1295367Sdes/* $OpenBSD: kexc25519c.c,v 1.7 2015/01/26 06:10:03 djm Exp $ */ 2261287Sdes/* 3261287Sdes * Copyright (c) 2001 Markus Friedl. All rights reserved. 4261287Sdes * Copyright (c) 2010 Damien Miller. All rights reserved. 5261287Sdes * Copyright (c) 2013 Aris Adamantiadis. All rights reserved. 6261287Sdes * 7261287Sdes * Redistribution and use in source and binary forms, with or without 8261287Sdes * modification, are permitted provided that the following conditions 9261287Sdes * are met: 10261287Sdes * 1. Redistributions of source code must retain the above copyright 11261287Sdes * notice, this list of conditions and the following disclaimer. 12261287Sdes * 2. Redistributions in binary form must reproduce the above copyright 13261287Sdes * notice, this list of conditions and the following disclaimer in the 14261287Sdes * documentation and/or other materials provided with the distribution. 15261287Sdes * 16261287Sdes * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 17261287Sdes * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 18261287Sdes * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 19261287Sdes * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 20261287Sdes * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 21261287Sdes * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 22261287Sdes * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 23261287Sdes * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 24261287Sdes * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 25261287Sdes * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 26261287Sdes */ 27261287Sdes 28261287Sdes#include "includes.h" 29261287Sdes 30261287Sdes#include <sys/types.h> 31261287Sdes 32261287Sdes#include <stdio.h> 33261287Sdes#include <string.h> 34261287Sdes#include <signal.h> 35261287Sdes 36295367Sdes#include "sshkey.h" 37261287Sdes#include "cipher.h" 38261287Sdes#include "kex.h" 39261287Sdes#include "log.h" 40261287Sdes#include "packet.h" 41261287Sdes#include "ssh2.h" 42295367Sdes#include "sshbuf.h" 43295367Sdes#include "digest.h" 44295367Sdes#include "ssherr.h" 45261287Sdes 46295367Sdesstatic int 47295367Sdesinput_kex_c25519_reply(int type, u_int32_t seq, void *ctxt); 48295367Sdes 49295367Sdesint 50295367Sdeskexc25519_client(struct ssh *ssh) 51261287Sdes{ 52295367Sdes struct kex *kex = ssh->kex; 53295367Sdes int r; 54261287Sdes 55295367Sdes kexc25519_keygen(kex->c25519_client_key, kex->c25519_client_pubkey); 56261287Sdes#ifdef DEBUG_KEXECDH 57295367Sdes dump_digest("client private key:", kex->c25519_client_key, 58295367Sdes sizeof(kex->c25519_client_key)); 59261287Sdes#endif 60295367Sdes if ((r = sshpkt_start(ssh, SSH2_MSG_KEX_ECDH_INIT)) != 0 || 61295367Sdes (r = sshpkt_put_string(ssh, kex->c25519_client_pubkey, 62295367Sdes sizeof(kex->c25519_client_pubkey))) != 0 || 63295367Sdes (r = sshpkt_send(ssh)) != 0) 64295367Sdes return r; 65261287Sdes 66261287Sdes debug("expecting SSH2_MSG_KEX_ECDH_REPLY"); 67295367Sdes ssh_dispatch_set(ssh, SSH2_MSG_KEX_ECDH_REPLY, &input_kex_c25519_reply); 68295367Sdes return 0; 69295367Sdes} 70261287Sdes 71295367Sdesstatic int 72295367Sdesinput_kex_c25519_reply(int type, u_int32_t seq, void *ctxt) 73295367Sdes{ 74295367Sdes struct ssh *ssh = ctxt; 75295367Sdes struct kex *kex = ssh->kex; 76295367Sdes struct sshkey *server_host_key = NULL; 77295367Sdes struct sshbuf *shared_secret = NULL; 78295367Sdes u_char *server_pubkey = NULL; 79295367Sdes u_char *server_host_key_blob = NULL, *signature = NULL; 