freedomofpress/securedrop — pull request #809 by eviljoel (2014-12-17 02:21:04+00:00)
Title: Remove Insecure Ciphers and Suggested Replacements

According to the OpenSSH 6.7 release document (http://www.openssh.com/txt/release-6.7), the CBC ciphers are now considered "unsafe". Thus, I have removed the blowfish-cbc and aes256-cbc ciphers. Newer, secure ciphers are available in the version of OpenSSH that ships with Ubuntu 14.04 and I have suggested you add aes256-gcm@openssh.com and chacha20-poly1305@openssh.com.

More information on chacha20-poly1305 is available here:
https://www.imperialviolet.org/2013/10/07/chacha20.html
https://vikingvpn.com/blogs/security/google-is-pushing-new-cipher-suites-all-about-chacha20-and-poly1305