1/* $OpenBSD: kex.c,v 1.88 2013/01/08 18:49:04 markus Exp $ */
2/*
3 * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 *    notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 *    notice, this list of conditions and the following disclaimer in the
12 *    documentation and/or other materials provided with the distribution.
13 *
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
15 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
18 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24 */
25
26#include "includes.h"
27
28#include <sys/param.h>
29
30#include <signal.h>
31#include <stdarg.h>
32#include <stdio.h>
33#include <stdlib.h>
34#include <string.h>
35
36#ifdef __APPLE_CRYPTO__
37#include "ossl-crypto.h"
38#else
39#include <openssl/crypto.h>
40#endif
41
42#include "xmalloc.h"
43#include "ssh2.h"
44#include "buffer.h"
45#include "packet.h"
46#include "compat.h"
47#include "cipher.h"
48#include "key.h"
49#include "kex.h"
50#include "log.h"
51#include "mac.h"
52#include "match.h"
53#include "dispatch.h"
54#include "monitor.h"
55#include "roaming.h"
56
57#ifdef GSSAPI
58#include "ssh-gss.h"
59#endif
60
61#if OPENSSL_VERSION_NUMBER >= 0x00907000L
62# if defined(HAVE_EVP_SHA256)
63# define evp_ssh_sha256 EVP_sha256
64# else
65extern const EVP_MD *evp_ssh_sha256(void);
66# endif
67#endif
68
69/* prototype */
70static void kex_kexinit_finish(Kex *);
71static void kex_choose_conf(Kex *);
72
73/* Validate KEX method name list */
74int
75kex_names_valid(const char *names)
76{
77	char *s, *cp, *p;
78
79	if (names == NULL || strcmp(names, "") == 0)
80		return 0;
81	s = cp = xstrdup(names);
82	for ((p = strsep(&cp, ",")); p && *p != '\0';
83	    (p = strsep(&cp, ","))) {
84	    	if (strcmp(p, KEX_DHGEX_SHA256) != 0 &&
85		    strcmp(p, KEX_DHGEX_SHA1) != 0 &&
86		    strcmp(p, KEX_DH14) != 0 &&
87		    strcmp(p, KEX_DH1) != 0 &&
88		    (strncmp(p, KEX_ECDH_SHA2_STEM,
89		    sizeof(KEX_ECDH_SHA2_STEM) - 1) != 0 ||
90		    kex_ecdh_name_to_nid(p) == -1)) {
91			error("Unsupported KEX algorithm \"%.100s\"", p);
92			xfree(s);
93			return 0;
94		}
95	}
96	debug3("kex names ok: [%s]", names);
97	xfree(s);
98	return 1;
99}
100
101/* put algorithm proposal into buffer */
102static void
103kex_prop2buf(Buffer *b, char *proposal[PROPOSAL_MAX])
104{
105	u_int i;
106
107	buffer_clear(b);
108	/*
109	 * add a dummy cookie, the cookie will be overwritten by
110	 * kex_send_kexinit(), each time a kexinit is set
111	 */
112	for (i = 0; i < KEX_COOKIE_LEN; i++)
113		buffer_put_char(b, 0);
114	for (i = 0; i < PROPOSAL_MAX; i++)
115		buffer_put_cstring(b, proposal[i]);
116	buffer_put_char(b, 0);			/* first_kex_packet_follows */
117	buffer_put_int(b, 0);			/* uint32 reserved */
118}
119
120/* parse buffer and return algorithm proposal */
121static char **
122kex_buf2prop(Buffer *raw, int *first_kex_follows)
123{
124	Buffer b;
125	u_int i;
126	char **proposal;
127
128	proposal = xcalloc(PROPOSAL_MAX, sizeof(char *));
129
130	buffer_init(&b);
131	buffer_append(&b, buffer_ptr(raw), buffer_len(raw));
132	/* skip cookie */
133	for (i = 0; i < KEX_COOKIE_LEN; i++)
134		buffer_get_char(&b);
135	/* extract kex init proposal strings */