80295367Sdes u_char hash[SSH_DIGEST_MAX_LENGTH]; 81295367Sdes size_t slen, pklen, sbloblen, hashlen; 82295367Sdes int r; 83295367Sdes 84295367Sdes if (kex->verify_host_key == NULL) { 85295367Sdes r = SSH_ERR_INVALID_ARGUMENT; 86295367Sdes goto out; 87295367Sdes } 88295367Sdes 89261287Sdes /* hostkey */ 90295367Sdes if ((r = sshpkt_get_string(ssh, &server_host_key_blob, 91295367Sdes &sbloblen)) != 0 || 92295367Sdes (r = sshkey_from_blob(server_host_key_blob, sbloblen, 93295367Sdes &server_host_key)) != 0) 94295367Sdes goto out; 95295367Sdes if (server_host_key->type != kex->hostkey_type || 96295367Sdes (kex->hostkey_type == KEY_ECDSA && 97295367Sdes server_host_key->ecdsa_nid != kex->hostkey_nid)) { 98295367Sdes r = SSH_ERR_KEY_TYPE_MISMATCH; 99295367Sdes goto out; 100295367Sdes } 101295367Sdes if (kex->verify_host_key(server_host_key, ssh) == -1) { 102295367Sdes r = SSH_ERR_SIGNATURE_INVALID; 103295367Sdes goto out; 104295367Sdes } 105261287Sdes 106261287Sdes /* Q_S, server public key */ 107295367Sdes /* signed H */ 108295367Sdes if ((r = sshpkt_get_string(ssh, &server_pubkey, &pklen)) != 0 || 109295367Sdes (r = sshpkt_get_string(ssh, &signature, &slen)) != 0 || 110295367Sdes (r = sshpkt_get_end(ssh)) != 0) 111295367Sdes goto out; 112295367Sdes if (pklen != CURVE25519_SIZE) { 113295367Sdes r = SSH_ERR_SIGNATURE_INVALID; 114295367Sdes goto out; 115295367Sdes } 116261287Sdes 117261287Sdes#ifdef DEBUG_KEXECDH 118261287Sdes dump_digest("server public key:", server_pubkey, CURVE25519_SIZE); 119261287Sdes#endif 120261287Sdes 121295367Sdes if ((shared_secret = sshbuf_new()) == NULL) { 122295367Sdes r = SSH_ERR_ALLOC_FAIL; 123295367Sdes goto out; 124295367Sdes } 125295367Sdes if ((r = kexc25519_shared_key(kex->c25519_client_key, server_pubkey, 126295367Sdes shared_secret)) < 0) 127295367Sdes goto out; 128261287Sdes 129261287Sdes /* calc and verify H */ 130295367Sdes hashlen = sizeof(hash); 131295367Sdes if ((r = kex_c25519_hash( 132261287Sdes kex->hash_alg, 133261287Sdes kex->client_version_string, 134261287Sdes kex->server_version_string, 135295367Sdes sshbuf_ptr(kex->my), sshbuf_len(kex->my), 136295367Sdes sshbuf_ptr(kex->peer), sshbuf_len(kex->peer), 137261287Sdes server_host_key_blob, sbloblen, 138295367Sdes kex->c25519_client_pubkey, 139261287Sdes server_pubkey, 140295367Sdes sshbuf_ptr(shared_secret), sshbuf_len(shared_secret), 141295367Sdes hash, &hashlen)) < 0) 142295367Sdes goto out; 143261287Sdes 144295367Sdes if ((r = sshkey_verify(server_host_key, signature, slen, hash, hashlen, 145295367Sdes ssh->compat)) != 0) 146295367Sdes goto out; 147295367Sdes 148261287Sdes /* save session id */ 149261287Sdes if (kex->session_id == NULL) { 150261287Sdes kex->session_id_len = hashlen; 151295367Sdes kex->session_id = malloc(kex->session_id_len); 152295367Sdes if (kex->session_id == NULL) { 153295367Sdes r = SSH_ERR_ALLOC_FAIL; 154295367Sdes goto out; 155295367Sdes } 156261287Sdes memcpy(kex->session_id, hash, kex->session_id_len); 157261287Sdes } 158295367Sdes 159295367Sdes if ((r = kex_derive_keys(ssh, hash, hashlen, shared_secret)) == 0) 160295367Sdes r = kex_send_newkeys(ssh); 161295367Sdesout: 162295367Sdes explicit_bzero(hash, sizeof(hash)); 163295367Sdes explicit_bzero(kex->c25519_client_key, sizeof(kex->c25519_client_key)); 164295367Sdes free(server_host_key_blob); 165295367Sdes free(server_pubkey); 166295367Sdes free(signature); 167295367Sdes sshkey_free(server_host_key); 168295367Sdes sshbuf_free(shared_secret); 169295367Sdes return r; 170261287Sdes} 171