1296633Sdes/* $OpenBSD: kexc25519s.c,v 1.10 2015/12/04 16:41:28 markus Exp $ */ 2261287Sdes/* 3261287Sdes * Copyright (c) 2001 Markus Friedl. All rights reserved. 4261287Sdes * Copyright (c) 2010 Damien Miller. All rights reserved. 5261287Sdes * Copyright (c) 2013 Aris Adamantiadis. All rights reserved. 6261287Sdes * 7261287Sdes * modification, are permitted provided that the following conditions 8261287Sdes * are met: 9261287Sdes * 1. Redistributions of source code must retain the above copyright 10261287Sdes * notice, this list of conditions and the following disclaimer. 11261287Sdes * 2. Redistributions in binary form must reproduce the above copyright 12261287Sdes * notice, this list of conditions and the following disclaimer in the 13261287Sdes * documentation and/or other materials provided with the distribution. 14261287Sdes * 15261287Sdes * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 16261287Sdes * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 17261287Sdes * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 18261287Sdes * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 19261287Sdes * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 20261287Sdes * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 21261287Sdes * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 22261287Sdes * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 23261287Sdes * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 24261287Sdes * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 25261287Sdes */ 26261287Sdes 27261287Sdes#include "includes.h" 28261287Sdes 29261287Sdes#include <sys/types.h> 30294336Sdes#include <stdio.h> 31261287Sdes#include <string.h> 32261287Sdes#include <signal.h> 33261287Sdes 34294332Sdes#include "sshkey.h" 35261287Sdes#include "cipher.h" 36294332Sdes#include "digest.h" 37261287Sdes#include "kex.h" 38261287Sdes#include "log.h" 39261287Sdes#include "packet.h" 40261287Sdes#include "ssh2.h" 41294332Sdes#include "sshbuf.h" 42294332Sdes#include "ssherr.h" 43261287Sdes 44294332Sdesstatic int input_kex_c25519_init(int, u_int32_t, void *); 45294332Sdes 46294332Sdesint 47294332Sdeskexc25519_server(struct ssh *ssh) 48261287Sdes{ 49294332Sdes debug("expecting SSH2_MSG_KEX_ECDH_INIT"); 50294332Sdes ssh_dispatch_set(ssh, SSH2_MSG_KEX_ECDH_INIT, &input_kex_c25519_init); 51294332Sdes return 0; 52294332Sdes} 53294332Sdes 54294332Sdesstatic int 55294332Sdesinput_kex_c25519_init(int type, u_int32_t seq, void *ctxt) 56294332Sdes{ 57294332Sdes struct ssh *ssh = ctxt; 58294332Sdes struct kex *kex = ssh->kex; 59294332Sdes struct sshkey *server_host_private, *server_host_public; 60294332Sdes struct sshbuf *shared_secret = NULL; 61261287Sdes u_char *server_host_key_blob = NULL, *signature = NULL; 62261287Sdes u_char server_key[CURVE25519_SIZE]; 63261287Sdes u_char *client_pubkey = NULL; 64261287Sdes u_char server_pubkey[CURVE25519_SIZE]; 65294332Sdes u_char hash[SSH_DIGEST_MAX_LENGTH]; 66294332Sdes size_t slen, pklen, sbloblen, hashlen; 67294332Sdes int r; 68261287Sdes 69261287Sdes /* generate private key */ 70261287Sdes kexc25519_keygen(server_key, server_pubkey); 71261287Sdes#ifdef DEBUG_KEXECDH 72261287Sdes dump_digest("server private key:", server_key, sizeof(server_key)); 73261287Sdes#endif 74261287Sdes if (kex->load_host_public_key == NULL || 75294332Sdes kex->load_host_private_key == NULL) { 76294332Sdes r = SSH_ERR_INVALID_ARGUMENT; 77294332Sdes goto out; 78294332Sdes } 79294332Sdes server_host_public = kex->load_host_public_key(kex->hostkey_type, 80294332Sdes kex->hostkey_nid, ssh); 81294332Sdes server_host_private = kex->load_host_private_key(kex->hostkey_type, 82294332Sdes kex->hostkey_nid, ssh); 83294332Sdes if (server_host_public == NULL) { 84294332Sdes r = SSH_ERR_NO_HOSTKEY_LOADED; 85294332Sdes goto out; 86294332Sdes } 87261287Sdes 88294332Sdes if ((r = sshpkt_get_string(ssh, &client_pubkey, &pklen)) != 0 || 89294332Sdes (r = sshpkt_get_end(ssh)) != 0) 90294332Sdes goto out; 91294332Sdes if (pklen != CURVE25519_SIZE) { 92294332Sdes r = SSH_ERR_SIGNATURE_INVALID; 93294332Sdes goto out; 94294332Sdes } 95261287Sdes#ifdef DEBUG_KEXECDH 96261287Sdes dump_digest("client public key:", client_pubkey, CURVE25519_SIZE); 97261287Sdes#endif 98261287Sdes 99294332Sdes if ((shared_secret = sshbuf_new()) == NULL) { 100294332Sdes r = SSH_ERR_ALLOC_FAIL; 101294332Sdes goto out; 102294332Sdes } 103294332Sdes if ((r = kexc25519_shared_key(server_key, client_pubkey, 104294332Sdes shared_secret)) < 0) 105294332Sdes goto out; 106261287Sdes 107261287Sdes /* calc H */ 108294332Sdes if ((r = sshkey_to_blob(server_host_public, &server_host_key_blob, 109294332Sdes &sbloblen)) != 0) 110294332Sdes goto out; 111294332Sdes hashlen = sizeof(hash); 112294332Sdes if ((r = kex_c25519_hash( 113261287Sdes kex->hash_alg, 114261287Sdes kex->client_version_string, 115261287Sdes kex->server_version_string, 116294332Sdes sshbuf_ptr(kex->peer), sshbuf_len(kex->peer), 117294332Sdes sshbuf_ptr(kex->my), sshbuf_len(kex->my), 118261287Sdes server_host_key_blob, sbloblen, 119261287Sdes client_pubkey, 120261287Sdes server_pubkey, 121294332Sdes sshbuf_ptr(shared_secret), sshbuf_len(shared_secret), 122294332Sdes hash, &hashlen)) < 0) 123294332Sdes goto out; 124261287Sdes 125261287Sdes /* save session id := H */ 126261287Sdes if (kex->session_id == NULL) { 127261287Sdes kex->session_id_len = hashlen; 128294332Sdes kex->session_id = malloc(kex->session_id_len); 129294332Sdes if (kex->session_id == NULL) { 130294332Sdes r = SSH_ERR_ALLOC_FAIL; 131294332Sdes goto out; 132294332Sdes } 133261287Sdes memcpy(kex->session_id, hash, kex->session_id_len); 134261287Sdes } 135261287Sdes 136261287Sdes /* sign H */ 137296633Sdes if ((r = kex->sign(server_host_private, server_host_public, &signature, 138296633Sdes &slen, hash, hashlen, kex->hostkey_alg, ssh->compat)) < 0) 139294332Sdes goto out; 140261287Sdes 141261287Sdes /* send server hostkey, ECDH pubkey 'Q_S' and signed H */ 142294332Sdes if ((r = sshpkt_start(ssh, SSH2_MSG_KEX_ECDH_REPLY)) != 0 || 143294332Sdes (r = sshpkt_put_string(ssh, server_host_key_blob, sbloblen)) != 0 || 144294332Sdes (r = sshpkt_put_string(ssh, server_pubkey, sizeof(server_pubkey))) != 0 || 145294332Sdes (r = sshpkt_put_string(ssh, signature, slen)) != 0 || 146294332Sdes (r = sshpkt_send(ssh)) != 0) 147294332Sdes goto out; 148261287Sdes 149294332Sdes if ((r = kex_derive_keys(ssh, hash, hashlen, shared_secret)) == 0) 150294332Sdes r = kex_send_newkeys(ssh); 151294332Sdesout: 152294332Sdes explicit_bzero(hash, sizeof(hash)); 153294332Sdes explicit_bzero(server_key, sizeof(server_key)); 154294332Sdes free(server_host_key_blob); 155261287Sdes free(signature); 156261287Sdes free(client_pubkey); 157294332Sdes sshbuf_free(shared_secret); 158294332Sdes return r; 159261287Sdes} 160