136	for (i = 0; i < PROPOSAL_MAX; i++) {
137		proposal[i] = buffer_get_cstring(&b,NULL);
138		debug2("kex_parse_kexinit: %s", proposal[i]);
139	}
140	/* first kex follows / reserved */
141	i = buffer_get_char(&b);
142	if (first_kex_follows != NULL)
143		*first_kex_follows = i;
144	debug2("kex_parse_kexinit: first_kex_follows %d ", i);
145	i = buffer_get_int(&b);
146	debug2("kex_parse_kexinit: reserved %u ", i);
147	buffer_free(&b);
148	return proposal;
149}
150
151static void
152kex_prop_free(char **proposal)
153{
154	u_int i;
155
156	for (i = 0; i < PROPOSAL_MAX; i++)
157		xfree(proposal[i]);
158	xfree(proposal);
159}
160
161/* ARGSUSED */
162static void
163kex_protocol_error(int type, u_int32_t seq, void *ctxt)
164{
165	error("Hm, kex protocol error: type %d seq %u", type, seq);
166}
167
168static void
169kex_reset_dispatch(void)
170{
171	dispatch_range(SSH2_MSG_TRANSPORT_MIN,
172	    SSH2_MSG_TRANSPORT_MAX, &kex_protocol_error);
173	dispatch_set(SSH2_MSG_KEXINIT, &kex_input_kexinit);
174}
175
176void
177kex_finish(Kex *kex)
178{
179	kex_reset_dispatch();
180
181	packet_start(SSH2_MSG_NEWKEYS);
182	packet_send();
183	/* packet_write_wait(); */
184	debug("SSH2_MSG_NEWKEYS sent");
185
186	debug("expecting SSH2_MSG_NEWKEYS");
187	packet_read_expect(SSH2_MSG_NEWKEYS);
188	packet_check_eom();
189	debug("SSH2_MSG_NEWKEYS received");
190
191	kex->done = 1;
192	buffer_clear(&kex->peer);
193	/* buffer_clear(&kex->my); */
194	kex->flags &= ~KEX_INIT_SENT;
195	xfree(kex->name);
196	kex->name = NULL;
197}
198
199void
200kex_send_kexinit(Kex *kex)
201{
202	u_int32_t rnd = 0;
203	u_char *cookie;
204	u_int i;
205
206	if (kex == NULL) {
207		error("kex_send_kexinit: no kex, cannot rekey");
208		return;
209	}
210	if (kex->flags & KEX_INIT_SENT) {
211		debug("KEX_INIT_SENT");
212		return;
213	}
214	kex->done = 0;
215
216	/* generate a random cookie */
217	if (buffer_len(&kex->my) < KEX_COOKIE_LEN)
218		fatal("kex_send_kexinit: kex proposal too short");
219	cookie = buffer_ptr(&kex->my);
220	for (i = 0; i < KEX_COOKIE_LEN; i++) {
221		if (i % 4 == 0)
222			rnd = arc4random();
223		cookie[i] = rnd;
224		rnd >>= 8;
225	}
226	packet_start(SSH2_MSG_KEXINIT);
227	packet_put_raw(buffer_ptr(&kex->my), buffer_len(&kex->my));
228	packet_send();
229	debug("SSH2_MSG_KEXINIT sent");
230	kex->flags |= KEX_INIT_SENT;
231}
232
233/* ARGSUSED */
234void
235kex_input_kexinit(int type, u_int32_t seq, void *ctxt)
236{
237	char *ptr;
238	u_int i, dlen;
239	Kex *kex = (Kex *)ctxt;
240
241	debug("SSH2_MSG_KEXINIT received");
242	if (kex == NULL)
243		fatal("kex_input_kexinit: no kex, cannot rekey");
244
245	ptr = packet_get_raw(&dlen);
246	buffer_append(&kex->peer, ptr, dlen);
247
248	/* discard packet */
249	for (i = 0; i < KEX_COOKIE_LEN; i++)
250		packet_get_char();
251	for (i = 0; i < PROPOSAL_MAX; i++)
252		xfree(packet_get_string(NULL));
253	/*
254	 * XXX RFC4253 sec 7: "each side MAY guess" - currently no supported
255	 * KEX method has the server move first, but a server might be using
256	 * a custom method or one that we otherwise don't support. We should
257	 * be prepared to remember first_kex_follows here so we can eat a
258	 * packet later.
