1 /* $OpenBSD: kex.h,v 1.117 2022/01/06 21:55:23 djm Exp $ */
4 * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved.
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
30 #include "crypto_api.h"
33 # include <openssl/bn.h>
34 # include <openssl/dh.h>
35 # include <openssl/ecdsa.h>
36 # ifdef OPENSSL_HAS_ECC
37 # include <openssl/ec.h>
38 # else /* OPENSSL_HAS_ECC */
40 # define EC_GROUP void
41 # define EC_POINT void
42 # endif /* OPENSSL_HAS_ECC */
43 #else /* WITH_OPENSSL */
47 # define EC_GROUP void
48 # define EC_POINT void
49 #endif /* WITH_OPENSSL */
51 #define KEX_COOKIE_LEN 16
53 #define KEX_DH1 "diffie-hellman-group1-sha1"
54 #define KEX_DH14_SHA1 "diffie-hellman-group14-sha1"
55 #define KEX_DH14_SHA256 "diffie-hellman-group14-sha256"
56 #define KEX_DH16_SHA512 "diffie-hellman-group16-sha512"
57 #define KEX_DH18_SHA512 "diffie-hellman-group18-sha512"
58 #define KEX_DHGEX_SHA1 "diffie-hellman-group-exchange-sha1"
59 #define KEX_DHGEX_SHA256 "diffie-hellman-group-exchange-sha256"
60 #define KEX_ECDH_SHA2_NISTP256 "ecdh-sha2-nistp256"
61 #define KEX_ECDH_SHA2_NISTP384 "ecdh-sha2-nistp384"
62 #define KEX_ECDH_SHA2_NISTP521 "ecdh-sha2-nistp521"
63 #define KEX_CURVE25519_SHA256 "curve25519-sha256"
64 #define KEX_CURVE25519_SHA256_OLD "curve25519-sha256@libssh.org"
65 #define KEX_SNTRUP761X25519_SHA512 "sntrup761x25519-sha512@openssh.com"
68 /* pre-auth compression (COMP_ZLIB) is only supported in the client */
70 #define COMP_DELAYED 2
72 #define CURVE25519_SIZE 32
74 enum kex_init_proposals
{
76 PROPOSAL_SERVER_HOST_KEY_ALGS
,
77 PROPOSAL_ENC_ALGS_CTOS
,
78 PROPOSAL_ENC_ALGS_STOC
,
79 PROPOSAL_MAC_ALGS_CTOS
,
80 PROPOSAL_MAC_ALGS_STOC
,
81 PROPOSAL_COMP_ALGS_CTOS
,
82 PROPOSAL_COMP_ALGS_STOC
,
104 KEX_KEM_SNTRUP761X25519_SHA512
,
109 #define KEX_INIT_SENT 0x0001
110 #define KEX_INITIAL 0x0002
111 #define KEX_HAS_PUBKEY_HOSTBOUND 0x0004
112 #define KEX_RSA_SHA2_256_SUPPORTED 0x0008 /* only set in server for now */
113 #define KEX_RSA_SHA2_512_SUPPORTED 0x0010 /* only set in server for now */
117 const struct sshcipher
*cipher
;
140 struct newkeys
*newkeys
[MODE_MAX
];
149 char *server_sig_algs
;
153 struct sshbuf
*client_version
;
154 struct sshbuf
*server_version
;
155 struct sshbuf
*session_id
;
156 struct sshbuf
*initial_sig
;
157 struct sshkey
*initial_hostkey
;
163 int (*verify_host_key
)(struct sshkey
*, struct ssh
*);
164 struct sshkey
*(*load_host_public_key
)(int, int, struct ssh
*);
165 struct sshkey
*(*load_host_private_key
)(int, int, struct ssh
*);
166 int (*host_key_index
)(struct sshkey
*, int, struct ssh
*);
167 int (*sign
)(struct ssh
*, struct sshkey
*, struct sshkey
*,
168 u_char
**, size_t *, const u_char
*, size_t, const char *);
169 int (*kex
[KEX_MAX
])(struct ssh
*);
170 /* kex specific state */
172 u_int min
, max
, nbits
; /* GEX */
173 EC_KEY
*ec_client_key
; /* ECDH */
174 const EC_GROUP
*ec_group
; /* ECDH */
175 u_char c25519_client_key
[CURVE25519_SIZE
]; /* 25519 + KEM */
176 u_char c25519_client_pubkey
[CURVE25519_SIZE
]; /* 25519 */
177 u_char sntrup761_client_key
[crypto_kem_sntrup761_SECRETKEYBYTES
]; /* KEM */
178 struct sshbuf
*client_pub
;
181 int kex_names_valid(const char *);
182 char *kex_alg_list(char);
183 char *kex_names_cat(const char *, const char *);
