xref: /dragonfly/crypto/openssh/kex.c (revision 25a2db75)
1 /* $OpenBSD: kex.c,v 1.86 2010/09/22 05:01:29 djm Exp $ */
2 /*
3  * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
15  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
18  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24  */
25 
26 #include "includes.h"
27 
28 #include <sys/param.h>
29 
30 #include <signal.h>
31 #include <stdarg.h>
32 #include <stdio.h>
33 #include <stdlib.h>
34 #include <string.h>
35 
36 #include <openssl/crypto.h>
37 
38 #include "xmalloc.h"
39 #include "ssh2.h"
40 #include "buffer.h"
41 #include "packet.h"
42 #include "compat.h"
43 #include "cipher.h"
44 #include "key.h"
45 #include "kex.h"
46 #include "log.h"
47 #include "mac.h"
48 #include "match.h"
49 #include "dispatch.h"
50 #include "monitor.h"
51 #include "roaming.h"
52 #include "canohost.h"
53 
54 #if OPENSSL_VERSION_NUMBER >= 0x00907000L
55 # if defined(HAVE_EVP_SHA256)
56 # define evp_ssh_sha256 EVP_sha256
57 # else
58 extern const EVP_MD *evp_ssh_sha256(void);
59 # endif
60 #endif
61 
62 /* prototype */
63 static void kex_kexinit_finish(Kex *);
64 static void kex_choose_conf(Kex *);
65 
66 /* Validate KEX method name list */
67 int
68 kex_names_valid(const char *names)
69 {
70 	char *s, *cp, *p;
71 
72 	if (names == NULL || strcmp(names, "") == 0)
73 		return 0;
74 	s = cp = xstrdup(names);
75 	for ((p = strsep(&cp, ",")); p && *p != '\0';
76 	    (p = strsep(&cp, ","))) {
77 	    	if (strcmp(p, KEX_DHGEX_SHA256) != 0 &&
78 		    strcmp(p, KEX_DHGEX_SHA1) != 0 &&
79 		    strcmp(p, KEX_DH14) != 0 &&
80 		    strcmp(p, KEX_DH1) != 0 &&
81 		    (strncmp(p, KEX_ECDH_SHA2_STEM,
82 		    sizeof(KEX_ECDH_SHA2_STEM) - 1) != 0 ||
83 		    kex_ecdh_name_to_nid(p) == -1)) {
84 			error("Unsupported KEX algorithm \"%.100s\"", p);
85 			xfree(s);
86 			return 0;
87 		}
88 	}
89 	debug3("kex names ok: [%s]", names);
90 	xfree(s);
91 	return 1;
92 }
93 
94 /* put algorithm proposal into buffer */
95 /* used in sshconnect.c as well as kex.c */
96 void
97 kex_prop2buf(Buffer *b, char *proposal[PROPOSAL_MAX])
98 {
99 	u_int i;
100 
101 	buffer_clear(b);
102 	/*
103 	 * add a dummy cookie, the cookie will be overwritten by
104 	 * kex_send_kexinit(), each time a kexinit is set
105 	 */
106 	for (i = 0; i < KEX_COOKIE_LEN; i++)
107 		buffer_put_char(b, 0);
108 	for (i = 0; i < PROPOSAL_MAX; i++)
109 		buffer_put_cstring(b, proposal[i]);
110 	buffer_put_char(b, 0);			/* first_kex_packet_follows */
111 	buffer_put_int(b, 0);			/* uint32 reserved */
112 }
113 
114 /* parse buffer and return algorithm proposal */
115 static char **
116 kex_buf2prop(Buffer *raw, int *first_kex_follows)
117 {
118 	Buffer b;
119 	u_int i;
120 	char **proposal;
121 
122 	proposal = xcalloc(PROPOSAL_MAX, sizeof(char *));
123 
124 	buffer_init(&b);
125 	buffer_append(&b, buffer_ptr(raw), buffer_len(raw));
126 	/* skip cookie */
127 	for (i = 0; i < KEX_COOKIE_LEN; i++)
128 		buffer_get_char(&b);
