blob: 113663598eff617c8ce57734363ff0badb442efa [file] [log] [blame]
Damien Millera664e872000-04-16 11:52:47 +10001/*
Ben Lindstrom44697232001-07-04 03:32:30 +00002 * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved.
Damien Millera664e872000-04-16 11:52:47 +10003 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
6 * are met:
7 * 1. Redistributions of source code must retain the above copyright
8 * notice, this list of conditions and the following disclaimer.
9 * 2. Redistributions in binary form must reproduce the above copyright
10 * notice, this list of conditions and the following disclaimer in the
11 * documentation and/or other materials provided with the distribution.
Damien Millera664e872000-04-16 11:52:47 +100012 *
13 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
14 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
15 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
16 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
17 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
18 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
19 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
20 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
21 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
22 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
23 */
24
25#include "includes.h"
Ben Lindstrom064496f2002-12-23 02:04:22 +000026RCSID("$OpenBSD: kex.c,v 1.52 2002/11/21 22:45:31 markus Exp $");
Damien Millera664e872000-04-16 11:52:47 +100027
28#include <openssl/crypto.h>
Damien Millera664e872000-04-16 11:52:47 +100029
Ben Lindstrom226cfa02001-01-22 05:34:40 +000030#include "ssh2.h"
31#include "xmalloc.h"
32#include "buffer.h"
33#include "bufaux.h"
34#include "packet.h"
35#include "compat.h"
36#include "cipher.h"
Damien Millera664e872000-04-16 11:52:47 +100037#include "kex.h"
Damien Miller0bc1bd82000-11-13 22:57:25 +110038#include "key.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000039#include "log.h"
Ben Lindstrom06b33aa2001-02-15 03:01:59 +000040#include "mac.h"
Ben Lindstromb9be60a2001-03-11 01:49:19 +000041#include "match.h"
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000042#include "dispatch.h"
Ben Lindstrom7a2073c2002-03-22 02:30:41 +000043#include "monitor.h"
Damien Millera664e872000-04-16 11:52:47 +100044
Damien Millerb1715dc2000-05-30 13:44:51 +100045#define KEX_COOKIE_LEN 16
46
Ben Lindstrom7a2073c2002-03-22 02:30:41 +000047/* Use privilege separation for sshd */
48int use_privsep;
Ben Lindstrom7339b2a2002-05-15 16:25:01 +000049struct monitor *pmonitor;
Ben Lindstrom7a2073c2002-03-22 02:30:41 +000050
51
Ben Lindstrombba81212001-06-25 05:01:22 +000052/* prototype */
53static void kex_kexinit_finish(Kex *);
54static void kex_choose_conf(Kex *);
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000055
56/* put algorithm proposal into buffer */
Ben Lindstrombba81212001-06-25 05:01:22 +000057static void
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000058kex_prop2buf(Buffer *b, char *proposal[PROPOSAL_MAX])
Damien Millera664e872000-04-16 11:52:47 +100059{
Damien Millera664e872000-04-16 11:52:47 +100060 int i;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000061
62 buffer_clear(b);
Ben Lindstrom59971722002-03-27 17:42:57 +000063 /*
64 * add a dummy cookie, the cookie will be overwritten by
65 * kex_send_kexinit(), each time a kexinit is set
66 */
67 for (i = 0; i < KEX_COOKIE_LEN; i++)
68 buffer_put_char(b, 0);
Damien Millera664e872000-04-16 11:52:47 +100069 for (i = 0; i < PROPOSAL_MAX; i++)
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000070 buffer_put_cstring(b, proposal[i]);
71 buffer_put_char(b, 0); /* first_kex_packet_follows */
72 buffer_put_int(b, 0); /* uint32 reserved */
Damien Millera664e872000-04-16 11:52:47 +100073}
74
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000075/* parse buffer and return algorithm proposal */
Ben Lindstrombba81212001-06-25 05:01:22 +000076static char **
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000077kex_buf2prop(Buffer *raw)