259	 * XXX2 - RFC4253 is kind of ambiguous on what first_kex_follows means
260	 * for cases where the server *doesn't* go first. I guess we should
261	 * ignore it when it is set for these cases, which is what we do now.
262	 */
263	(void) packet_get_char();	/* first_kex_follows */
264	(void) packet_get_int();	/* reserved */
265	packet_check_eom();
266
267	kex_kexinit_finish(kex);
268}
269
270Kex *
271kex_setup(char *proposal[PROPOSAL_MAX])
272{
273	Kex *kex;
274
275	kex = xcalloc(1, sizeof(*kex));
276	buffer_init(&kex->peer);
277	buffer_init(&kex->my);
278	kex_prop2buf(&kex->my, proposal);
279	kex->done = 0;
280
281	kex_send_kexinit(kex);					/* we start */
282	kex_reset_dispatch();
283
284	return kex;
285}
286
287static void
288kex_kexinit_finish(Kex *kex)
289{
290	if (!(kex->flags & KEX_INIT_SENT))
291		kex_send_kexinit(kex);
292
293	kex_choose_conf(kex);
294
295	if (kex->kex_type >= 0 && kex->kex_type < KEX_MAX &&
296	    kex->kex[kex->kex_type] != NULL) {
297		(kex->kex[kex->kex_type])(kex);
298	} else {
299		fatal("Unsupported key exchange %d", kex->kex_type);
300	}
301}
302
303static void
304choose_enc(Enc *enc, char *client, char *server)
305{
306	char *name = match_list(client, server, NULL);
307	if (name == NULL)
308		fatal("no matching cipher found: client %s server %s",
309		    client, server);
310	if ((enc->cipher = cipher_by_name(name)) == NULL)
311		fatal("matching cipher is not supported: %s", name);
312	enc->name = name;
313	enc->enabled = 0;
314	enc->iv = NULL;
315	enc->iv_len = cipher_ivlen(enc->cipher);
316	enc->key = NULL;
317	enc->key_len = cipher_keylen(enc->cipher);
318	enc->block_size = cipher_blocksize(enc->cipher);
319}
320
321static void
322choose_mac(Mac *mac, char *client, char *server)
323{
324	char *name = match_list(client, server, NULL);
325	if (name == NULL)
326		fatal("no matching mac found: client %s server %s",
327		    client, server);
328	if (mac_setup(mac, name) < 0)
329		fatal("unsupported mac %s", name);
330	/* truncate the key */
331	if (datafellows & SSH_BUG_HMAC)
332		mac->key_len = 16;
333	mac->name = name;
334	mac->key = NULL;
335	mac->enabled = 0;
336}
337
338static void
339choose_comp(Comp *comp, char *client, char *server)
340{
341	char *name = match_list(client, server, NULL);
342	if (name == NULL)
343		fatal("no matching comp found: client %s server %s", client, server);
344	if (strcmp(name, "zlib@openssh.com") == 0) {
345		comp->type = COMP_DELAYED;
346	} else if (strcmp(name, "zlib") == 0) {
347		comp->type = COMP_ZLIB;
348	} else if (strcmp(name, "none") == 0) {
349		comp->type = COMP_NONE;
350	} else {
351		fatal("unsupported comp %s", name);
352	}
353	comp->name = name;
354}
355
356static void
357choose_kex(Kex *k, char *client, char *server)
358{
359	k->name = match_list(client, server, NULL);
360	if (k->name == NULL)
361		fatal("Unable to negotiate a key exchange method");