129 	/* extract kex init proposal strings */
130 	for (i = 0; i < PROPOSAL_MAX; i++) {
131 		proposal[i] = buffer_get_cstring(&b,NULL);
132 		debug2("kex_parse_kexinit: %s", proposal[i]);
133 	}
134 	/* first kex follows / reserved */
135 	i = buffer_get_char(&b);
136 	if (first_kex_follows != NULL)
137 		*first_kex_follows = i;
138 	debug2("kex_parse_kexinit: first_kex_follows %d ", i);
139 	i = buffer_get_int(&b);
140 	debug2("kex_parse_kexinit: reserved %u ", i);
141 	buffer_free(&b);
142 	return proposal;
143 }
144 
145 static void
146 kex_prop_free(char **proposal)
147 {
148 	u_int i;
149 
150 	for (i = 0; i < PROPOSAL_MAX; i++)
151 		xfree(proposal[i]);
152 	xfree(proposal);
153 }
154 
155 /* ARGSUSED */
156 static void
157 kex_protocol_error(int type, u_int32_t seq, void *ctxt)
158 {
159 	error("Hm, kex protocol error: type %d seq %u", type, seq);
160 }
161 
162 static void
163 kex_reset_dispatch(void)
164 {
165 	dispatch_range(SSH2_MSG_TRANSPORT_MIN,
166 	    SSH2_MSG_TRANSPORT_MAX, &kex_protocol_error);
167 	dispatch_set(SSH2_MSG_KEXINIT, &kex_input_kexinit);
168 }
169 
170 void
171 kex_finish(Kex *kex)
172 {
173 	kex_reset_dispatch();
174 
175 	packet_start(SSH2_MSG_NEWKEYS);
176 	packet_send();
177 	/* packet_write_wait(); */
178 	debug("SSH2_MSG_NEWKEYS sent");
179 
180 	debug("expecting SSH2_MSG_NEWKEYS");
181 	packet_read_expect(SSH2_MSG_NEWKEYS);
182 	packet_check_eom();
183 	debug("SSH2_MSG_NEWKEYS received");
184 
185 	kex->done = 1;
186 	buffer_clear(&kex->peer);
187 	/* buffer_clear(&kex->my); */
188 	kex->flags &= ~KEX_INIT_SENT;
189 	xfree(kex->name);
190 	kex->name = NULL;
191 }
192 
193 void
194 kex_send_kexinit(Kex *kex)
195 {
196 	u_int32_t rnd = 0;
197 	u_char *cookie;
198 	u_int i;
199 
200 	if (kex == NULL) {
201 		error("kex_send_kexinit: no kex, cannot rekey");
202 		return;
203 	}
204 	if (kex->flags & KEX_INIT_SENT) {
205 		debug("KEX_INIT_SENT");
206 		return;
207 	}
208 	kex->done = 0;
209 
210 	/* generate a random cookie */
211 	if (buffer_len(&kex->my) < KEX_COOKIE_LEN)
212 		fatal("kex_send_kexinit: kex proposal too short");
213 	cookie = buffer_ptr(&kex->my);
214 	for (i = 0; i < KEX_COOKIE_LEN; i++) {
215 		if (i % 4 == 0)
216 			rnd = arc4random();
217 		cookie[i] = rnd;
218 		rnd >>= 8;
219 	}
220 	packet_start(SSH2_MSG_KEXINIT);
221 	packet_put_raw(buffer_ptr(&kex->my), buffer_len(&kex->my));
222 	packet_send();
223 	debug("SSH2_MSG_KEXINIT sent");
224 	kex->flags |= KEX_INIT_SENT;
225 }
226 
227 /* ARGSUSED */
228 void
229 kex_input_kexinit(int type, u_int32_t seq, void *ctxt)
230 {
231 	char *ptr;
232 	u_int i, dlen;
233 	Kex *kex = (Kex *)ctxt;
234 
235 	debug("SSH2_MSG_KEXINIT received");
236 	if (kex == NULL)
237 		fatal("kex_input_kexinit: no kex, cannot rekey");
238 
239 	ptr = packet_get_raw(&dlen);
240 	buffer_append(&kex->peer, ptr, dlen);
241 
242 	/* discard packet */
243 	for (i = 0; i < KEX_COOKIE_LEN; i++)
244 		packet_get_char();
245 	for (i = 0; i < PROPOSAL_MAX; i++)