Damien Millerb1715dc2000-05-30 13:44:51 +100078{
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000079 Buffer b;
Damien Millerb1715dc2000-05-30 13:44:51 +100080 int i;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000081 char **proposal;
Damien Millerb1715dc2000-05-30 13:44:51 +100082
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000083 proposal = xmalloc(PROPOSAL_MAX * sizeof(char *));
Damien Millerb1715dc2000-05-30 13:44:51 +100084
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000085 buffer_init(&b);
86 buffer_append(&b, buffer_ptr(raw), buffer_len(raw));
Damien Millerb1715dc2000-05-30 13:44:51 +100087 /* skip cookie */
88 for (i = 0; i < KEX_COOKIE_LEN; i++)
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000089 buffer_get_char(&b);
Damien Millerb1715dc2000-05-30 13:44:51 +100090 /* extract kex init proposal strings */
91 for (i = 0; i < PROPOSAL_MAX; i++) {
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000092 proposal[i] = buffer_get_string(&b,NULL);
93 debug2("kex_parse_kexinit: %s", proposal[i]);
Damien Millerb1715dc2000-05-30 13:44:51 +100094 }
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000095 /* first kex follows / reserved */
96 i = buffer_get_char(&b);
97 debug2("kex_parse_kexinit: first_kex_follows %d ", i);
98 i = buffer_get_int(&b);
99 debug2("kex_parse_kexinit: reserved %d ", i);
100 buffer_free(&b);
101 return proposal;
Damien Millerb1715dc2000-05-30 13:44:51 +1000102}
103
Ben Lindstrombba81212001-06-25 05:01:22 +0000104static void
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000105kex_prop_free(char **proposal)
Damien Millera664e872000-04-16 11:52:47 +1000106{
107 int i;
Damien Millera664e872000-04-16 11:52:47 +1000108
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000109 for (i = 0; i < PROPOSAL_MAX; i++)
110 xfree(proposal[i]);
111 xfree(proposal);
Damien Millera664e872000-04-16 11:52:47 +1000112}
113
Ben Lindstrombba81212001-06-25 05:01:22 +0000114static void
Damien Miller630d6f42002-01-22 23:17:30 +1100115kex_protocol_error(int type, u_int32_t seq, void *ctxt)
Damien Miller874d77b2000-10-14 16:23:11 +1100116{
Damien Miller630d6f42002-01-22 23:17:30 +1100117 error("Hm, kex protocol error: type %d seq %u", type, seq);
Damien Miller874d77b2000-10-14 16:23:11 +1100118}
119
Ben Lindstrombba81212001-06-25 05:01:22 +0000120static void
Damien Millerbc27d4e2002-02-13 13:54:06 +1100121kex_reset_dispatch(void)
Ben Lindstrom8ac91062001-04-04 17:57:54 +0000122{
Damien Miller7d053392002-01-22 23:24:13 +1100123 dispatch_range(SSH2_MSG_TRANSPORT_MIN,
124 SSH2_MSG_TRANSPORT_MAX, &kex_protocol_error);
Damien Millerbc27d4e2002-02-13 13:54:06 +1100125 dispatch_set(SSH2_MSG_KEXINIT, &kex_input_kexinit);
Ben Lindstrom8ac91062001-04-04 17:57:54 +0000126}
127
128void
Ben Lindstrom238abf62001-04-04 17:52:53 +0000129kex_finish(Kex *kex)
Damien Millera664e872000-04-16 11:52:47 +1000130{
Damien Millerbc27d4e2002-02-13 13:54:06 +1100131 kex_reset_dispatch();
Ben Lindstrom238abf62001-04-04 17:52:53 +0000132
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000133 packet_start(SSH2_MSG_NEWKEYS);
134 packet_send();
135 /* packet_write_wait(); */
136 debug("SSH2_MSG_NEWKEYS sent");
Damien Millera664e872000-04-16 11:52:47 +1000137
Ben Lindstrom064496f2002-12-23 02:04:22 +0000138 debug("expecting SSH2_MSG_NEWKEYS");
Damien Millerdff50992002-01-22 23:16:32 +1100139 packet_read_expect(SSH2_MSG_NEWKEYS);
Ben Lindstrom14519082002-02-26 17:58:29 +0000140 packet_check_eom();
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000141 debug("SSH2_MSG_NEWKEYS received");
Ben Lindstrom5ba23b32001-04-05 02:05:21 +0000142
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000143 kex->done = 1;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000144 buffer_clear(&kex->peer);
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000145 /* buffer_clear(&kex->my); */
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000146 kex->flags &= ~KEX_INIT_SENT;
Ben Lindstrom5ba23b32001-04-05 02:05:21 +0000147 xfree(kex->name);
