2 * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved.
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
7 * 1. Redistributions of source code must retain the above copyright
8 * notice, this list of conditions and the following disclaimer.
9 * 2. Redistributions in binary form must reproduce the above copyright
10 * notice, this list of conditions and the following disclaimer in the
11 * documentation and/or other materials provided with the distribution.
13 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
14 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
15 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
16 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
17 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
18 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
19 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
20 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
21 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
22 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26 RCSID("$OpenBSD: kex.c,v 1.65 2005/11/04 05:15:59 djm Exp $");
28 #include <openssl/crypto.h>
45 #define KEX_COOKIE_LEN 16
48 static void kex_kexinit_finish(Kex
*);
49 static void kex_choose_conf(Kex
*);
51 /* put algorithm proposal into buffer */
53 kex_prop2buf(Buffer
*b
, char *proposal
[PROPOSAL_MAX
])
59 * add a dummy cookie, the cookie will be overwritten by
60 * kex_send_kexinit(), each time a kexinit is set
62 for (i
= 0; i
< KEX_COOKIE_LEN
; i
++)
63 buffer_put_char(b
, 0);
64 for (i
= 0; i
< PROPOSAL_MAX
; i
++)
65 buffer_put_cstring(b
, proposal
[i
]);
66 buffer_put_char(b
, 0); /* first_kex_packet_follows */
67 buffer_put_int(b
, 0); /* uint32 reserved */
70 /* parse buffer and return algorithm proposal */
72 kex_buf2prop(Buffer
*raw
, int *first_kex_follows
)
78 proposal
= xmalloc(PROPOSAL_MAX
* sizeof(char *));
81 buffer_append(&b
, buffer_ptr(raw
), buffer_len(raw
));
83 for (i
= 0; i
< KEX_COOKIE_LEN
; i
++)
85 /* extract kex init proposal strings */
86 for (i
= 0; i
< PROPOSAL_MAX
; i
++) {
87 proposal
[i
] = buffer_get_string(&b
,NULL
);
88 debug2("kex_parse_kexinit: %s", proposal
[i
]);
90 /* first kex follows / reserved */
91 i
= buffer_get_char(&b
);
92 if (first_kex_follows
!= NULL
)
93 *first_kex_follows
= i
;
94 debug2("kex_parse_kexinit: first_kex_follows %d ", i
);
95 i
= buffer_get_int(&b
);
96 debug2("kex_parse_kexinit: reserved %d ", i
);
102 kex_prop_free(char **proposal
)
106 for (i
= 0; i
< PROPOSAL_MAX
; i
++)
112 kex_protocol_error(int type
, u_int32_t seq
, void *ctxt
)
114 error("Hm, kex protocol error: type %d seq %u", type
, seq
);
118 kex_reset_dispatch(void)
120 dispatch_range(SSH2_MSG_TRANSPORT_MIN
,
121 SSH2_MSG_TRANSPORT_MAX
, &kex_protocol_error
);
122 dispatch_set(SSH2_MSG_KEXINIT
, &kex_input_kexinit
);
128 kex_reset_dispatch();
130 packet_start(SSH2_MSG_NEWKEYS
);
132 /* packet_write_wait(); */
133 debug("SSH2_MSG_NEWKEYS sent");
135 debug("expecting SSH2_MSG_NEWKEYS");
136 packet_read_expect(SSH2_MSG_NEWKEYS
);
138 debug("SSH2_MSG_NEWKEYS received");