246 		xfree(packet_get_string(NULL));
247 	(void) packet_get_char();
248 	(void) packet_get_int();
249 	packet_check_eom();
250 
251 	kex_kexinit_finish(kex);
252 }
253 
254 Kex *
255 kex_setup(char *proposal[PROPOSAL_MAX])
256 {
257 	Kex *kex;
258 
259 	kex = xcalloc(1, sizeof(*kex));
260 	buffer_init(&kex->peer);
261 	buffer_init(&kex->my);
262 	kex_prop2buf(&kex->my, proposal);
263 	kex->done = 0;
264 
265 	kex_send_kexinit(kex);					/* we start */
266 	kex_reset_dispatch();
267 
268 	return kex;
269 }
270 
271 static void
272 kex_kexinit_finish(Kex *kex)
273 {
274 	if (!(kex->flags & KEX_INIT_SENT))
275 		kex_send_kexinit(kex);
276 
277 	kex_choose_conf(kex);
278 
279 	if (kex->kex_type >= 0 && kex->kex_type < KEX_MAX &&
280 	    kex->kex[kex->kex_type] != NULL) {
281 		(kex->kex[kex->kex_type])(kex);
282 	} else {
283 		fatal("Unsupported key exchange %d", kex->kex_type);
284 	}
285 }
286 
287 static void
288 choose_enc(Enc *enc, char *client, char *server)
289 {
290 	char *name = match_list(client, server, NULL);
291 	if (name == NULL)
292 		fatal("no matching cipher found: client %s server %s",
293 		    client, server);
294 	if ((enc->cipher = cipher_by_name(name)) == NULL)
295 		fatal("matching cipher is not supported: %s", name);
296 	enc->name = name;
297 	enc->enabled = 0;
298 	enc->iv = NULL;
299 	enc->key = NULL;
300 	enc->key_len = cipher_keylen(enc->cipher);
301 	enc->block_size = cipher_blocksize(enc->cipher);
302 }
303 
304 static void
305 choose_mac(Mac *mac, char *client, char *server)
306 {
307 	char *name = match_list(client, server, NULL);
308 	if (name == NULL)
309 		fatal("no matching mac found: client %s server %s",
310 		    client, server);
311 	if (mac_setup(mac, name) < 0)
312 		fatal("unsupported mac %s", name);
313 	/* truncate the key */
314 	if (datafellows & SSH_BUG_HMAC)
315 		mac->key_len = 16;
316 	mac->name = name;
317 	mac->key = NULL;
318 	mac->enabled = 0;
319 }
320 
321 static void
322 choose_comp(Comp *comp, char *client, char *server)
323 {
324 	char *name = match_list(client, server, NULL);
325 	if (name == NULL)
326 		fatal("no matching comp found: client %s server %s", client, server);
327 	if (strcmp(name, "zlib@openssh.com") == 0) {
328 		comp->type = COMP_DELAYED;
329 	} else if (strcmp(name, "zlib") == 0) {
330 		comp->type = COMP_ZLIB;
331 	} else if (strcmp(name, "none") == 0) {
332 		comp->type = COMP_NONE;
333 	} else {
334 		fatal("unsupported comp %s", name);
335 	}
336 	comp->name = name;
337 }
338 
339 static void
340 choose_kex(Kex *k, char *client, char *server)
341 {
342 	k->name = match_list(client, server, NULL);
343 	if (k->name == NULL)
344 		fatal("Unable to negotiate a key exchange method");
345 	if (strcmp(k->name, KEX_DH1) == 0) {
346 		k->kex_type = KEX_DH_GRP1_SHA1;
347 		k->evp_md = EVP_sha1();
348 	} else if (strcmp(k->name, KEX_DH14) == 0) {
349 		k->kex_type = KEX_DH_GRP14_SHA1;
350 		k->evp_md = EVP_sha1();
351 	} else if (strcmp(k->name, KEX_DHGEX_SHA1) == 0) {