148 kex->name = NULL;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000149}
Damien Millera664e872000-04-16 11:52:47 +1000150
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000151void
152kex_send_kexinit(Kex *kex)
153{
Ben Lindstrom59971722002-03-27 17:42:57 +0000154 u_int32_t rand = 0;
155 u_char *cookie;
156 int i;
157
Ben Lindstrom8ac91062001-04-04 17:57:54 +0000158 if (kex == NULL) {
159 error("kex_send_kexinit: no kex, cannot rekey");
160 return;
161 }
Ben Lindstrom238abf62001-04-04 17:52:53 +0000162 if (kex->flags & KEX_INIT_SENT) {
163 debug("KEX_INIT_SENT");
164 return;
165 }
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000166 kex->done = 0;
Ben Lindstrom59971722002-03-27 17:42:57 +0000167
168 /* generate a random cookie */
169 if (buffer_len(&kex->my) < KEX_COOKIE_LEN)
170 fatal("kex_send_kexinit: kex proposal too short");
171 cookie = buffer_ptr(&kex->my);
172 for (i = 0; i < KEX_COOKIE_LEN; i++) {
173 if (i % 4 == 0)
174 rand = arc4random();
175 cookie[i] = rand;
176 rand >>= 8;
177 }
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000178 packet_start(SSH2_MSG_KEXINIT);
179 packet_put_raw(buffer_ptr(&kex->my), buffer_len(&kex->my));
180 packet_send();
181 debug("SSH2_MSG_KEXINIT sent");
182 kex->flags |= KEX_INIT_SENT;
183}
184
185void
Damien Miller630d6f42002-01-22 23:17:30 +1100186kex_input_kexinit(int type, u_int32_t seq, void *ctxt)
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000187{
188 char *ptr;
189 int dlen;
Ben Lindstrom8e312f32001-04-04 23:50:21 +0000190 int i;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000191 Kex *kex = (Kex *)ctxt;
192
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000193 debug("SSH2_MSG_KEXINIT received");
Ben Lindstrom8ac91062001-04-04 17:57:54 +0000194 if (kex == NULL)
195 fatal("kex_input_kexinit: no kex, cannot rekey");
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000196
197 ptr = packet_get_raw(&dlen);
198 buffer_append(&kex->peer, ptr, dlen);
199
Ben Lindstrom8e312f32001-04-04 23:50:21 +0000200 /* discard packet */
201 for (i = 0; i < KEX_COOKIE_LEN; i++)
202 packet_get_char();
203 for (i = 0; i < PROPOSAL_MAX; i++)
204 xfree(packet_get_string(NULL));
Ben Lindstromc5a7f4f2002-06-25 23:19:13 +0000205 (void) packet_get_char();
206 (void) packet_get_int();
Damien Miller48b03fc2002-01-22 23:11:40 +1100207 packet_check_eom();
Ben Lindstrom8e312f32001-04-04 23:50:21 +0000208
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000209 kex_kexinit_finish(kex);
210}
211
212Kex *
Ben Lindstrom238abf62001-04-04 17:52:53 +0000213kex_setup(char *proposal[PROPOSAL_MAX])
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000214{
215 Kex *kex;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000216
217 kex = xmalloc(sizeof(*kex));
218 memset(kex, 0, sizeof(*kex));
219 buffer_init(&kex->peer);
220 buffer_init(&kex->my);
221 kex_prop2buf(&kex->my, proposal);
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000222 kex->done = 0;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000223
224 kex_send_kexinit(kex); /* we start */
Damien Millerbc27d4e2002-02-13 13:54:06 +1100225 kex_reset_dispatch();
Ben Lindstrom8ac91062001-04-04 17:57:54 +0000226
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000227 return kex;
228}
229
Ben Lindstrombba81212001-06-25 05:01:22 +0000230static void
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000231kex_kexinit_finish(Kex *kex)
232{
233 if (!(kex->flags & KEX_INIT_SENT))
234 kex_send_kexinit(kex);
235
236 kex_choose_conf(kex);
237
Ben Lindstrom1c37c6a2001-12-06 18:00:18 +0000238 switch (kex->kex_type) {
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000239 case DH_GRP1_SHA1:
240 kexdh(kex);
241 break;
242 case DH_GEX_SHA1:
243 kexgex(kex);
244 break;
245 default:
246 fatal("Unsupported key exchange %d", kex->kex_type);
Damien Millera664e872000-04-16 11:52:47 +1000247 }
Damien Millera664e872000-04-16 11:52:47 +1000248}
249
Ben Lindstrombba81212001-06-25 05:01:22 +0000250static void
Damien Millera664e872000-04-16 11:52:47 +1000251choose_enc(Enc *enc, char *client, char *server)
