1294332Sdes/* $OpenBSD: kexc25519c.c,v 1.7 2015/01/26 06:10:03 djm Exp $ */ 2261287Sdes/* 3261287Sdes * Copyright (c) 2001 Markus Friedl. All rights reserved. 4261287Sdes * Copyright (c) 2010 Damien Miller. All rights reserved. 5261287Sdes * Copyright (c) 2013 Aris Adamantiadis. All rights reserved. 6261287Sdes * 7261287Sdes * Redistribution and use in source and binary forms, with or without 8261287Sdes * modification, are permitted provided that the following conditions 9261287Sdes * are met: 10261287Sdes * 1. Redistributions of source code must retain the above copyright 11261287Sdes * notice, this list of conditions and the following disclaimer. 12261287Sdes * 2. Redistributions in binary form must reproduce the above copyright 13261287Sdes * notice, this list of conditions and the following disclaimer in the 14261287Sdes * documentation and/or other materials provided with the distribution. 15261287Sdes * 16261287Sdes * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 17261287Sdes * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 18261287Sdes * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 19261287Sdes * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 20261287Sdes * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 21261287Sdes * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 22261287Sdes * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 23261287Sdes * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 24261287Sdes * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 25261287Sdes * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 26261287Sdes */ 27261287Sdes 28261287Sdes#include "includes.h" 29261287Sdes 30261287Sdes#include <sys/types.h> 31261287Sdes 32261287Sdes#include <stdio.h> 33261287Sdes#include <string.h> 34261287Sdes#include <signal.h> 35261287Sdes 36294332Sdes#include "sshkey.h" 37261287Sdes#include "cipher.h" 38261287Sdes#include "kex.h" 39261287Sdes#include "log.h" 40261287Sdes#include "packet.h" 41261287Sdes#include "ssh2.h" 42294332Sdes#include "sshbuf.h" 43294332Sdes#include "digest.h" 44294332Sdes#include "ssherr.h" 45261287Sdes 46294332Sdesstatic int 47294332Sdesinput_kex_c25519_reply(int type, u_int32_t seq, void *ctxt); 48294332Sdes 49294332Sdesint 50294332Sdeskexc25519_client(struct ssh *ssh) 51261287Sdes{ 52294332Sdes struct kex *kex = ssh->kex; 53294332Sdes int r; 54261287Sdes 55294332Sdes kexc25519_keygen(kex->c25519_client_key, kex->c25519_client_pubkey); 56261287Sdes#ifdef DEBUG_KEXECDH 57294332Sdes dump_digest("client private key:", kex->c25519_client_key, 58294332Sdes sizeof(kex->c25519_client_key)); 59261287Sdes#endif 60294332Sdes if ((r = sshpkt_start(ssh, SSH2_MSG_KEX_ECDH_INIT)) != 0 || 61294332Sdes (r = sshpkt_put_string(ssh, kex->c25519_client_pubkey, 62294332Sdes sizeof(kex->c25519_client_pubkey))) != 0 || 63294332Sdes (r = sshpkt_send(ssh)) != 0) 64294332Sdes return r; 65261287Sdes 66261287Sdes debug("expecting SSH2_MSG_KEX_ECDH_REPLY"); 67294332Sdes ssh_dispatch_set(ssh, SSH2_MSG_KEX_ECDH_REPLY, &input_kex_c25519_reply); 68294332Sdes return 0; 69294332Sdes} 70261287Sdes 71294332Sdesstatic int 72294332Sdesinput_kex_c25519_reply(int type, u_int32_t seq, void *ctxt) 73294332Sdes{ 74294332Sdes struct ssh *ssh = ctxt; 75294332Sdes struct kex *kex = ssh->kex; 76294332Sdes struct sshkey *server_host_key = NULL; 77294332Sdes struct sshbuf *shared_secret = NULL; 78294332Sdes u_char *server_pubkey = NULL; 79294332Sdes u_char *server_host_key_blob = NULL, *signature = NULL; 