2 * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved.
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
7 * 1. Redistributions of source code must retain the above copyright
8 * notice, this list of conditions and the following disclaimer.
9 * 2. Redistributions in binary form must reproduce the above copyright
10 * notice, this list of conditions and the following disclaimer in the
11 * documentation and/or other materials provided with the distribution.
13 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
14 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
15 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
16 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
17 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
18 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
19 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
20 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
21 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
22 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26 RCSID("$OpenBSD: kex.c,v 1.56 2003/11/21 11:57:03 djm Exp $");
28 #include <openssl/crypto.h>
45 #define KEX_COOKIE_LEN 16
48 static void kex_kexinit_finish(Kex
*);
49 static void kex_choose_conf(Kex
*);
51 /* put algorithm proposal into buffer */
53 kex_prop2buf(Buffer
*b
, char *proposal
[PROPOSAL_MAX
])
59 * add a dummy cookie, the cookie will be overwritten by
60 * kex_send_kexinit(), each time a kexinit is set
62 for (i
= 0; i
< KEX_COOKIE_LEN
; i
++)
63 buffer_put_char(b
, 0);
64 for (i
= 0; i
< PROPOSAL_MAX
; i
++)
65 buffer_put_cstring(b
, proposal
[i
]);
66 buffer_put_char(b
, 0); /* first_kex_packet_follows */
67 buffer_put_int(b
, 0); /* uint32 reserved */
70 /* parse buffer and return algorithm proposal */
72 kex_buf2prop(Buffer
*raw
, int *first_kex_follows
)
78 proposal
= xmalloc(PROPOSAL_MAX
* sizeof(char *));
81 buffer_append(&b
, buffer_ptr(raw
), buffer_len(raw
));
83 for (i
= 0; i
< KEX_COOKIE_LEN
; i
++)
85 /* extract kex init proposal strings */
86 for (i
= 0; i
< PROPOSAL_MAX
; i
++) {
87 proposal
[i
] = buffer_get_string(&b
,NULL
);
88 debug2("kex_parse_kexinit: %s", proposal
[i
]);
90 /* first kex follows / reserved */
91 i
= buffer_get_char(&b
);
92 if (first_kex_follows
!= NULL
)
93 *first_kex_follows
= i
;
94 debug2("kex_parse_kexinit: first_kex_follows %d ", i
);
95 i
= buffer_get_int(&b
);
96 debug2("kex_parse_kexinit: reserved %d ", i
);
102 kex_prop_free(char **proposal
)
106 for (i
= 0; i
< PROPOSAL_MAX
; i
++)
112 kex_protocol_error(int type
, u_int32_t seq
, void *ctxt
)
114 error("Hm, kex protocol error: type %d seq %u", type
, seq
);
118 kex_reset_dispatch(void)
120 dispatch_range(SSH2_MSG_TRANSPORT_MIN
,
121 SSH2_MSG_TRANSPORT_MAX
, &kex_protocol_error
);
122 dispatch_set(SSH2_MSG_KEXINIT
, &kex_input_kexinit
);
128 kex_reset_dispatch();
130 packet_start(SSH2_MSG_NEWKEYS
);
132 /* packet_write_wait(); */
133 debug("SSH2_MSG_NEWKEYS sent");
135 debug("expecting SSH2_MSG_NEWKEYS");
136 packet_read_expect(SSH2_MSG_NEWKEYS
);
138 debug("SSH2_MSG_NEWKEYS received");
141 buffer_clear(&kex
->peer
);
142 /* buffer_clear(&kex->my); */
143 kex
->flags
&= ~KEX_INIT_SENT
;
149 kex_send_kexinit(Kex
*kex
)
156 error("kex_send_kexinit: no kex, cannot rekey");
159 if (kex
->flags
& KEX_INIT_SENT
) {
160 debug("KEX_INIT_SENT");
165 /* generate a random cookie */
166 if (buffer_len(&kex
->my
) < KEX_COOKIE_LEN
)
167 fatal("kex_send_kexinit: kex proposal too short");
168 cookie
= buffer_ptr(&kex
->my
);
169 for (i
= 0; i
< KEX_COOKIE_LEN
; i
++) {
175 packet_start(SSH2_MSG_KEXINIT
);
176 packet_put_raw(buffer_ptr(&kex
->my
), buffer_len(&kex
->my
));