252{
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000253 char *name = match_list(client, server, NULL);
Damien Millera664e872000-04-16 11:52:47 +1000254 if (name == NULL)
255 fatal("no matching cipher found: client %s server %s", client, server);
Damien Miller963f6b22002-02-19 15:21:23 +1100256 if ((enc->cipher = cipher_by_name(name)) == NULL)
Damien Miller874d77b2000-10-14 16:23:11 +1100257 fatal("matching cipher is not supported: %s", name);
Damien Millera664e872000-04-16 11:52:47 +1000258 enc->name = name;
259 enc->enabled = 0;
260 enc->iv = NULL;
261 enc->key = NULL;
Damien Miller963f6b22002-02-19 15:21:23 +1100262 enc->key_len = cipher_keylen(enc->cipher);
263 enc->block_size = cipher_blocksize(enc->cipher);
Damien Millera664e872000-04-16 11:52:47 +1000264}
Ben Lindstrombba81212001-06-25 05:01:22 +0000265static void
Damien Millera664e872000-04-16 11:52:47 +1000266choose_mac(Mac *mac, char *client, char *server)
267{
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000268 char *name = match_list(client, server, NULL);
Damien Millera664e872000-04-16 11:52:47 +1000269 if (name == NULL)
270 fatal("no matching mac found: client %s server %s", client, server);
Ben Lindstrom06b33aa2001-02-15 03:01:59 +0000271 if (mac_init(mac, name) < 0)
Damien Millera664e872000-04-16 11:52:47 +1000272 fatal("unsupported mac %s", name);
Ben Lindstrom06b33aa2001-02-15 03:01:59 +0000273 /* truncate the key */
274 if (datafellows & SSH_BUG_HMAC)
275 mac->key_len = 16;
Damien Millera664e872000-04-16 11:52:47 +1000276 mac->name = name;
Damien Millera664e872000-04-16 11:52:47 +1000277 mac->key = NULL;
278 mac->enabled = 0;
279}
Ben Lindstrombba81212001-06-25 05:01:22 +0000280static void
Damien Millera664e872000-04-16 11:52:47 +1000281choose_comp(Comp *comp, char *client, char *server)
282{
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000283 char *name = match_list(client, server, NULL);
Damien Millera664e872000-04-16 11:52:47 +1000284 if (name == NULL)
285 fatal("no matching comp found: client %s server %s", client, server);
286 if (strcmp(name, "zlib") == 0) {
287 comp->type = 1;
288 } else if (strcmp(name, "none") == 0) {
289 comp->type = 0;
290 } else {
291 fatal("unsupported comp %s", name);
292 }
293 comp->name = name;
294}
Ben Lindstrombba81212001-06-25 05:01:22 +0000295static void
Damien Millera664e872000-04-16 11:52:47 +1000296choose_kex(Kex *k, char *client, char *server)
297{
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000298 k->name = match_list(client, server, NULL);
Damien Millera664e872000-04-16 11:52:47 +1000299 if (k->name == NULL)
300 fatal("no kex alg");
Damien Miller874d77b2000-10-14 16:23:11 +1100301 if (strcmp(k->name, KEX_DH1) == 0) {
302 k->kex_type = DH_GRP1_SHA1;
303 } else if (strcmp(k->name, KEX_DHGEX) == 0) {
304 k->kex_type = DH_GEX_SHA1;
305 } else
Damien Millera664e872000-04-16 11:52:47 +1000306 fatal("bad kex alg %s", k->name);
307}
Ben Lindstrombba81212001-06-25 05:01:22 +0000308static void
Damien Millera664e872000-04-16 11:52:47 +1000309choose_hostkeyalg(Kex *k, char *client, char *server)
310{
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000311 char *hostkeyalg = match_list(client, server, NULL);
Damien Miller0bc1bd82000-11-13 22:57:25 +1100312 if (hostkeyalg == NULL)
Damien Millera664e872000-04-16 11:52:47 +1000313 fatal("no hostkey alg");
Damien Miller0bc1bd82000-11-13 22:57:25 +1100314 k->hostkey_type = key_type_from_name(hostkeyalg);
315 if (k->hostkey_type == KEY_UNSPEC)
316 fatal("bad hostkey alg '%s'", hostkeyalg);
Ben Lindstrom48bd7c12001-01-09 00:35:42 +0000317 xfree(hostkeyalg);
Damien Millera664e872000-04-16 11:52:47 +1000318}
319
Ben Lindstrombba81212001-06-25 05:01:22 +0000320static void
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000321kex_choose_conf(Kex *kex)
Damien Millera664e872000-04-16 11:52:47 +1000322{
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000323 Newkeys *newkeys;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000324 char **my, **peer;
