm) { - case GNUTLS_MAC_MD5: - padsize = 48; - break; - case GNUTLS_MAC_SHA: - padsize = 40; - break; - default: - padsize = 0; - } - if (padsize > 0) { - memset(opad, 0x5C, padsize); - memset(ipad, 0x36, padsize); + padsize = get_padsize( handle->algorithm); + if (padsize == 0) { + gnutls_assert(); + return; } + memset(opad, 0x5C, padsize); + memset(ipad, 0x36, padsize); + td = _gnutls_hash_init(handle->algorithm); if (td != GNUTLS_HASH_FAILED) { if (key_size > 0) diff --git a/lib/gnutls_int.h b/lib/gnutls_int.h index 729e09ac75..58b8644402 100644 --- a/lib/gnutls_int.h +++ b/lib/gnutls_int.h @@ -175,7 +175,9 @@ typedef enum gnutls_kx_algorithm { GNUTLS_KX_RSA=1, GNUTLS_KX_DHE_DSS, GNUTLS_KX_RSA_EXPORT, GNUTLS_KX_SRP_RSA, GNUTLS_KX_SRP_DSS } gnutls_kx_algorithm; -typedef enum gnutls_mac_algorithm { GNUTLS_MAC_UNKNOWN=0, GNUTLS_MAC_NULL=1, GNUTLS_MAC_MD5, GNUTLS_MAC_SHA } gnutls_mac_algorithm; +typedef enum gnutls_mac_algorithm { GNUTLS_MAC_UNKNOWN=0, GNUTLS_MAC_NULL=1, +GNUTLS_MAC_MD5, GNUTLS_MAC_SHA, GNUTLS_MAC_RMD160 +} gnutls_mac_algorithm; typedef gnutls_mac_algorithm gnutls_digest_algorithm; typedef enum gnutls_compression_method { GNUTLS_COMP_NULL=1, GNUTLS_COMP_ZLIB, diff --git a/lib/gnutls_priority.c b/lib/gnutls_priority.c index c5f8fd3986..ad898bc53d 100644 --- a/lib/gnutls_priority.c +++ b/lib/gnutls_priority.c @@ -222,13 +222,10 @@ int gnutls_certificate_type_set_priority(gnutls_session session, * the appropriate functions. * * The order is TLS1, SSL3 for protocols. - * GNUTLS_KX_RSA, GNUTLS_KX_DHE_DSS, GNUTLS_KX_DHE_RSA for key exchange - * algorithms. - * GNUTLS_MAC_SHA, GNUTLS_MAC_MD5 for MAC algorithms. - * GNUTLS_CIPHER_AES_256_CBC, - * GNUTLS_CIPHER_AES_128_CBC, - * and GNUTLS_CIPHER_3DES_CBC, - * GNUTLS_CIPHER_ARCFOUR_128 for ciphers. + * RSA, DHE_DSS, DHE_RSA for key exchange + * algorithms. SHA, MD5 and RIPEMD160 for MAC algorithms. + * AES_256_CBC, AES_128_CBC, 3DES_CBC, + * and ARCFOUR_128 for ciphers. * **/ int gnutls_set_default_priority(gnutls_session session) @@ -243,7 +240,7 @@ int gnutls_set_default_priority(gnutls_session session) }; static const int comp_priority[] = { GNUTLS_COMP_NULL, 0 }; static const int mac_priority[] = - { GNUTLS_MAC_SHA, GNUTLS_MAC_MD5, 0 }; + { GNUTLS_MAC_SHA, GNUTLS_MAC_MD5, GNUTLS_MAC_RMD160, 0 }; gnutls_cipher_set_priority(session, cipher_priority); gnutls_compression_set_priority(session, comp_priority); @@ -261,12 +258,11 @@ int gnutls_set_default_priority(gnutls_session session) * Sets some default priority on the ciphers, key exchange methods, macs * and compression methods. This is to avoid using the gnutls_*_priority() functions, if * these defaults are ok. This function also includes weak algorithms. - * The order is TLS1, SSL3 for protocols, GNUTLS_KX_DHE_DSS, GNUTLS_KX_RSA, - * GNUTLS_KX_DHE_RSA, GNUTLS_KX_RSA_EXPORT for key exchange algorithms. - * GNUTLS_MAC_SHA, GNUTLS_MAC_MD5 for MAC algorithms, - * GNUTLS_CIPHER_AES_256_CBC, GNUTLS_CIPHER_AES_128_CBC, - * and GNUTLS_CIPHER_3DES_CBC, GNUTLS_CIPHER_ARCFOUR_128, - * GNUTLS_CIPHER_ARCFOUR_40 for ciphers. + * The order is TLS1, SSL3 for protocols, RSA, DHE_DSS, + * DHE_RSA, RSA_EXPORT for key exchange