178 debug("SSH2_MSG_KEXINIT sent");
179 kex
->flags
|= KEX_INIT_SENT
;
183 kex_input_kexinit(int type
, u_int32_t seq
, void *ctxt
)
188 Kex
*kex
= (Kex
*)ctxt
;
190 debug("SSH2_MSG_KEXINIT received");
192 fatal("kex_input_kexinit: no kex, cannot rekey");
194 ptr
= packet_get_raw(&dlen
);
195 buffer_append(&kex
->peer
, ptr
, dlen
);
198 for (i
= 0; i
< KEX_COOKIE_LEN
; i
++)
200 for (i
= 0; i
< PROPOSAL_MAX
; i
++)
201 xfree(packet_get_string(NULL
));
202 (void) packet_get_char();
203 (void) packet_get_int();
206 kex_kexinit_finish(kex
);
210 kex_setup(char *proposal
[PROPOSAL_MAX
])
214 kex
= xmalloc(sizeof(*kex
));
215 memset(kex
, 0, sizeof(*kex
));
216 buffer_init(&kex
->peer
);
217 buffer_init(&kex
->my
);
218 kex_prop2buf(&kex
->my
, proposal
);
221 kex_send_kexinit(kex
); /* we start */
222 kex_reset_dispatch();
228 kex_kexinit_finish(Kex
*kex
)
230 if (!(kex
->flags
& KEX_INIT_SENT
))
231 kex_send_kexinit(kex
);
233 kex_choose_conf(kex
);
235 if (kex
->kex_type
>= 0 && kex
->kex_type
< KEX_MAX
&&
236 kex
->kex
[kex
->kex_type
] != NULL
) {
237 (kex
->kex
[kex
->kex_type
])(kex
);
239 fatal("Unsupported key exchange %d", kex
->kex_type
);
244 choose_enc(Enc
*enc
, char *client
, char *server
)
246 char *name
= match_list(client
, server
, NULL
);
248 fatal("no matching cipher found: client %s server %s", client
, server
);
249 if ((enc
->cipher
= cipher_by_name(name
)) == NULL
)
250 fatal("matching cipher is not supported: %s", name
);
255 enc
->key_len
= cipher_keylen(enc
->cipher
);
256 enc
->block_size
= cipher_blocksize(enc
->cipher
);
259 choose_mac(Mac
*mac
, char *client
, char *server
)
261 char *name
= match_list(client
, server
, NULL
);
263 fatal("no matching mac found: client %s server %s", client
, server
);
264 if (mac_init(mac
, name
) < 0)
265 fatal("unsupported mac %s", name
);
266 /* truncate the key */
267 if (datafellows
& SSH_BUG_HMAC
)
274 choose_comp(Comp
*comp
, char *client
, char *server
)
276 char *name
= match_list(client
, server
, NULL
);
278 fatal("no matching comp found: client %s server %s", client
, server
);
279 if (strcmp(name
, "zlib") == 0) {
281 } else if (strcmp(name
, "none") == 0) {
284 fatal("unsupported comp %s", name
);
289 choose_kex(Kex
*k
, char *client
, char *server
)
291 k
->name
= match_list(client
, server
, NULL
);
294 if (strcmp(k
->name
, KEX_DH1
) == 0) {
295 k
->kex_type
= KEX_DH_GRP1_SHA1
;
296 } else if (strcmp(k
->name
, KEX_DHGEX
) == 0) {
297 k
->kex_type
= KEX_DH_GEX_SHA1
;
299 fatal("bad kex alg %s", k
->name
);
302 choose_hostkeyalg(Kex
*k
, char *client
, char *server
)
304 char *hostkeyalg
= match_list(client
, server
, NULL
);
305 if (hostkeyalg
== NULL
)
306 fatal("no hostkey alg");
307 k
->hostkey_type
= key_type_from_name(hostkeyalg
);
308 if (k
->hostkey_type
== KEY_UNSPEC
)
309 fatal("bad hostkey alg '%s'", hostkeyalg
);
314 proposals_match(char *my
[PROPOSAL_MAX
], char *peer
[PROPOSAL_MAX
])
316 static int check
[] = {
317 PROPOSAL_KEX_ALGS
, PROPOSAL_SERVER_HOST_KEY_ALGS
, -1
322 for (idx
= &check
[0]; *idx
!= -1; idx
++) {
323 if ((p
= strchr(my
[*idx
], ',')) != NULL
)
325 if ((p
= strchr(peer
[*idx
], ',')) != NULL
)
327 if (strcmp(my
[*idx
], peer
[*idx
]) != 0) {
328 debug2("proposal mismatch: my %s peer %s",
329 my
[*idx
], peer
[*idx
]);
333 debug2("proposals match");
338 kex_choose_conf(Kex
*kex
)
342 char **cprop
, **sprop
;
343 int nenc
, nmac
, ncomp
;
345 int ctos
; /* direction: if true client-to-server */
347 int first_kex_follows
, type
;
349 my
= kex_buf2prop(&kex
->my
, NULL
);
350 peer
= kex_buf2prop(&kex
->peer
, &first_kex_follows
);
360 /* Algorithm Negotiation */
361 for (mode
= 0; mode
< MODE_MAX
; mode