352 		k->kex_type = KEX_DH_GEX_SHA1;
353 		k->evp_md = EVP_sha1();
354 #if OPENSSL_VERSION_NUMBER >= 0x00907000L
355 	} else if (strcmp(k->name, KEX_DHGEX_SHA256) == 0) {
356 		k->kex_type = KEX_DH_GEX_SHA256;
357 		k->evp_md = evp_ssh_sha256();
358 	} else if (strncmp(k->name, KEX_ECDH_SHA2_STEM,
359 	    sizeof(KEX_ECDH_SHA2_STEM) - 1) == 0) {
360  		k->kex_type = KEX_ECDH_SHA2;
361 		k->evp_md = kex_ecdh_name_to_evpmd(k->name);
362 #endif
363 	} else
364 		fatal("bad kex alg %s", k->name);
365 }
366 
367 static void
368 choose_hostkeyalg(Kex *k, char *client, char *server)
369 {
370 	char *hostkeyalg = match_list(client, server, NULL);
371 	if (hostkeyalg == NULL)
372 		fatal("no hostkey alg");
373 	k->hostkey_type = key_type_from_name(hostkeyalg);
374 	if (k->hostkey_type == KEY_UNSPEC)
375 		fatal("bad hostkey alg '%s'", hostkeyalg);
376 	xfree(hostkeyalg);
377 }
378 
379 static int
380 proposals_match(char *my[PROPOSAL_MAX], char *peer[PROPOSAL_MAX])
381 {
382 	static int check[] = {
383 		PROPOSAL_KEX_ALGS, PROPOSAL_SERVER_HOST_KEY_ALGS, -1
384 	};
385 	int *idx;
386 	char *p;
387 
388 	for (idx = &check[0]; *idx != -1; idx++) {
389 		if ((p = strchr(my[*idx], ',')) != NULL)
390 			*p = '\0';
391 		if ((p = strchr(peer[*idx], ',')) != NULL)
392 			*p = '\0';
393 		if (strcmp(my[*idx], peer[*idx]) != 0) {
394 			debug2("proposal mismatch: my %s peer %s",
395 			    my[*idx], peer[*idx]);
396 			return (0);
397 		}
398 	}
399 	debug2("proposals match");
400 	return (1);
401 }
402 
403 static void
404 kex_choose_conf(Kex *kex)
405 {
406 	Newkeys *newkeys;
407 	char **my, **peer;
408 	char **cprop, **sprop;
409 	int nenc, nmac, ncomp;
410 	u_int mode, ctos, need;
411 	int first_kex_follows, type;
412 	int log_flag = 0;
413 
414 	int auth_flag;
415 
416 	auth_flag = packet_authentication_state();
417 
418 	debug ("AUTH STATE IS %d", auth_flag);
419 
420 	my   = kex_buf2prop(&kex->my, NULL);
421 	peer = kex_buf2prop(&kex->peer, &first_kex_follows);
422 
423 	if (kex->server) {
424 		cprop=peer;
425 		sprop=my;
426 	} else {
427 		cprop=my;
428 		sprop=peer;
429 	}
430 
431 	/* Check whether server offers roaming */
432 	if (!kex->server) {
433 		char *roaming;
434 		roaming = match_list(KEX_RESUME, peer[PROPOSAL_KEX_ALGS], NULL);
435 		if (roaming) {
436 			kex->roaming = 1;
437 			xfree(roaming);
438 		}
439 	}
440 
441 	/* Algorithm Negotiation */
442 	for (mode = 0; mode < MODE_MAX; mode++) {
443 		newkeys = xcalloc(1, sizeof(*newkeys));
444 		kex->newkeys[mode] = newkeys;
445 		ctos = (!kex->server && mode == MODE_OUT) ||
446 		    (kex->server && mode == MODE_IN);
447 		nenc  = ctos ? PROPOSAL_ENC_ALGS_CTOS  : PROPOSAL_ENC_ALGS_STOC;
448 		nmac  = ctos ? PROPOSAL_MAC_ALGS_CTOS  : PROPOSAL_MAC_ALGS_STOC;
449 		ncomp = ctos ? PROPOSAL_COMP_ALGS_CTOS : PROPOSAL_COMP_ALGS_STOC;
450 		choose_enc (&newkeys->enc,  cprop[nenc],  sprop[nenc]);
451 		choose_mac (&newkeys->mac,  cprop[nmac],  sprop[nmac]);