325 char **cprop, **sprop;
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000326 int nenc, nmac, ncomp;
Damien Millera664e872000-04-16 11:52:47 +1000327 int mode;
328 int ctos; /* direction: if true client-to-server */
329 int need;
Damien Millera664e872000-04-16 11:52:47 +1000330
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000331 my = kex_buf2prop(&kex->my);
332 peer = kex_buf2prop(&kex->peer);
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000333
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000334 if (kex->server) {
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000335 cprop=peer;
336 sprop=my;
337 } else {
338 cprop=my;
339 sprop=peer;
340 }
Damien Millera664e872000-04-16 11:52:47 +1000341
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000342 /* Algorithm Negotiation */
Damien Millera664e872000-04-16 11:52:47 +1000343 for (mode = 0; mode < MODE_MAX; mode++) {
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000344 newkeys = xmalloc(sizeof(*newkeys));
345 memset(newkeys, 0, sizeof(*newkeys));
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000346 kex->newkeys[mode] = newkeys;
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000347 ctos = (!kex->server && mode == MODE_OUT) || (kex->server && mode == MODE_IN);
Damien Millera664e872000-04-16 11:52:47 +1000348 nenc = ctos ? PROPOSAL_ENC_ALGS_CTOS : PROPOSAL_ENC_ALGS_STOC;
349 nmac = ctos ? PROPOSAL_MAC_ALGS_CTOS : PROPOSAL_MAC_ALGS_STOC;
350 ncomp = ctos ? PROPOSAL_COMP_ALGS_CTOS : PROPOSAL_COMP_ALGS_STOC;
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000351 choose_enc (&newkeys->enc, cprop[nenc], sprop[nenc]);
352 choose_mac (&newkeys->mac, cprop[nmac], sprop[nmac]);
353 choose_comp(&newkeys->comp, cprop[ncomp], sprop[ncomp]);
Damien Millera664e872000-04-16 11:52:47 +1000354 debug("kex: %s %s %s %s",
355 ctos ? "client->server" : "server->client",
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000356 newkeys->enc.name,
357 newkeys->mac.name,
358 newkeys->comp.name);
Damien Millera664e872000-04-16 11:52:47 +1000359 }
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000360 choose_kex(kex, cprop[PROPOSAL_KEX_ALGS], sprop[PROPOSAL_KEX_ALGS]);
361 choose_hostkeyalg(kex, cprop[PROPOSAL_SERVER_HOST_KEY_ALGS],
Damien Millera664e872000-04-16 11:52:47 +1000362 sprop[PROPOSAL_SERVER_HOST_KEY_ALGS]);
Damien Millera664e872000-04-16 11:52:47 +1000363 need = 0;
364 for (mode = 0; mode < MODE_MAX; mode++) {
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000365 newkeys = kex->newkeys[mode];
Damien Miller963f6b22002-02-19 15:21:23 +1100366 if (need < newkeys->enc.key_len)
367 need = newkeys->enc.key_len;
368 if (need < newkeys->enc.block_size)
369 need = newkeys->enc.block_size;
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000370 if (need < newkeys->mac.key_len)
371 need = newkeys->mac.key_len;
Damien Millera664e872000-04-16 11:52:47 +1000372 }
Damien Millerb1715dc2000-05-30 13:44:51 +1000373 /* XXX need runden? */
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000374 kex->we_need = need;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000375
376 kex_prop_free(my);
377 kex_prop_free(peer);
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000378}
379
Ben Lindstrombba81212001-06-25 05:01:22 +0000380static u_char *
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000381derive_key(Kex *kex, int id, int need, u_char *hash, BIGNUM *shared_secret)
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000382{
383 Buffer b;
Ben Lindstrom80cb27d2002-03-05 01:33:36 +0000384 const EVP_MD *evp_md = EVP_sha1();
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000385 EVP_MD_CTX md;
386 char c = id;
387 int have;
Damien Miller3672e4b2002-02-05 11:54:07 +1100388 int mdsz = EVP_MD_size(evp_md);
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000389 u_char *digest = xmalloc(roundup(need, mdsz));
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000390
391 buffer_init(&b);
392 buffer_put_bignum2(&b, shared_secret);
393