141 buffer_clear(&kex
->peer
);
142 /* buffer_clear(&kex->my); */
143 kex
->flags
&= ~KEX_INIT_SENT
;
149 kex_send_kexinit(Kex
*kex
)
156 error("kex_send_kexinit: no kex, cannot rekey");
159 if (kex
->flags
& KEX_INIT_SENT
) {
160 debug("KEX_INIT_SENT");
165 /* generate a random cookie */
166 if (buffer_len(&kex
->my
) < KEX_COOKIE_LEN
)
167 fatal("kex_send_kexinit: kex proposal too short");
168 cookie
= buffer_ptr(&kex
->my
);
169 for (i
= 0; i
< KEX_COOKIE_LEN
; i
++) {
175 packet_start(SSH2_MSG_KEXINIT
);
176 packet_put_raw(buffer_ptr(&kex
->my
), buffer_len(&kex
->my
));
178 debug("SSH2_MSG_KEXINIT sent");
179 kex
->flags
|= KEX_INIT_SENT
;
183 kex_input_kexinit(int type
, u_int32_t seq
, void *ctxt
)
187 Kex
*kex
= (Kex
*)ctxt
;
189 debug("SSH2_MSG_KEXINIT received");
191 fatal("kex_input_kexinit: no kex, cannot rekey");
193 ptr
= packet_get_raw(&dlen
);
194 buffer_append(&kex
->peer
, ptr
, dlen
);
197 for (i
= 0; i
< KEX_COOKIE_LEN
; i
++)
199 for (i
= 0; i
< PROPOSAL_MAX
; i
++)
200 xfree(packet_get_string(NULL
));
201 (void) packet_get_char();
202 (void) packet_get_int();
205 kex_kexinit_finish(kex
);
209 kex_setup(char *proposal
[PROPOSAL_MAX
])
213 kex
= xmalloc(sizeof(*kex
));
214 memset(kex
, 0, sizeof(*kex
));
215 buffer_init(&kex
->peer
);
216 buffer_init(&kex
->my
);
217 kex_prop2buf(&kex
->my
, proposal
);
220 kex_send_kexinit(kex
); /* we start */
221 kex_reset_dispatch();
227 kex_kexinit_finish(Kex
*kex
)
229 if (!(kex
->flags
& KEX_INIT_SENT
))
230 kex_send_kexinit(kex
);
232 kex_choose_conf(kex
);
234 if (kex
->kex_type
>= 0 && kex
->kex_type
< KEX_MAX
&&
235 kex
->kex
[kex
->kex_type
] != NULL
) {
236 (kex
->kex
[kex
->kex_type
])(kex
);
238 fatal("Unsupported key exchange %d", kex
->kex_type
);
243 choose_enc(Enc
*enc
, char *client
, char *server
)
245 char *name
= match_list(client
, server
, NULL
);
247 fatal("no matching cipher found: client %s server %s", client
, server
);
248 if ((enc
->cipher
= cipher_by_name(name
)) == NULL
)
249 fatal("matching cipher is not supported: %s", name
);
254 enc
->key_len
= cipher_keylen(enc
->cipher
);
255 enc
->block_size
= cipher_blocksize(enc
->cipher
);
258 choose_mac(Mac
*mac
, char *client
, char *server
)
260 char *name
= match_list(client
, server
, NULL
);
262 fatal("no matching mac found: client %s server %s", client
, server
);
263 if (mac_init(mac
, name
) < 0)
264 fatal("unsupported mac %s", name
);
265 /* truncate the key */
266 if (datafellows
& SSH_BUG_HMAC
)
273 choose_comp(Comp
*comp
, char *client
, char *server
)
275 char *name
= match_list(client
, server
, NULL
);
277 fatal("no matching comp found: client %s server %s", client
, server
);
278 if (strcmp(name
, "zlib@openssh.com") == 0) {
279 comp
->type
= COMP_DELAYED
;
280 } else if (strcmp(name
, "zlib") == 0) {
281 comp
->type
= COMP_ZLIB
;
282 } else if (strcmp(name
, "none") == 0) {
283 comp
->type
= COMP_NONE
;
285 fatal("unsupported comp %s", name
);
290 choose_kex(Kex
*k
, char *client
, char *server
)
292 k
->name
= match_list(client
, server
, NULL
);
295 if (strcmp(k
->name