452 		choose_comp(&newkeys->comp, cprop[ncomp], sprop[ncomp]);
453 		debug("REQUESTED ENC.NAME is '%s'", newkeys->enc.name);
454 		if (strcmp(newkeys->enc.name, "none") == 0) {
455 				debug("Requesting NONE. Authflag is %d", auth_flag);
456 			if (auth_flag == 1) {
457 				debug("None requested post authentication.");
458 			} else {
459 				fatal("Pre-authentication none cipher requests are not allowed.");
460 			}
461 		}
462 		debug("kex: %s %s %s %s",
463 		    ctos ? "client->server" : "server->client",
464 		    newkeys->enc.name,
465 		    newkeys->mac.name,
466 		    newkeys->comp.name);
467 		/* client starts withctos = 0 && log flag = 0 and no log*/
468 		/* 2nd client pass ctos=1 and flag = 1 so no log*/
469 		/* server starts with ctos =1 && log_flag = 0 so log */
470 		/* 2nd sever pass ctos = 1 && log flag = 1 so no log*/
471 		/* -cjr*/
472 		if (ctos && !log_flag) {
473 			logit("SSH: Server;Ltype: Kex;Remote: %s-%d;Enc: %s;MAC: %s;Comp: %s",
474 			      get_remote_ipaddr(),
475 			      get_remote_port(),
476 			      newkeys->enc.name,
477 			      newkeys->mac.name,
478 			      newkeys->comp.name);
479 		}
480 		log_flag = 1;
481 	}
482 	choose_kex(kex, cprop[PROPOSAL_KEX_ALGS], sprop[PROPOSAL_KEX_ALGS]);
483 	choose_hostkeyalg(kex, cprop[PROPOSAL_SERVER_HOST_KEY_ALGS],
484 	    sprop[PROPOSAL_SERVER_HOST_KEY_ALGS]);
485 	need = 0;
486 	for (mode = 0; mode < MODE_MAX; mode++) {
487 		newkeys = kex->newkeys[mode];
488 		if (need < newkeys->enc.key_len)
489 			need = newkeys->enc.key_len;
490 		if (need < newkeys->enc.block_size)
491 			need = newkeys->enc.block_size;
492 		if (need < newkeys->mac.key_len)
493 			need = newkeys->mac.key_len;
494 	}
495 	/* XXX need runden? */
496 	kex->we_need = need;
497 
498 	/* ignore the next message if the proposals do not match */
499 	if (first_kex_follows && !proposals_match(my, peer) &&
500 	    !(datafellows & SSH_BUG_FIRSTKEX)) {
501 		type = packet_read();
502 		debug2("skipping next packet (type %u)", type);
503 	}
504 
505 	kex_prop_free(my);
506 	kex_prop_free(peer);
507 }
508 
509 static u_char *
510 derive_key(Kex *kex, int id, u_int need, u_char *hash, u_int hashlen,
511     BIGNUM *shared_secret)
512 {
513 	Buffer b;
514 	EVP_MD_CTX md;
515 	char c = id;
516 	u_int have;
517 	int mdsz;
518 	u_char *digest;
519 
520 	if ((mdsz = EVP_MD_size(kex->evp_md)) <= 0)
521 		fatal("bad kex md size %d", mdsz);
522 	digest = xmalloc(roundup(need, mdsz));
523 
524 	buffer_init(&b);
525 	buffer_put_bignum2(&b, shared_secret);
526 
527 	/* K1 = HASH(K || H || "A" || session_id) */
528 	EVP_DigestInit(&md, kex->evp_md);
529 	if (!(datafellows & SSH_BUG_DERIVEKEY))
530 		EVP_DigestUpdate(&md, buffer_ptr(&b), buffer_len(&b));
531 	EVP_DigestUpdate(&md, hash, hashlen);
532 	EVP_DigestUpdate(&md, &c, 1);
533 	EVP_DigestUpdate(&md, kex->session_id, kex->session_id_len);
534 	EVP_DigestFinal(&md, digest, NULL);
535 
536 	/*
537 	 * expand key:
538 	 * Kn = HASH(K || H || K1 || K2 || ... || Kn-1)