362	if (strcmp(k->name, KEX_DH1) == 0) {
363		k->kex_type = KEX_DH_GRP1_SHA1;
364		k->evp_md = EVP_sha1();
365	} else if (strcmp(k->name, KEX_DH14) == 0) {
366		k->kex_type = KEX_DH_GRP14_SHA1;
367		k->evp_md = EVP_sha1();
368	} else if (strcmp(k->name, KEX_DHGEX_SHA1) == 0) {
369		k->kex_type = KEX_DH_GEX_SHA1;
370		k->evp_md = EVP_sha1();
371#if OPENSSL_VERSION_NUMBER >= 0x00907000L
372	} else if (strcmp(k->name, KEX_DHGEX_SHA256) == 0) {
373		k->kex_type = KEX_DH_GEX_SHA256;
374		k->evp_md = evp_ssh_sha256();
375	} else if (strncmp(k->name, KEX_ECDH_SHA2_STEM,
376	    sizeof(KEX_ECDH_SHA2_STEM) - 1) == 0) {
377 		k->kex_type = KEX_ECDH_SHA2;
378		k->evp_md = kex_ecdh_name_to_evpmd(k->name);
379#endif
380#ifdef GSSAPI
381	} else if (strncmp(k->name, KEX_GSS_GEX_SHA1_ID,
382	    sizeof(KEX_GSS_GEX_SHA1_ID) - 1) == 0) {
383		k->kex_type = KEX_GSS_GEX_SHA1;
384		k->evp_md = EVP_sha1();
385	} else if (strncmp(k->name, KEX_GSS_GRP1_SHA1_ID,
386	    sizeof(KEX_GSS_GRP1_SHA1_ID) - 1) == 0) {
387		k->kex_type = KEX_GSS_GRP1_SHA1;
388		k->evp_md = EVP_sha1();
389	} else if (strncmp(k->name, KEX_GSS_GRP14_SHA1_ID,
390	    sizeof(KEX_GSS_GRP14_SHA1_ID) - 1) == 0) {
391		k->kex_type = KEX_GSS_GRP14_SHA1;
392		k->evp_md = EVP_sha1();
393#endif
394	} else
395		fatal("bad kex alg %s", k->name);
396}
397
398static void
399choose_hostkeyalg(Kex *k, char *client, char *server)
400{
401	char *hostkeyalg = match_list(client, server, NULL);
402	if (hostkeyalg == NULL)
403		fatal("no hostkey alg");
404	k->hostkey_type = key_type_from_name(hostkeyalg);
405	if (k->hostkey_type == KEY_UNSPEC)
406		fatal("bad hostkey alg '%s'", hostkeyalg);
407	xfree(hostkeyalg);
408}
409
410static int
411proposals_match(char *my[PROPOSAL_MAX], char *peer[PROPOSAL_MAX])
412{
413	static int check[] = {
414		PROPOSAL_KEX_ALGS, PROPOSAL_SERVER_HOST_KEY_ALGS, -1
415	};
416	int *idx;
417	char *p;
418
419	for (idx = &check[0]; *idx != -1; idx++) {
420		if ((p = strchr(my[*idx], ',')) != NULL)
421			*p = '\0';
422		if ((p = strchr(peer[*idx], ',')) != NULL)
423			*p = '\0';
424		if (strcmp(my[*idx], peer[*idx]) != 0) {
425			debug2("proposal mismatch: my %s peer %s",
426			    my[*idx], peer[*idx]);
427			return (0);
428		}
429	}
430	debug2("proposals match");
431	return (1);
432}
433
434static void
435kex_choose_conf(Kex *kex)
436{
437	Newkeys *newkeys;
438	char **my, **peer;
439	char **cprop, **sprop;
440	int nenc, nmac, ncomp;
441	u_int mode, ctos, need, authlen;
442	int first_kex_follows, type;
443
444	my   = kex_buf2prop(&kex->my, NULL);
445	peer = kex_buf2prop(&kex->peer, &first_kex_follows);
446
447	if (kex->server) {
448		cprop=peer;
449		sprop=my;
450	} else {
451		cprop=my;
452		sprop=peer;
453	}
454
455	/* Check whether server offers roaming */
456	if (!kex->server) {
457		char *roaming;
458		roaming = match_list(KEX_RESUME, peer[PROPOSAL_KEX_ALGS], NULL);