, KEX_DH1
) == 0) {
296 k
->kex_type
= KEX_DH_GRP1_SHA1
;
297 k
->evp_md
= EVP_sha1();
298 } else if (strcmp(k
->name
, KEX_DH14
) == 0) {
299 k
->kex_type
= KEX_DH_GRP14_SHA1
;
300 k
->evp_md
= EVP_sha1();
301 } else if (strcmp(k
->name
, KEX_DHGEX_SHA1
) == 0) {
302 k
->kex_type
= KEX_DH_GEX_SHA1
;
303 k
->evp_md
= EVP_sha1();
305 fatal("bad kex alg %s", k
->name
);
309 choose_hostkeyalg(Kex
*k
, char *client
, char *server
)
311 char *hostkeyalg
= match_list(client
, server
, NULL
);
312 if (hostkeyalg
== NULL
)
313 fatal("no hostkey alg");
314 k
->hostkey_type
= key_type_from_name(hostkeyalg
);
315 if (k
->hostkey_type
== KEY_UNSPEC
)
316 fatal("bad hostkey alg '%s'", hostkeyalg
);
321 proposals_match(char *my
[PROPOSAL_MAX
], char *peer
[PROPOSAL_MAX
])
323 static int check
[] = {
324 PROPOSAL_KEX_ALGS
, PROPOSAL_SERVER_HOST_KEY_ALGS
, -1
329 for (idx
= &check
[0]; *idx
!= -1; idx
++) {
330 if ((p
= strchr(my
[*idx
], ',')) != NULL
)
332 if ((p
= strchr(peer
[*idx
], ',')) != NULL
)
334 if (strcmp(my
[*idx
], peer
[*idx
]) != 0) {
335 debug2("proposal mismatch: my %s peer %s",
336 my
[*idx
], peer
[*idx
]);
340 debug2("proposals match");
345 kex_choose_conf(Kex
*kex
)
349 char **cprop
, **sprop
;
350 int nenc
, nmac
, ncomp
;
351 u_int mode
, ctos
, need
;
352 int first_kex_follows
, type
;
354 my
= kex_buf2prop(&kex
->my
, NULL
);
355 peer
= kex_buf2prop(&kex
->peer
, &first_kex_follows
);
365 /* Algorithm Negotiation */
366 for (mode
= 0; mode
< MODE_MAX
; mode
++) {
367 newkeys
= xmalloc(sizeof(*newkeys
));
368 memset(newkeys
, 0, sizeof(*newkeys
));
369 kex
->newkeys
[mode
] = newkeys
;
370 ctos
= (!kex
->server
&& mode
== MODE_OUT
) || (kex
->server
&& mode
== MODE_IN
);
371 nenc
= ctos
? PROPOSAL_ENC_ALGS_CTOS
: PROPOSAL_ENC_ALGS_STOC
;
372 nmac
= ctos
? PROPOSAL_MAC_ALGS_CTOS
: PROPOSAL_MAC_ALGS_STOC
;
373 ncomp
= ctos
? PROPOSAL_COMP_ALGS_CTOS
: PROPOSAL_COMP_ALGS_STOC
;
374 choose_enc (&newkeys
->enc
, cprop
[nenc
], sprop
[nenc
]);
375 choose_mac (&newkeys
->mac
, cprop
[nmac
], sprop
[nmac
]);
376 choose_comp(&newkeys
->comp
, cprop
[ncomp
], sprop
[ncomp
]);
377 debug("kex: %s %s %s %s",
378 ctos
? "client->server" : "server->client",
383 choose_kex(kex
, cprop
[PROPOSAL_KEX_ALGS
], sprop
[PROPOSAL_KEX_ALGS
]);
384 choose_hostkeyalg(kex
, cprop
[PROPOSAL_SERVER_HOST_KEY_ALGS
],
385 sprop
[PROPOSAL_SERVER_HOST_KEY_ALGS
]);
387 for (mode
= 0; mode
< MODE_MAX
; mode
++) {
388 newkeys
= kex
->newkeys
[mode
];
389 if (need
< newkeys
->enc
.key_len
)
390 need
= newkeys
->enc
.key_len
;
391 if (need
< newkeys
->enc
.block_size
)
392 need
= newkeys
->enc
.block_size
;
393 if (need
< newkeys
->mac
.key_len
)
394 need
= newkeys
->mac
.key_len
;
396 /* XXX need runden? */
399 /* ignore the next message if the proposals do not match */
400 if (first_kex_follows
&& !proposals_match(my
, peer
) &&
401 !(datafellows
& SSH_BUG_FIRSTKEX
)) {
402 type
= packet_read();
403 debug2("skipping next packet (type %u)", type
);
411 derive_key(Kex
*kex
, int id
, u_int need
, u_char
*hash
, u_int hashlen
,
412 BIGNUM
*shared_secret