539 	 * Key = K1 || K2 || ... || Kn
540 	 */
541 	for (have = mdsz; need > have; have += mdsz) {
542 		EVP_DigestInit(&md, kex->evp_md);
543 		if (!(datafellows & SSH_BUG_DERIVEKEY))
544 			EVP_DigestUpdate(&md, buffer_ptr(&b), buffer_len(&b));
545 		EVP_DigestUpdate(&md, hash, hashlen);
546 		EVP_DigestUpdate(&md, digest, have);
547 		EVP_DigestFinal(&md, digest + have, NULL);
548 	}
549 	buffer_free(&b);
550 #ifdef DEBUG_KEX
551 	fprintf(stderr, "key '%c'== ", c);
552 	dump_digest("key", digest, need);
553 #endif
554 	return digest;
555 }
556 
557 Newkeys *current_keys[MODE_MAX];
558 
559 #define NKEYS	6
560 void
561 kex_derive_keys(Kex *kex, u_char *hash, u_int hashlen, BIGNUM *shared_secret)
562 {
563 	u_char *keys[NKEYS];
564 	u_int i, mode, ctos;
565 
566 	for (i = 0; i < NKEYS; i++) {
567 		keys[i] = derive_key(kex, 'A'+i, kex->we_need, hash, hashlen,
568 		    shared_secret);
569 	}
570 
571 	debug2("kex_derive_keys");
572 	for (mode = 0; mode < MODE_MAX; mode++) {
573 		current_keys[mode] = kex->newkeys[mode];
574 		kex->newkeys[mode] = NULL;
575 		ctos = (!kex->server && mode == MODE_OUT) ||
576 		    (kex->server && mode == MODE_IN);
577 		current_keys[mode]->enc.iv  = keys[ctos ? 0 : 1];
578 		current_keys[mode]->enc.key = keys[ctos ? 2 : 3];
579 		current_keys[mode]->mac.key = keys[ctos ? 4 : 5];
580 	}
581 }
582 
583 Newkeys *
584 kex_get_newkeys(int mode)
585 {
586 	Newkeys *ret;
587 
588 	ret = current_keys[mode];
589 	current_keys[mode] = NULL;
590 	return ret;
591 }
592 
593 void
594 derive_ssh1_session_id(BIGNUM *host_modulus, BIGNUM *server_modulus,
595     u_int8_t cookie[8], u_int8_t id[16])
596 {
597 	const EVP_MD *evp_md = EVP_md5();
598 	EVP_MD_CTX md;
599 	u_int8_t nbuf[2048], obuf[EVP_MAX_MD_SIZE];
600 	int len;
601 
602 	EVP_DigestInit(&md, evp_md);
603 
604 	len = BN_num_bytes(host_modulus);
605 	if (len < (512 / 8) || (u_int)len > sizeof(nbuf))
606 		fatal("%s: bad host modulus (len %d)", __func__, len);
607 	BN_bn2bin(host_modulus, nbuf);
608 	EVP_DigestUpdate(&md, nbuf, len);
609 
610 	len = BN_num_bytes(server_modulus);
611 	if (len < (512 / 8) || (u_int)len > sizeof(nbuf))
612 		fatal("%s: bad server modulus (len %d)", __func__, len);
613 	BN_bn2bin(server_modulus, nbuf);
614 	EVP_DigestUpdate(&md, nbuf, len);
615 
616 	EVP_DigestUpdate(&md, cookie, 8);
617 
618 	EVP_DigestFinal(&md, obuf, NULL);
619 	memcpy(id, obuf, 16);
620 
621 	memset(nbuf, 0, sizeof(nbuf));
622 	memset(obuf, 0, sizeof(obuf));
623 	memset(&md, 0, sizeof(md));
624 }
625 
626 #if defined(DEBUG_KEX) || defined(DEBUG_KEXDH) || defined(DEBUG_KEXECDH)
627 void
628 dump_digest(char *msg, u_char *digest, int len)
629 {
630 	int i;
631 
632 	fprintf(stderr, "%s\n", msg);
633 	for (i = 0; i < len; i++) {
634 		fprintf(stderr, "%02x", digest[i]);
635 		if (i%32 == 31)
636 			fprintf(stderr, "\n");
637 		else if (i%8 == 7)
638 			fprintf(stderr, " ");
639 	}
640 	fprintf(stderr, "\n");
641 }
642 #endif
643