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000394 /* K1 = HASH(K || H || "A" || session_id) */
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000395 EVP_DigestInit(&md, evp_md);
Ben Lindstrom8c963922001-04-30 23:06:57 +0000396 if (!(datafellows & SSH_BUG_DERIVEKEY))
397 EVP_DigestUpdate(&md, buffer_ptr(&b), buffer_len(&b));
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000398 EVP_DigestUpdate(&md, hash, mdsz);
399 EVP_DigestUpdate(&md, &c, 1);
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000400 EVP_DigestUpdate(&md, kex->session_id, kex->session_id_len);
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000401 EVP_DigestFinal(&md, digest, NULL);
402
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000403 /*
404 * expand key:
405 * Kn = HASH(K || H || K1 || K2 || ... || Kn-1)
406 * Key = K1 || K2 || ... || Kn
407 */
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000408 for (have = mdsz; need > have; have += mdsz) {
409 EVP_DigestInit(&md, evp_md);
Ben Lindstrom8c963922001-04-30 23:06:57 +0000410 if (!(datafellows & SSH_BUG_DERIVEKEY))
411 EVP_DigestUpdate(&md, buffer_ptr(&b), buffer_len(&b));
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000412 EVP_DigestUpdate(&md, hash, mdsz);
413 EVP_DigestUpdate(&md, digest, have);
414 EVP_DigestFinal(&md, digest + have, NULL);
415 }
416 buffer_free(&b);
417#ifdef DEBUG_KEX
418 fprintf(stderr, "key '%c'== ", c);
419 dump_digest("key", digest, need);
420#endif
421 return digest;
Damien Millera664e872000-04-16 11:52:47 +1000422}
423
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000424Newkeys *current_keys[MODE_MAX];
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000425
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000426#define NKEYS 6
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000427void
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000428kex_derive_keys(Kex *kex, u_char *hash, BIGNUM *shared_secret)
Damien Millera664e872000-04-16 11:52:47 +1000429{
Ben Lindstrom46c16222000-12-22 01:43:59 +0000430 u_char *keys[NKEYS];
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000431 int i, mode, ctos;
Damien Millera664e872000-04-16 11:52:47 +1000432
433 for (i = 0; i < NKEYS; i++)
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000434 keys[i] = derive_key(kex, 'A'+i, kex->we_need, hash, shared_secret);
Damien Millera664e872000-04-16 11:52:47 +1000435
Ben Lindstrom064496f2002-12-23 02:04:22 +0000436 debug2("kex_derive_keys");
Damien Millera664e872000-04-16 11:52:47 +1000437 for (mode = 0; mode < MODE_MAX; mode++) {
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000438 current_keys[mode] = kex->newkeys[mode];
439 kex->newkeys[mode] = NULL;
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000440 ctos = (!kex->server && mode == MODE_OUT) || (kex->server && mode == MODE_IN);
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000441 current_keys[mode]->enc.iv = keys[ctos ? 0 : 1];
442 current_keys[mode]->enc.key = keys[ctos ? 2 : 3];
443 current_keys[mode]->mac.key = keys[ctos ? 4 : 5];
Damien Millera664e872000-04-16 11:52:47 +1000444 }
Damien Millera664e872000-04-16 11:52:47 +1000445}
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000446
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000447Newkeys *
448kex_get_newkeys(int mode)
449{
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000450 Newkeys *ret;
451
452 ret = current_keys[mode];
453 current_keys[mode] = NULL;
454 return ret;
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000455}
456
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000457#if defined(DEBUG_KEX) || defined(DEBUG_KEXDH)
458void
459dump_digest(char *msg, u_char *digest, int len)
460{
461 int i;
462
463 fprintf(stderr, "%s\n", msg);
Ben Lindstrom1c37c6a2001-12-06 18:00:18 +0000464 for (i = 0; i< len; i++) {
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000465 fprintf(stderr, "%02x", digest[i]);
466 if (i%32 == 31)
467 fprintf(stderr, "\n");
468 else if (i%8 == 7)
469 fprintf(stderr, " ");
470 }
471 fprintf(stderr, "\n");
472}
473#endif