)
421 if ((mdsz
= EVP_MD_size(kex
->evp_md
)) <= 0)
422 fatal("bad kex md size %d", mdsz
);
423 digest
= xmalloc(roundup(need
, mdsz
));
426 buffer_put_bignum2(&b
, shared_secret
);
428 /* K1 = HASH(K || H || "A" || session_id) */
429 EVP_DigestInit(&md
, kex
->evp_md
);
430 if (!(datafellows
& SSH_BUG_DERIVEKEY
))
431 EVP_DigestUpdate(&md
, buffer_ptr(&b
), buffer_len(&b
));
432 EVP_DigestUpdate(&md
, hash
, hashlen
);
433 EVP_DigestUpdate(&md
, &c
, 1);
434 EVP_DigestUpdate(&md
, kex
->session_id
, kex
->session_id_len
);
435 EVP_DigestFinal(&md
, digest
, NULL
);
439 * Kn = HASH(K || H || K1 || K2 || ... || Kn-1)
440 * Key = K1 || K2 || ... || Kn
442 for (have
= mdsz
; need
> have
; have
+= mdsz
) {
443 EVP_DigestInit(&md
, kex
->evp_md
);
444 if (!(datafellows
& SSH_BUG_DERIVEKEY
))
445 EVP_DigestUpdate(&md
, buffer_ptr(&b
), buffer_len(&b
));
446 EVP_DigestUpdate(&md
, hash
, hashlen
);
447 EVP_DigestUpdate(&md
, digest
, have
);
448 EVP_DigestFinal(&md
, digest
+ have
, NULL
);
452 fprintf(stderr
, "key '%c'== ", c
);
453 dump_digest("key", digest
, need
);
458 Newkeys
*current_keys
[MODE_MAX
];
462 kex_derive_keys(Kex
*kex
, u_char
*hash
, u_int hashlen
, BIGNUM
*shared_secret
)
467 for (i
= 0; i
< NKEYS
; i
++) {
468 keys
[i
] = derive_key(kex
, 'A'+i
, kex
->we_need
, hash
, hashlen
,
472 debug2("kex_derive_keys");
473 for (mode
= 0; mode
< MODE_MAX
; mode
++) {
474 current_keys
[mode
] = kex
->newkeys
[mode
];
475 kex
->newkeys
[mode
] = NULL
;
476 ctos
= (!kex
->server
&& mode
== MODE_OUT
) || (kex
->server
&& mode
== MODE_IN
);
477 current_keys
[mode
]->enc
.iv
= keys
[ctos
? 0 : 1];
478 current_keys
[mode
]->enc
.key
= keys
[ctos
? 2 : 3];
479 current_keys
[mode
]->mac
.key
= keys
[ctos
? 4 : 5];
484 kex_get_newkeys(int mode
)
488 ret
= current_keys
[mode
];
489 current_keys
[mode
] = NULL
;
494 derive_ssh1_session_id(BIGNUM
*host_modulus
, BIGNUM
*server_modulus
,
495 u_int8_t cookie
[8], u_int8_t id
[16])
497 const EVP_MD
*evp_md
= EVP_md5();
499 u_int8_t nbuf
[2048], obuf
[EVP_MAX_MD_SIZE
];
502 EVP_DigestInit(&md
, evp_md
);
504 len
= BN_num_bytes(host_modulus
);
505 if (len
< (512 / 8) || (u_int
)len
> sizeof(nbuf
))
506 fatal("%s: bad host modulus (len %d)", __func__
, len
);
507 BN_bn2bin(host_modulus
, nbuf
);
508 EVP_DigestUpdate(&md
, nbuf
, len
);
510 len
= BN_num_bytes(server_modulus
);
511 if (len
< (512 / 8) || (u_int
)len
> sizeof(nbuf
))
512 fatal("%s: bad server modulus (len %d)", __func__
, len
);
513 BN_bn2bin(server_modulus
, nbuf
);
514 EVP_DigestUpdate(&md
, nbuf
, len
);
516 EVP_DigestUpdate(&md
, cookie
, 8);
518 EVP_DigestFinal(&md
, obuf
, NULL
);
519 memcpy(id
, obuf
, 16);
521 memset(nbuf
, 0, sizeof(nbuf
));
522 memset(obuf
, 0, sizeof(obuf
));
523 memset(&md
, 0, sizeof(md
));
526 #if defined(DEBUG_KEX) || defined(DEBUG_KEXDH)
528 dump_digest(char *msg
, u_char
*digest
, int len
)
532 fprintf(stderr
, "%s\n", msg
);
533 for (i
= 0; i
< len
; i
++) {
534 fprintf(stderr
, "%02x", digest
[i
]);
536 fprintf(stderr
, "\n");
538 fprintf(stderr
, " ");
540 fprintf(stderr
, "\n");