1 /* $OpenBSD: kexgen.c,v 1.2 2019/01/23 00:30:41 djm Exp $ */ 2 /* 3 * Copyright (c) 2019 Markus Friedl. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 15 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 16 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 17 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 18 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 19 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 20 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 21 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 23 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 24 */ 25 26 #include "includes.h" 27 28 #include <sys/types.h> 29 30 #include <stdio.h> 31 #include <string.h> 32 #include <signal.h> 33 34 #include "sshkey.h" 35 #include "kex.h" 36 #include "log.h" 37 #include "packet.h" 38 #include "ssh2.h" 39 #include "sshbuf.h" 40 #include "digest.h" 41 #include "ssherr.h" 42 43 static int input_kex_gen_init(int, u_int32_t, struct ssh *); 44 static int input_kex_gen_reply(int type, u_int32_t seq, struct ssh *ssh); 45 46 static int 47 kex_gen_hash( 48 int hash_alg, 49 const struct sshbuf *client_version, 50 const struct sshbuf *server_version, 51 const struct sshbuf *client_kexinit, 52 const struct sshbuf *server_kexinit, 53 const struct sshbuf *server_host_key_blob, 54 const struct sshbuf *client_pub, 55 const struct sshbuf *server_pub, 56 const struct sshbuf *shared_secret, 57 u_char *hash, size_t *hashlen) 58 { 59 struct sshbuf *b; 60 int r; 61 62 if (*hashlen < ssh_digest_bytes(hash_alg)) 63 return SSH_ERR_INVALID_ARGUMENT; 64 if ((b = sshbuf_new()) == NULL) 65 return SSH_ERR_ALLOC_FAIL; 66 if ((r = sshbuf_put_stringb(b, client_version)) != 0 || 67 (r = sshbuf_put_stringb(b, server_version)) != 0 || 68 /* kexinit messages: fake header: len+SSH2_MSG_KEXINIT */ 69 (r = sshbuf_put_u32(b, sshbuf_len(client_kexinit) + 1)) != 0 || 70 (r = sshbuf_put_u8(b, SSH2_MSG_KEXINIT)) != 0 || 71 (r = sshbuf_putb(b, client_kexinit)) != 0 || 72 (r = sshbuf_put_u32(b, sshbuf_len(server_kexinit) + 1)) != 0 || 73 (r = sshbuf_put_u8(b, SSH2_MSG_KEXINIT)) != 0 || 74 (r = sshbuf_putb(b, server_kexinit)) != 0 || 75 (r = sshbuf_put_stringb(b, server_host_key_blob)) != 0 || 76 (r = sshbuf_put_stringb(b, client_pub)) != 0 || 77 (r = sshbuf_put_stringb(b, server_pub)) != 0 || 78 (r = sshbuf_putb(b, shared_secret)) != 0) { 79 sshbuf_free(b); 80 return r; 81 } 82 #ifdef DEBUG_KEX 83 sshbuf_dump(b, stderr); 84 #endif 85 if (ssh_digest_buffer(hash_alg, b, hash, *hashlen) != 0) { 86 sshbuf_free(b); 87 return SSH_ERR_LIBCRYPTO_ERROR; 88 } 89 sshbuf_free(b); 90 *hashlen = ssh_digest_bytes(hash_alg); 91 #ifdef DEBUG_KEX 92 dump_digest("hash", hash, *hashlen); 93 #endif 94 return 0; 95 } 96 97 int 98 kex_gen_client(struct ssh *ssh) 99 { 100 struct kex *kex = ssh->kex; 101 int r; 102 103 switch (kex->kex_type) { 104 #ifdef WITH_OPENSSL 105 case KEX_DH_GRP1_SHA1: 106 case KEX_DH_GRP14_SHA1: 107 case KEX_DH_GRP14_SHA256: 108 case KEX_DH_GRP16_SHA512: 109 case KEX_DH_GRP18_SHA512: 110 r = kex_dh_keypair(kex); 111 break; 112 case KEX_ECDH_SHA2: 113 r = kex_ecdh_keypair(kex); 114 break; 115 #endif 116 case KEX_C25519_SHA256: 117 r = kex_c25519_keypair(kex); 118 break; 119 case KEX_KEM_SNTRUP4591761X25519_SHA512: 120 r = kex_kem_sntrup4591761x25519_keypair(kex); 121 break; 122 default: 123 r = SSH_ERR_INVALID_ARGUMENT; 124 break; 125 } 126 if (r != 0) 127 return r; 128 if ((r = sshpkt_start(ssh, SSH2_MSG_KEX_ECDH_INIT)) != 0 || 129 (r = sshpkt_put_stringb(ssh, kex->client_pub)) != 0 || 130 (r = sshpkt_send(ssh)) != 0) 131 return r; 132 debug("expecting SSH2_MSG_KEX_ECDH_REPLY"); 133 ssh_dispatch_set(ssh, SSH2_MSG_KEX_ECDH_REPLY, &input_kex_gen_reply); 134 return 0; 135 } 136 137 static int 138 input_kex_gen_reply(int type, u_int32_t seq, struct ssh *ssh) 139 { 140 struct kex *kex = ssh->kex; 141 struct sshkey *server_host_key = NULL; 142 struct sshbuf *shared_secret = NULL; 143 struct sshbuf *server_blob = NULL; 144 struct sshbuf *tmp = NULL, *server_host_key_blob = NULL; 145 u_char *signature = NULL; 146 u_char hash[SSH_DIGEST_MAX_LENGTH]; 147 size_t slen, hashlen; 148 int r; 149 150 /* hostkey */ 151 if ((r = sshpkt_getb_froms(ssh, &server_host_key_blob)) != 0) 152 goto out; 153 /* sshkey_fromb() consumes its buffer, so make a copy */ 154 if ((tmp = sshbuf_fromb(server_host_key_blob)) == NULL) { 155 r = SSH_ERR_ALLOC_FAIL; 156 goto out; 157 } 158 if ((r = sshkey_fromb(tmp, &server_host_key)) != 0) 159 goto out; 160 if ((r = kex_verify_host_key(ssh, server_host_key)) != 0) 161 goto out; 162 163 /* Q_S, server public key */ 164 /* signed H */ 165 if ((r = sshpkt_getb_froms(ssh, &server_blob)) != 0 || 166 (r = sshpkt_get_string(ssh, &signature, &slen)) != 0 || 167 (r = sshpkt_get_end(ssh)) != 0) 168 goto out; 169 170 /* compute shared secret */ 171 switch (kex->kex_type) { 172 #ifdef WITH_OPENSSL 173 case KEX_DH_GRP1_SHA1: 174 case KEX_DH_GRP14_SHA1: 175 case KEX_DH_GRP14_SHA256: 176 case KEX_DH_GRP16_SHA512: 177 case KEX_DH_GRP18_SHA512: 178 r = kex_dh_dec(kex, server_blob, &shared_secret); 179 break; 180 case KEX_ECDH_SHA2: 181 r = kex_ecdh_dec(kex, server_blob, &shared_secret); 182 break; 183 #endif 184 case KEX_C25519_SHA256: 185 r = kex_c25519_dec(kex, server_blob, &shared_secret); 186 break; 187 case KEX_KEM_SNTRUP4591761X25519_SHA512: 188 r = kex_kem_sntrup4591761x25519_dec(kex, server_blob, 189 &shared_secret); 190 break; 191 default: 192 r = SSH_ERR_INVALID_ARGUMENT; 193 break; 194 } 195 if (r !=0 ) 196 goto out; 197 198 /* calc and verify H */ 199 hashlen = sizeof(hash); 200 if ((r = kex_gen_hash( 201 kex->hash_alg, 202 kex->client_version, 203 kex->server_version, 204 kex->my, 205 kex->peer, 206 server_host_key_blob, 207 kex->client_pub, 208 server_blob, 209 shared_secret, 210 hash, &hashlen)) != 0) 211 goto out; 212 213 if ((r = sshkey_verify(server_host_key, signature, slen, hash, hashlen, 214 kex->hostkey_alg, ssh->compat)) != 0) 215 goto out; 216 217 if ((r = kex_derive_keys(ssh, hash, hashlen, shared_secret)) == 0) 218 r = kex_send_newkeys(ssh); 219 out: 220 explicit_bzero(hash, sizeof(hash)); 221 explicit_bzero(kex->c25519_client_key, sizeof(kex->c25519_client_key)); 222 explicit_bzero(kex->sntrup4591761_client_key, 223 sizeof(kex->sntrup4591761_client_key)); 224 sshbuf_free(server_host_key_blob); 225 free(signature); 226 sshbuf_free(tmp); 227 