1296781Sdes/* $OpenBSD: kexc25519s.c,v 1.10 2015/12/04 16:41:28 markus Exp $ */ 2261287Sdes/* 3261287Sdes * Copyright (c) 2001 Markus Friedl. All rights reserved. 4261287Sdes * Copyright (c) 2010 Damien Miller. All rights reserved. 5261287Sdes * Copyright (c) 2013 Aris Adamantiadis. All rights reserved. 6261287Sdes * 7261287Sdes * modification, are permitted provided that the following conditions 8261287Sdes * are met: 9261287Sdes * 1. Redistributions of source code must retain the above copyright 10261287Sdes * notice, this list of conditions and the following disclaimer. 11261287Sdes * 2. Redistributions in binary form must reproduce the above copyright 12261287Sdes * notice, this list of conditions and the following disclaimer in the 13261287Sdes * documentation and/or other materials provided with the distribution. 14261287Sdes * 15261287Sdes * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 16261287Sdes * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 17261287Sdes * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 18261287Sdes * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 19261287Sdes * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 20261287Sdes * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 21261287Sdes * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 22261287Sdes * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 23261287Sdes * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 24261287Sdes * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 25261287Sdes */ 26261287Sdes 27261287Sdes#include "includes.h" 28261287Sdes 29261287Sdes#include <sys/types.h> 30295367Sdes#include <stdio.h> 31261287Sdes#include <string.h> 32261287Sdes#include <signal.h> 33261287Sdes 34295367Sdes#include "sshkey.h" 35261287Sdes#include "cipher.h" 36295367Sdes#include "digest.h" 37261287Sdes#include "kex.h" 38261287Sdes#include "log.h" 39261287Sdes#include "packet.h" 40261287Sdes#include "ssh2.h" 41295367Sdes#include "sshbuf.h" 42295367Sdes#include "ssherr.h" 43261287Sdes 44295367Sdesstatic int input_kex_c25519_init(int, u_int32_t, void *); 45295367Sdes 46295367Sdesint 47295367Sdeskexc25519_server(struct ssh *ssh) 48261287Sdes{ 49295367Sdes debug("expecting SSH2_MSG_KEX_ECDH_INIT"); 50295367Sdes ssh_dispatch_set(ssh, SSH2_MSG_KEX_ECDH_INIT, &input_kex_c25519_init); 51295367Sdes return 0; 52295367Sdes} 53295367Sdes 54295367Sdesstatic int 55295367Sdesinput_kex_c25519_init(int type, u_int32_t seq, void *ctxt) 56295367Sdes{ 57295367Sdes struct ssh *ssh = ctxt; 58295367Sdes struct kex *kex = ssh->kex; 59295367Sdes struct sshkey *server_host_private, *server_host_public; 60295367Sdes struct sshbuf *shared_secret = NULL; 61261287Sdes u_char *server_host_key_blob = NULL, *signature = NULL; 62261287Sdes u_char server_key[CURVE25519_SIZE]; 63261287Sdes u_char *client_pubkey = NULL; 64261287Sdes u_char server_pubkey[CURVE25519_SIZE]; 65295367Sdes u_char hash[SSH_DIGEST_MAX_LENGTH]; 66295367Sdes size_t slen, pklen, sbloblen, hashlen; 67295367Sdes int r; 68261287Sdes 69261287Sdes /* generate private key */ 70261287Sdes kexc25519_keygen(server_key, server_pubkey); 71261287Sdes#ifdef DEBUG_KEXECDH 72261287Sdes dump_digest("server private key:", server_key, sizeof(server_key)); 73261287Sdes#endif 74261287Sdes if (kex->load_host_public_key == NULL || 75295367Sdes kex->load_host_private_key == NULL) { 76295367Sdes r = SSH_ERR_INVALID_ARGUMENT; 77295367Sdes goto out; 78295367Sdes } 79295367Sdes server_host_public = kex->load_host_public_key(kex->hostkey_type, 80295367Sdes kex->hostkey_nid, ssh); 81295367Sdes server_host_private = kex->load_host_private_key(kex->hostkey_type, 82295367Sdes kex->hostkey_nid, ssh); 83295367Sdes if (server_host_public == NULL) { 84295367Sdes r = SSH_ERR_NO_HOSTKEY_LOADED; 85295367Sdes goto out; 86295367Sdes } 87261287Sdes 88295367Sdes if ((r = sshpkt_get_string(ssh, &client_pubkey, &pklen)) != 0 || 89295367Sdes (r = sshpkt_get_end(ssh)) != 0) 90295367Sdes goto out; 91295367Sdes if (pklen != CURVE25519_SIZE) { 92295367Sdes r = SSH_ERR_SIGNATURE_INVALID; 93295367Sdes goto out; 94295367Sdes } 95261287Sdes#ifdef DEBUG_KEXECDH 96261287Sdes dump_digest("client public key:", client_pubkey, CURVE25519_SIZE); 97261287Sdes#endif 98261287Sdes 99295367Sdes if ((shared_secret = sshbuf_new()) == NULL) { 100295367Sdes r = SSH_ERR_ALLOC_FAIL; 101295367Sdes goto out; 102295367Sdes } 103295367Sdes if ((r = kexc25519_shared_key(server_key, client_pubkey, 104295367Sdes shared_secret)) < 0) 105295367Sdes goto out; 106261287Sdes 107261287Sdes /* calc H */ 108295367Sdes if ((r = sshkey_to_blob(server_host_public, &server_host_key_blob, 109295367Sdes &sbloblen)) != 0) 110295367Sdes goto out; 111295367Sdes hashlen = sizeof(hash); 112295367Sdes if ((r = kex_c25519_hash( 113261287Sdes kex->hash_alg, 114261287Sdes kex->client_version_string, 115261287Sdes kex->server_version_string, 116295367Sdes sshbuf_ptr(kex->peer), sshbuf_len(kex->peer), 117295367Sdes sshbuf_ptr(kex->my), sshbuf_len(kex->my), 118261287Sdes server_host_key_blob, sbloblen, 119261287Sdes client_pubkey, 120261287Sdes server_pubkey, 121295367Sdes sshbuf_ptr(shared_secret), sshbuf_len(shared_secret), 122295367Sdes hash, &hashlen)) < 0) 123295367Sdes goto out; 124261287Sdes 125261287Sdes /* save session id := H */ 126261287Sdes if (kex->session_id == NULL) { 127261287Sdes kex->session_id_len = hashlen; 128295367Sdes kex->session_id = malloc(kex->session_id_len); 129295367Sdes if (kex->session_id == NULL) { 130295367Sdes r = SSH_ERR_ALLOC_FAIL; 131295367Sdes goto out; 132295367Sdes } 133261287Sdes memcpy(kex->session_id, hash, kex->session_id_len); 134261287Sdes } 135261287Sdes 136261287Sdes /* sign H */ 137296781Sdes if ((r = kex->sign(server_host_private, server_host_public, &signature, 138296781Sdes &slen, hash, hashlen, kex->hostkey_alg, ssh->compat)) < 0) 139295367Sdes goto out; 140261287Sdes 141261287Sdes /* send server hostkey, ECDH pubkey 'Q_S' and signed H */ 142295367Sdes if ((r = sshpkt_start(ssh, SSH2_MSG_KEX_ECDH_REPLY)) != 0 || 143295367Sdes (r = sshpkt_put_string(ssh, server_host_key_blob, sbloblen)) != 0 || 144295367Sdes (r = sshpkt_put_string(ssh, server_pubkey, sizeof(server_pubkey))) != 0 || 145295367Sdes (r = sshpkt_put_string(ssh, signature, slen)) != 0 || 146295367Sdes (r = sshpkt_send(ssh)) != 0) 147295367Sdes goto out; 148261287Sdes 149295367Sdes if ((r = kex_derive_keys(ssh, hash, hashlen, shared_secret)) == 0) 150295367Sdes r = kex_send_newkeys(ssh); 151295367Sdesout: 152295367Sdes explicit_bzero(hash, sizeof(hash)); 153295367Sdes explicit_bzero(server_key, sizeof(server_key)); 154295367Sdes free(server_host_key_blob); 155261287Sdes free(signature); 156261287Sdes free(client_pubkey); 157295367Sdes sshbuf_free(shared_secret); 158295367Sdes return r; 159261287Sdes} 160