184 int kex_assemble_names(char **, const char *, const char *);
186 int kex_exchange_identification(struct ssh
*, int, const char *);
188 struct kex
*kex_new(void);
189 int kex_ready(struct ssh
*, char *[PROPOSAL_MAX
]);
190 int kex_setup(struct ssh
*, char *[PROPOSAL_MAX
]);
191 void kex_free_newkeys(struct newkeys
*);
192 void kex_free(struct kex
*);
194 int kex_buf2prop(struct sshbuf
*, int *, char ***);
195 int kex_prop2buf(struct sshbuf
*, char *proposal
[PROPOSAL_MAX
]);
196 void kex_prop_free(char **);
197 int kex_load_hostkey(struct ssh
*, struct sshkey
**, struct sshkey
**);
198 int kex_verify_host_key(struct ssh
*, struct sshkey
*);
200 int kex_send_kexinit(struct ssh
*);
201 int kex_input_kexinit(int, u_int32_t
, struct ssh
*);
202 int kex_input_ext_info(int, u_int32_t
, struct ssh
*);
203 int kex_protocol_error(int, u_int32_t
, struct ssh
*);
204 int kex_derive_keys(struct ssh
*, u_char
*, u_int
, const struct sshbuf
*);
205 int kex_send_newkeys(struct ssh
*);
206 int kex_start_rekex(struct ssh
*);
208 int kexgex_client(struct ssh
*);
209 int kexgex_server(struct ssh
*);
210 int kex_gen_client(struct ssh
*);
211 int kex_gen_server(struct ssh
*);
213 int kex_dh_keypair(struct kex
*);
214 int kex_dh_enc(struct kex
*, const struct sshbuf
*, struct sshbuf
**,
216 int kex_dh_dec(struct kex
*, const struct sshbuf
*, struct sshbuf
**);
218 int kex_ecdh_keypair(struct kex
*);
219 int kex_ecdh_enc(struct kex
*, const struct sshbuf
*, struct sshbuf
**,
221 int kex_ecdh_dec(struct kex
*, const struct sshbuf
*, struct sshbuf
**);
223 int kex_c25519_keypair(struct kex
*);
224 int kex_c25519_enc(struct kex
*, const struct sshbuf
*, struct sshbuf
**,
226 int kex_c25519_dec(struct kex
*, const struct sshbuf
*, struct sshbuf
**);
228 int kex_kem_sntrup761x25519_keypair(struct kex
*);
229 int kex_kem_sntrup761x25519_enc(struct kex
*, const struct sshbuf
*,
230 struct sshbuf
**, struct sshbuf
**);
231 int kex_kem_sntrup761x25519_dec(struct kex
*, const struct sshbuf
*,
234 int kex_dh_keygen(struct kex
*);
235 int kex_dh_compute_key(struct kex
*, BIGNUM
*, struct sshbuf
*);
237 int kexgex_hash(int, const struct sshbuf
*, const struct sshbuf
*,
238 const struct sshbuf
*, const struct sshbuf
*, const struct sshbuf
*,
240 const BIGNUM
*, const BIGNUM
*, const BIGNUM
*,
241 const BIGNUM
*, const u_char
*, size_t,
244 void kexc25519_keygen(u_char key
[CURVE25519_SIZE
], u_char pub
[CURVE25519_SIZE
])
245 __attribute__((__bounded__(__minbytes__
, 1, CURVE25519_SIZE
)))
246 __attribute__((__bounded__(__minbytes__
, 2, CURVE25519_SIZE
)));
247 int kexc25519_shared_key(const u_char key
[CURVE25519_SIZE
],
248 const u_char pub
[CURVE25519_SIZE
], struct sshbuf
*out
)
249 __attribute__((__bounded__(__minbytes__
, 1, CURVE25519_SIZE
)))
250 __attribute__((__bounded__(__minbytes__
, 2, CURVE25519_SIZE
)));
251 int kexc25519_shared_key_ext(const u_char key
[CURVE25519_SIZE
],
252 const u_char pub
[CURVE25519_SIZE
], struct sshbuf
*out
, int)
253 __attribute__((__bounded__(__minbytes__
, 1, CURVE25519_SIZE
)))
254 __attribute__((__bounded__(__minbytes__
, 2, CURVE25519_SIZE
)));
256 #if defined(DEBUG_KEX) || defined(DEBUG_KEXDH) || defined(DEBUG_KEXECDH)
257 void dump_digest(const char *, const u_char
*, int);
260 #if !defined(WITH_OPENSSL) || !defined(OPENSSL_HAS_ECC)