algorithms. + * SHA, MD5, RIPEMD160 for MAC algorithms, + * AES_256_CBC, AES_128_CBC, + * and 3DES_CBC, ARCFOUR_128, ARCFOUR_40 for ciphers. * **/ int gnutls_set_default_export_priority(gnutls_session session) @@ -285,7 +281,7 @@ int gnutls_set_default_export_priority(gnutls_session session) }; static const int comp_priority[] = { GNUTLS_COMP_NULL, 0 }; static const int mac_priority[] = - { GNUTLS_MAC_SHA, GNUTLS_MAC_MD5, 0 }; + { GNUTLS_MAC_SHA, GNUTLS_MAC_MD5, GNUTLS_MAC_RMD160, 0 }; gnutls_cipher_set_priority(session, cipher_priority); gnutls_compression_set_priority(session, comp_priority); diff --git a/lib/x509/common.c b/lib/x509/common.c index ec76e18463..557ab03c1e 100644 --- a/lib/x509/common.c +++ b/lib/x509/common.c @@ -602,7 +602,6 @@ int _gnutls_x509_export_int( ASN1_TYPE asn1_data, *output_data_size = len; if (result == ASN1_MEM_ERROR) { gnutls_assert(); - _gnutls_debug_log("Length required for der coding: %d\n", len); return GNUTLS_E_SHORT_MEMORY_BUFFER; } gnutls_assert(); @@ -626,7 +625,6 @@ int _gnutls_x509_export_int( ASN1_TYPE asn1_data, if ((result=asn1_der_coding( asn1_data, "", tmp, &len, NULL)) != ASN1_SUCCESS) { gnutls_assert(); if (result == ASN1_MEM_ERROR) { - _gnutls_debug_log("Length required for der coding: %d\n", len); *output_data_size = B64FSIZE(strlen(pem_header),len) + 1; } gnutls_afree(tmp); diff --git a/src/cli.c b/src/cli.c index 7bbb141c7d..6a52c2c1fd 100644 --- a/src/cli.c +++ b/src/cli.c @@ -81,11 +81,12 @@ int kx_priority[PRI_MAX] = }; int cipher_priority[PRI_MAX] = { GNUTLS_CIPHER_ARCFOUR_128, GNUTLS_CIPHER_AES_128_CBC, - GNUTLS_CIPHER_3DES_CBC, + GNUTLS_CIPHER_3DES_CBC, GNUTLS_CIPHER_AES_256_CBC, GNUTLS_CIPHER_ARCFOUR_40, 0 }; int comp_priority[PRI_MAX] = { GNUTLS_COMP_ZLIB, GNUTLS_COMP_NULL, 0 }; -int mac_priority[PRI_MAX] = { GNUTLS_MAC_SHA, GNUTLS_MAC_MD5, 0 }; +int mac_priority[PRI_MAX] = + { GNUTLS_MAC_SHA, GNUTLS_MAC_MD5, GNUTLS_MAC_RMD160, 0 }; int cert_type_priority[PRI_MAX] = { GNUTLS_CRT_X509, GNUTLS_CRT_OPENPGP, 0 }; /* end of global stuff */ diff --git a/src/common.c b/src/common.c index 9bf983d795..2dc8e502a7 100644 --- a/src/common.c +++ b/src/common.c @@ -486,6 +486,7 @@ void print_list(void) printf("MACs:"); printf(" MD5"); + printf(", RMD160"); printf(", SHA-1\n"); printf("Key exchange algorithms:"); @@ -571,6 +572,8 @@ void parse_macs(char **macs, int nmacs, int *mac_priority) for (j = i = 0; i < nmacs; i++) { if (strncasecmp(macs[i], "MD5", 3) == 0) mac_priority[j++] = GNUTLS_MAC_MD5; + if (strncasecmp(macs[i], "RMD", 3) == 0) + mac_priority[j++] = GNUTLS_MAC_RMD160; if (strncasecmp(macs[i], "SHA", 3) == 0) mac_priority[j++] = GNUTLS_MAC_SHA; } diff --git a/src/serv.c b/src/serv.c index ec879e8e64..6b9c0c57f0 100644 --- a/src/serv.c +++ b/src/serv.c @@ -259,7 +259,8 @@ int cipher_priority[PRI_MAX] = int comp_priority[PRI_MAX] = { GNUTLS_COMP_ZLIB, GNUTLS_COMP_LZO, GNUTLS_COMP_NULL, 0 }; -int mac_priority[PRI_MAX] = { GNUTLS_MAC_SHA, GNUTLS_MAC_MD5, 0 }; +int mac_priority[PRI_MAX] = + { GNUTLS_MAC_SHA, GNUTLS_MAC_MD5, GNUTLS_MAC_RMD160, 0 }; int cert_type_priority[PRI_MAX] = { GNUTLS_CRT_X509, GNUTLS_CRT_OPENPGP, 0 }; LIST_DECLARE_INIT(listener_list, listener_item, listener_free);