459		if (roaming) {
460			kex->roaming = 1;
461			xfree(roaming);
462		}
463	}
464
465	/* Algorithm Negotiation */
466	for (mode = 0; mode < MODE_MAX; mode++) {
467		newkeys = xcalloc(1, sizeof(*newkeys));
468		kex->newkeys[mode] = newkeys;
469		ctos = (!kex->server && mode == MODE_OUT) ||
470		    (kex->server && mode == MODE_IN);
471		nenc  = ctos ? PROPOSAL_ENC_ALGS_CTOS  : PROPOSAL_ENC_ALGS_STOC;
472		nmac  = ctos ? PROPOSAL_MAC_ALGS_CTOS  : PROPOSAL_MAC_ALGS_STOC;
473		ncomp = ctos ? PROPOSAL_COMP_ALGS_CTOS : PROPOSAL_COMP_ALGS_STOC;
474		choose_enc(&newkeys->enc, cprop[nenc], sprop[nenc]);
475		/* ignore mac for authenticated encryption */
476		authlen = cipher_authlen(newkeys->enc.cipher);
477		if (authlen == 0)
478			choose_mac(&newkeys->mac, cprop[nmac], sprop[nmac]);
479		choose_comp(&newkeys->comp, cprop[ncomp], sprop[ncomp]);
480		debug("kex: %s %s %s %s",
481		    ctos ? "client->server" : "server->client",
482		    newkeys->enc.name,
483		    authlen == 0 ? newkeys->mac.name : "<implicit>",
484		    newkeys->comp.name);
485	}
486	choose_kex(kex, cprop[PROPOSAL_KEX_ALGS], sprop[PROPOSAL_KEX_ALGS]);
487	choose_hostkeyalg(kex, cprop[PROPOSAL_SERVER_HOST_KEY_ALGS],
488	    sprop[PROPOSAL_SERVER_HOST_KEY_ALGS]);
489	need = 0;
490	for (mode = 0; mode < MODE_MAX; mode++) {
491		newkeys = kex->newkeys[mode];
492		if (need < newkeys->enc.key_len)
493			need = newkeys->enc.key_len;
494		if (need < newkeys->enc.block_size)
495			need = newkeys->enc.block_size;
496		if (need < newkeys->enc.iv_len)
497			need = newkeys->enc.iv_len;
498		if (need < newkeys->mac.key_len)
499			need = newkeys->mac.key_len;
500	}
501	/* XXX need runden? */
502	kex->we_need = need;
503
504	/* ignore the next message if the proposals do not match */
505	if (first_kex_follows && !proposals_match(my, peer) &&
506	    !(datafellows & SSH_BUG_FIRSTKEX)) {
507		type = packet_read();
508		debug2("skipping next packet (type %u)", type);
509	}
510
511	kex_prop_free(my);
512	kex_prop_free(peer);
513}
514
515static u_char *
516derive_key(Kex *kex, int id, u_int need, u_char *hash, u_int hashlen,
517    BIGNUM *shared_secret)
518{
519	Buffer b;
520	EVP_MD_CTX md;
521	char c = id;
522	u_int have;
523	int mdsz;
524	u_char *digest;
525
526	if ((mdsz = EVP_MD_size(kex->evp_md)) <= 0)
527		fatal("bad kex md size %d", mdsz);
528	digest = xmalloc(roundup(need, mdsz));
529
530	buffer_init(&b);
531	buffer_put_bignum2(&b, shared_secret);
532
533	/* K1 = HASH(K || H || "A" || session_id) */
534	EVP_DigestInit(&md, kex->evp_md);
535	if (!(datafellows & SSH_BUG_DERIVEKEY))
536		EVP_DigestUpdate(&md, buffer_ptr(&b), buffer_len(&b));
537	EVP_DigestUpdate(&md, hash, hashlen);
538	EVP_DigestUpdate(&md, &c, 1);
539	EVP_DigestUpdate(&md, kex->session_id, kex->session_id_len);
540	EVP_DigestFinal(&md, digest, NULL);
541
542	/*
543	 * expand key:
