kex: disable des-cbc-ssh1 by default

Reviewed-by: Andreas Schneider <asn@cryptomilk.org>

src/kex.c

@@ -40,7 +40,8 @@
 #ifdef HAVE_LIBGCRYPT
 # define BLOWFISH "blowfish-cbc,"
 # define AES "aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,"
-# define DES "3des-cbc,des-cbc-ssh1"
+# define DES "3des-cbc"
+# define DES_SUPPORTED "3des-cbc,des-cbc-ssh1"
 #elif defined(HAVE_LIBCRYPTO)
 # ifdef HAVE_OPENSSL_BLOWFISH_H
 #  define BLOWFISH "blowfish-cbc,"
@@ -56,7 +57,8 @@
 # else
 #  define AES ""
 #  endif
-# define DES "3des-cbc,des-cbc-ssh1"
+# define DES "3des-cbc"
+# define DES_SUPPORTED "3des-cbc,des-cbc-ssh1"
 #endif
 
 #ifdef WITH_ZLIB
@@ -101,8 +103,8 @@ static const char *default_methods[] = {
 static const char *supported_methods[] = {
   KEY_EXCHANGE,
   HOSTKEYS,
-  AES BLOWFISH DES,
+  AES BLOWFISH DES_SUPPORTED,
-  AES BLOWFISH DES,
+  AES BLOWFISH DES_SUPPORTED,
   "hmac-sha1,hmac-sha2-256,hmac-sha2-512",
   "hmac-sha1,hmac-sha2-256,hmac-sha2-512",
   ZLIB,