++) {
362 newkeys
= xmalloc(sizeof(*newkeys
));
363 memset(newkeys
, 0, sizeof(*newkeys
));
364 kex
->newkeys
[mode
] = newkeys
;
365 ctos
= (!kex
->server
&& mode
== MODE_OUT
) || (kex
->server
&& mode
== MODE_IN
);
366 nenc
= ctos
? PROPOSAL_ENC_ALGS_CTOS
: PROPOSAL_ENC_ALGS_STOC
;
367 nmac
= ctos
? PROPOSAL_MAC_ALGS_CTOS
: PROPOSAL_MAC_ALGS_STOC
;
368 ncomp
= ctos
? PROPOSAL_COMP_ALGS_CTOS
: PROPOSAL_COMP_ALGS_STOC
;
369 choose_enc (&newkeys
->enc
, cprop
[nenc
], sprop
[nenc
]);
370 choose_mac (&newkeys
->mac
, cprop
[nmac
], sprop
[nmac
]);
371 choose_comp(&newkeys
->comp
, cprop
[ncomp
], sprop
[ncomp
]);
372 debug("kex: %s %s %s %s",
373 ctos
? "client->server" : "server->client",
378 choose_kex(kex
, cprop
[PROPOSAL_KEX_ALGS
], sprop
[PROPOSAL_KEX_ALGS
]);
379 choose_hostkeyalg(kex
, cprop
[PROPOSAL_SERVER_HOST_KEY_ALGS
],
380 sprop
[PROPOSAL_SERVER_HOST_KEY_ALGS
]);
382 for (mode
= 0; mode
< MODE_MAX
; mode
++) {
383 newkeys
= kex
->newkeys
[mode
];
384 if (need
< newkeys
->enc
.key_len
)
385 need
= newkeys
->enc
.key_len
;
386 if (need
< newkeys
->enc
.block_size
)
387 need
= newkeys
->enc
.block_size
;
388 if (need
< newkeys
->mac
.key_len
)
389 need
= newkeys
->mac
.key_len
;
391 /* XXX need runden? */
394 /* ignore the next message if the proposals do not match */
395 if (first_kex_follows
&& !proposals_match(my
, peer
) &&
396 !(datafellows
& SSH_BUG_FIRSTKEX
)) {
397 type
= packet_read();
398 debug2("skipping next packet (type %u)", type
);
406 derive_key(Kex
*kex
, int id
, int need
, u_char
*hash
, BIGNUM
*shared_secret
)
409 const EVP_MD
*evp_md
= EVP_sha1();
413 int mdsz
= EVP_MD_size(evp_md
);
414 u_char
*digest
= xmalloc(roundup(need
, mdsz
));
417 buffer_put_bignum2(&b
, shared_secret
);
419 /* K1 = HASH(K || H || "A" || session_id) */
420 EVP_DigestInit(&md
, evp_md
);
421 if (!(datafellows
& SSH_BUG_DERIVEKEY
))
422 EVP_DigestUpdate(&md
, buffer_ptr(&b
), buffer_len(&b
));
423 EVP_DigestUpdate(&md
, hash
, mdsz
);
424 EVP_DigestUpdate(&md
, &c
, 1);
425 EVP_DigestUpdate(&md
, kex
->session_id
, kex
->session_id_len
);
426 EVP_DigestFinal(&md
, digest
, NULL
);
430 * Kn = HASH(K || H || K1 || K2 || ... || Kn-1)
431 * Key = K1 || K2 || ... || Kn
433 for (have
= mdsz
; need
> have
; have
+= mdsz
) {
434 EVP_DigestInit(&md
, evp_md
);
435 if (!(datafellows
& SSH_BUG_DERIVEKEY
))
436 EVP_DigestUpdate(&md
, buffer_ptr(&b
), buffer_len(&b
));
437 EVP_DigestUpdate(&md
, hash
, mdsz
);
438 EVP_DigestUpdate(&md
, digest
, have
);
439 EVP_DigestFinal(&md
, digest
+ have
, NULL
);
443 fprintf(stderr
, "key '%c'== ", c
);
444 dump_digest("key", digest
, need
);
449 Newkeys
*current_keys
[MODE_MAX
];
453 kex_derive_keys(Kex
*kex
, u_char
*hash
, BIGNUM
*shared_secret
)
458 for (i
= 0; i
< NKEYS
; i
++)
459 keys
[i
] = derive_key(kex
, 'A'+i
, kex
->we_need
, hash
, shared_secret
);
461 debug2("kex_derive_keys");
462 for (mode
= 0; mode
< MODE_MAX
; mode
++) {
463 current_keys
[mode
] = kex
->newkeys
[mode
];
464 kex
->newkeys
[mode
] = NULL
;
465 ctos
= (!kex
->server
&& mode
== MODE_OUT
) || (kex
->server
&& mode
== MODE_IN
);
466 current_keys
[mode
]->enc
.iv
= keys
[ctos
? 0 : 1];
467 current_keys
[mode
]->enc
.key
= keys
[ctos
? 2 : 3];
468 current_keys
[mode
]->mac
.key
= keys
[ctos
? 4 : 5];
473 kex_get_newkeys(int mode
)
477 ret
= current_keys
[mode
];
478 current_keys
[mode
] = NULL
;
482 #if defined(DEBUG_KEX) || defined(DEBUG_KEXDH)
484 dump_digest(char *msg
, u_char
*digest
, int len
)
488 fprintf(stderr
, "%s\n", msg
);
489 for (i
= 0; i
< len
; i
++) {
490 fprintf(stderr
, "%02x", digest
[i
]);
492 fprintf(stderr
, "\n");
494 fprintf(stderr
, " ");
496 fprintf(stderr
, "\n");