1 /* $OpenBSD: kexdhc.c,v 1.22 2018/02/07 02:06:51 jsing Exp $ */
3 * Copyright (c) 2001 Markus Friedl. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
15 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
18 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
30 #include <sys/types.h>
32 #include <openssl/dh.h>
39 #include "openbsd-compat/openssl-compat.h"
54 static int input_kex_dh(int, u_int32_t, struct ssh *);
57 kexdh_client(struct ssh *ssh)
59 struct kex *kex = ssh->kex;
61 const BIGNUM *pub_key;
63 /* generate and send 'e', client DH public key */
64 switch (kex->kex_type) {
65 case KEX_DH_GRP1_SHA1:
66 kex->dh = dh_new_group1();
68 case KEX_DH_GRP14_SHA1:
69 case KEX_DH_GRP14_SHA256:
70 kex->dh = dh_new_group14();
72 case KEX_DH_GRP16_SHA512:
73 kex->dh = dh_new_group16();
75 case KEX_DH_GRP18_SHA512:
76 kex->dh = dh_new_group18();
79 r = SSH_ERR_INVALID_ARGUMENT;
82 if (kex->dh == NULL) {
83 r = SSH_ERR_ALLOC_FAIL;
86 debug("sending SSH2_MSG_KEXDH_INIT");
87 if ((r = dh_gen_key(kex->dh, kex->we_need * 8)) != 0)
89 DH_get0_key(kex->dh, &pub_key, NULL);
90 if ((r = sshpkt_start(ssh, SSH2_MSG_KEXDH_INIT)) != 0 ||
91 (r = sshpkt_put_bignum2(ssh, pub_key)) != 0 ||
92 (r = sshpkt_send(ssh)) != 0)
95 DHparams_print_fp(stderr, kex->dh);
96 fprintf(stderr, "pub= ");
97 BN_print_fp(stderr, pub_key);
98 fprintf(stderr, "\n");
100 debug("expecting SSH2_MSG_KEXDH_REPLY");
101 ssh_dispatch_set(ssh, SSH2_MSG_KEXDH_REPLY, &input_kex_dh);
108 input_kex_dh(int type, u_int32_t seq, struct ssh *ssh)
110 struct kex *kex = ssh->kex;
111 BIGNUM *dh_server_pub = NULL, *shared_secret = NULL;
112 const BIGNUM *pub_key;
113 struct sshkey *server_host_key = NULL;
114 u_char *kbuf = NULL, *server_host_key_blob = NULL, *signature = NULL;
115 u_char hash[SSH_DIGEST_MAX_LENGTH];
116 size_t klen = 0, slen, sbloblen, hashlen;
119 if (kex->verify_host_key == NULL) {
120 r = SSH_ERR_INVALID_ARGUMENT;
124 if ((r = sshpkt_get_string(ssh, &server_host_key_blob,
126 (r = sshkey_from_blob(server_host_key_blob, sbloblen,
127 &server_host_key)) != 0)
129 if (server_host_key->type != kex->hostkey_type ||
130 (kex->hostkey_type == KEY_ECDSA &&
131 server_host_key->ecdsa_nid != kex->hostkey_nid)) {
132 r = SSH_ERR_KEY_TYPE_MISMATCH;
135 if (kex->verify_host_key(server_host_key, ssh) == -1) {
136 r = SSH_ERR_SIGNATURE_INVALID;
139 /* DH parameter f, server public DH key */
140 if ((dh_server_pub = BN_new()) == NULL) {
141 r = SSH_ERR_ALLOC_FAIL;
145 if ((r = sshpkt_get_bignum2(ssh, dh_server_pub)) != 0 ||
146 (r = sshpkt_get_string(ssh, &signature, &slen)) != 0 ||
147 (r = sshpkt_get_end(ssh)) != 0)
150 fprintf(stderr, "dh_server_pub= ");
151 BN_print_fp(stderr, dh_server_pub);
152 fprintf(stderr, "\n");
153 debug("bits %d", BN_num_bits(dh_server_pub));
155 if (!dh_pub_is_valid(kex->dh, dh_server_pub)) {
156 sshpkt_disconnect(ssh, "bad server public DH value");
157 r = SSH_ERR_MESSAGE_INCOMPLETE;
161 klen = DH_size(kex->dh);
162 if ((kbuf = malloc(klen)) == NULL ||
163 (shared_secret = BN_new()) == NULL) {
164 r = SSH_ERR_ALLOC_FAIL;
167 if ((kout = DH_compute_key(kbuf, dh_server_pub, kex->dh)) < 0 ||
168 BN_bin2bn(kbuf, kout, shared_secret) == NULL) {
169 r = SSH_ERR_LIBCRYPTO_ERROR;
173 dump_digest("shared secret", kbuf, kout);
176 /* calc and verify H */
177 DH_get0_key(kex->dh, &pub_key, NULL);
178 hashlen = sizeof(hash);
179 if ((r = kex_dh_hash(
181 kex->client_version_string,
182 kex->server_version_string,
183 sshbuf_ptr(kex->my), sshbuf_len(kex->my),
184 sshbuf_ptr(kex->peer), sshbuf_len(kex->peer),
185 server_host_key_blob, sbloblen,
189 hash, &hashlen)) != 0)
192 if ((r = sshkey_verify(server_host_key, signature, slen, hash, hashlen,
193 kex->hostkey_alg, ssh->compat)) != 0)
196 /* save session id */
197 if (kex->session_id == NULL) {
198 kex->session_id_len = hashlen;
199 kex->session_id = malloc(kex->session_id_len);
200 if (kex->session_id == NULL) {
201 r = SSH_ERR_ALLOC_FAIL;
204 memcpy(kex->session_id, hash, kex->session_id_len);
207 if ((r = kex_derive_keys_bn(ssh, hash, hashlen, shared_secret)) == 0)
208 r = kex_send_newkeys(ssh);
210 explicit_bzero(hash, sizeof(hash));
213 BN_clear_free(dh_server_pub);
215 explicit_bzero(kbuf, klen);
218 BN_clear_free(shared_secret);
219 sshkey_free(server_host_key);
220 free(server_host_key_blob);
224 #endif /* WITH_OPENSSL */