sshkey_free(server_host_key); 228 sshbuf_free(server_blob); 229 sshbuf_free(shared_secret); 230 sshbuf_free(kex->client_pub); 231 kex->client_pub = NULL; 232 return r; 233 } 234 235 int 236 kex_gen_server(struct ssh *ssh) 237 { 238 debug("expecting SSH2_MSG_KEX_ECDH_INIT"); 239 ssh_dispatch_set(ssh, SSH2_MSG_KEX_ECDH_INIT, &input_kex_gen_init); 240 return 0; 241 } 242 243 static int 244 input_kex_gen_init(int type, u_int32_t seq, struct ssh *ssh) 245 { 246 struct kex *kex = ssh->kex; 247 struct sshkey *server_host_private, *server_host_public; 248 struct sshbuf *shared_secret = NULL; 249 struct sshbuf *server_pubkey = NULL; 250 struct sshbuf *client_pubkey = NULL; 251 struct sshbuf *server_host_key_blob = NULL; 252 u_char *signature = NULL, hash[SSH_DIGEST_MAX_LENGTH]; 253 size_t slen, hashlen; 254 int r; 255 256 if ((r = kex_load_hostkey(ssh, &server_host_private, 257 &server_host_public)) != 0) 258 goto out; 259 260 if ((r = sshpkt_getb_froms(ssh, &client_pubkey)) != 0 || 261 (r = sshpkt_get_end(ssh)) != 0) 262 goto out; 263 264 /* compute shared secret */ 265 switch (kex->kex_type) { 266 #ifdef WITH_OPENSSL 267 case KEX_DH_GRP1_SHA1: 268 case KEX_DH_GRP14_SHA1: 269 case KEX_DH_GRP14_SHA256: 270 case KEX_DH_GRP16_SHA512: 271 case KEX_DH_GRP18_SHA512: 272 r = kex_dh_enc(kex, client_pubkey, &server_pubkey, 273 &shared_secret); 274 break; 275 case KEX_ECDH_SHA2: 276 r = kex_ecdh_enc(kex, client_pubkey, &server_pubkey, 277 &shared_secret); 278 break; 279 #endif 280 case KEX_C25519_SHA256: 281 r = kex_c25519_enc(kex, client_pubkey, &server_pubkey, 282 &shared_secret); 283 break; 284 case KEX_KEM_SNTRUP4591761X25519_SHA512: 285 r = kex_kem_sntrup4591761x25519_enc(kex, client_pubkey, 286 &server_pubkey, &shared_secret); 287 break; 288 default: 289 r = SSH_ERR_INVALID_ARGUMENT; 290 break; 291 } 292 if (r !=0 ) 293 goto out; 294 295 /* calc H */ 296 if ((server_host_key_blob = sshbuf_new()) == NULL) { 297 r = SSH_ERR_ALLOC_FAIL; 298 goto out; 299 } 300 if ((r = sshkey_putb(server_host_public, server_host_key_blob)) != 0) 301 goto out; 302 hashlen = sizeof(hash); 303 if ((r = kex_gen_hash( 304 kex->hash_alg, 305 kex->client_version, 306 kex->server_version, 307 kex->peer, 308 kex->my, 309 server_host_key_blob, 310 client_pubkey, 311 server_pubkey, 312 shared_secret, 313 hash, &hashlen)) != 0) 314 goto out; 315 316 /* sign H */ 317 if ((r = kex->sign(ssh, server_host_private, server_host_public, 318 &signature, &slen, hash, hashlen, kex->hostkey_alg)) != 0) 319 goto out; 320 321 /* send server hostkey, ECDH pubkey 'Q_S' and signed H */ 322 if ((r = sshpkt_start(ssh, SSH2_MSG_KEX_ECDH_REPLY)) != 0 || 323 (r = sshpkt_put_stringb(ssh, server_host_key_blob)) != 0 || 324 (r = sshpkt_put_stringb(ssh, server_pubkey)) != 0 || 325 (r = sshpkt_put_string(ssh, signature, slen)) != 0 || 326 (r = sshpkt_send(ssh)) != 0) 327 goto out; 328 329 if ((r = kex_derive_keys(ssh, hash, hashlen, shared_secret)) == 0) 330 r = kex_send_newkeys(ssh); 331 out: 332 explicit_bzero(hash, sizeof(hash)); 333 sshbuf_free(server_host_key_blob); 334 free(signature); 335 sshbuf_free(shared_secret); 336 sshbuf_free(client_pubkey); 337 sshbuf_free(server_pubkey); 338 return r; 339 } 340