80294332Sdes u_char hash[SSH_DIGEST_MAX_LENGTH]; 81294332Sdes size_t slen, pklen, sbloblen, hashlen; 82294332Sdes int r; 83294332Sdes 84294332Sdes if (kex->verify_host_key == NULL) { 85294332Sdes r = SSH_ERR_INVALID_ARGUMENT; 86294332Sdes goto out; 87294332Sdes } 88294332Sdes 89261287Sdes /* hostkey */ 90294332Sdes if ((r = sshpkt_get_string(ssh, &server_host_key_blob, 91294332Sdes &sbloblen)) != 0 || 92294332Sdes (r = sshkey_from_blob(server_host_key_blob, sbloblen, 93294332Sdes &server_host_key)) != 0) 94294332Sdes goto out; 95294332Sdes if (server_host_key->type != kex->hostkey_type || 96294332Sdes (kex->hostkey_type == KEY_ECDSA && 97294332Sdes server_host_key->ecdsa_nid != kex->hostkey_nid)) { 98294332Sdes r = SSH_ERR_KEY_TYPE_MISMATCH; 99294332Sdes goto out; 100294332Sdes } 101294332Sdes if (kex->verify_host_key(server_host_key, ssh) == -1) { 102294332Sdes r = SSH_ERR_SIGNATURE_INVALID; 103294332Sdes goto out; 104294332Sdes } 105261287Sdes 106261287Sdes /* Q_S, server public key */ 107294332Sdes /* signed H */ 108294332Sdes if ((r = sshpkt_get_string(ssh, &server_pubkey, &pklen)) != 0 || 109294332Sdes (r = sshpkt_get_string(ssh, &signature, &slen)) != 0 || 110294332Sdes (r = sshpkt_get_end(ssh)) != 0) 111294332Sdes goto out; 112294332Sdes if (pklen != CURVE25519_SIZE) { 113294332Sdes r = SSH_ERR_SIGNATURE_INVALID; 114294332Sdes goto out; 115294332Sdes } 116261287Sdes 117261287Sdes#ifdef DEBUG_KEXECDH 118261287Sdes dump_digest("server public key:", server_pubkey, CURVE25519_SIZE); 119261287Sdes#endif 120261287Sdes 121294332Sdes if ((shared_secret = sshbuf_new()) == NULL) { 122294332Sdes r = SSH_ERR_ALLOC_FAIL; 123294332Sdes goto out; 124294332Sdes } 125294332Sdes if ((r = kexc25519_shared_key(kex->c25519_client_key, server_pubkey, 126294332Sdes shared_secret)) < 0) 127294332Sdes goto out; 128261287Sdes 129261287Sdes /* calc and verify H */ 130294332Sdes hashlen = sizeof(hash); 131294332Sdes if ((r = kex_c25519_hash( 132261287Sdes kex->hash_alg, 133261287Sdes kex->client_version_string, 134261287Sdes kex->server_version_string, 135294332Sdes sshbuf_ptr(kex->my), sshbuf_len(kex->my), 136294332Sdes sshbuf_ptr(kex->peer), sshbuf_len(kex->peer), 137261287Sdes server_host_key_blob, sbloblen, 138294332Sdes kex->c25519_client_pubkey, 139261287Sdes server_pubkey, 140294332Sdes sshbuf_ptr(shared_secret), sshbuf_len(shared_secret), 141294332Sdes hash, &hashlen)) < 0) 142294332Sdes goto out; 143261287Sdes 144294332Sdes if ((r = sshkey_verify(server_host_key, signature, slen, hash, hashlen, 145294332Sdes ssh->compat)) != 0) 146294332Sdes goto out; 147294332Sdes 148261287Sdes /* save session id */ 149261287Sdes if (kex->session_id == NULL) { 150261287Sdes kex->session_id_len = hashlen; 151294332Sdes kex->session_id = malloc(kex->session_id_len); 152294332Sdes if (kex->session_id == NULL) { 153294332Sdes r = SSH_ERR_ALLOC_FAIL; 154294332Sdes goto out; 155294332Sdes } 156261287Sdes memcpy(kex->session_id, hash, kex->session_id_len); 157261287Sdes } 158294332Sdes 159294332Sdes if ((r = kex_derive_keys(ssh, hash, hashlen, shared_secret)) == 0) 160294332Sdes r = kex_send_newkeys(ssh); 161294332Sdesout: 162294332Sdes explicit_bzero(hash, sizeof(hash)); 163294332Sdes explicit_bzero(kex->c25519_client_key, sizeof(kex->c25519_client_key)); 164294332Sdes free(server_host_key_blob); 165294332Sdes free(server_pubkey); 166294332Sdes free(signature); 167294332Sdes sshkey_free(server_host_key); 168294332Sdes sshbuf_free(shared_secret); 169294332Sdes return r; 170261287Sdes} 171