544	 * Kn = HASH(K || H || K1 || K2 || ... || Kn-1)
545	 * Key = K1 || K2 || ... || Kn
546	 */
547	for (have = mdsz; need > have; have += mdsz) {
548		EVP_DigestInit(&md, kex->evp_md);
549		if (!(datafellows & SSH_BUG_DERIVEKEY))
550			EVP_DigestUpdate(&md, buffer_ptr(&b), buffer_len(&b));
551		EVP_DigestUpdate(&md, hash, hashlen);
552		EVP_DigestUpdate(&md, digest, have);
553		EVP_DigestFinal(&md, digest + have, NULL);
554	}
555	buffer_free(&b);
556#ifdef DEBUG_KEX
557	fprintf(stderr, "key '%c'== ", c);
558	dump_digest("key", digest, need);
559#endif
560	return digest;
561}
562
563Newkeys *current_keys[MODE_MAX];
564
565#define NKEYS	6
566void
567kex_derive_keys(Kex *kex, u_char *hash, u_int hashlen, BIGNUM *shared_secret)
568{
569	u_char *keys[NKEYS];
570	u_int i, mode, ctos;
571
572	for (i = 0; i < NKEYS; i++) {
573		keys[i] = derive_key(kex, 'A'+i, kex->we_need, hash, hashlen,
574		    shared_secret);
575	}
576
577	debug2("kex_derive_keys");
578	for (mode = 0; mode < MODE_MAX; mode++) {
579		current_keys[mode] = kex->newkeys[mode];
580		kex->newkeys[mode] = NULL;
581		ctos = (!kex->server && mode == MODE_OUT) ||
582		    (kex->server && mode == MODE_IN);
583		current_keys[mode]->enc.iv  = keys[ctos ? 0 : 1];
584		current_keys[mode]->enc.key = keys[ctos ? 2 : 3];
585		current_keys[mode]->mac.key = keys[ctos ? 4 : 5];
586	}
587}
588
589Newkeys *
590kex_get_newkeys(int mode)
591{
592	Newkeys *ret;
593
594	ret = current_keys[mode];
595	current_keys[mode] = NULL;
596	return ret;
597}
598
599void
600derive_ssh1_session_id(BIGNUM *host_modulus, BIGNUM *server_modulus,
601    u_int8_t cookie[8], u_int8_t id[16])
602{
603	const EVP_MD *evp_md = EVP_md5();
604	EVP_MD_CTX md;
605	u_int8_t nbuf[2048], obuf[EVP_MAX_MD_SIZE];
606	int len;
607
608	EVP_DigestInit(&md, evp_md);
609
610	len = BN_num_bytes(host_modulus);
611	if (len < (512 / 8) || (u_int)len > sizeof(nbuf))
612		fatal("%s: bad host modulus (len %d)", __func__, len);
613	BN_bn2bin(host_modulus, nbuf);
614	EVP_DigestUpdate(&md, nbuf, len);
615
616	len = BN_num_bytes(server_modulus);
617	if (len < (512 / 8) || (u_int)len > sizeof(nbuf))
618		fatal("%s: bad server modulus (len %d)", __func__, len);
619	BN_bn2bin(server_modulus, nbuf);
620	EVP_DigestUpdate(&md, nbuf, len);
621
622	EVP_DigestUpdate(&md, cookie, 8);
623
624	EVP_DigestFinal(&md, obuf, NULL);
625	memcpy(id, obuf, 16);
626
627	memset(nbuf, 0, sizeof(nbuf));
628	memset(obuf, 0, sizeof(obuf));
629	memset(&md, 0, sizeof(md));
630}
631
632#if defined(DEBUG_KEX) || defined(DEBUG_KEXDH) || defined(DEBUG_KEXECDH)
633void
634dump_digest(char *msg, u_char *digest, int len)
635{
636	int i;
637
638	fprintf(stderr, "%s\n", msg);
639	for (i = 0; i < len; i++) {
640		fprintf(stderr, "%02x", digest[i]);
641		if (i%32 == 31)
642			fprintf(stderr, "\n");
643		else if (i%8 == 7)
644			fprintf(stderr, " ");
645	}
646	fprintf(stderr, "\n");
647}
648#endif
649