/src/hpn-ssh/kexgen.c

Source (jump to first uncovered line)
/* $OpenBSD: kexgen.c,v 1.10 2024/09/09 02:39:57 djm Exp $ */
/*
 * Copyright (c) 2019 Markus Friedl.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */

#include "includes.h"

#include <sys/types.h>

#include <stdarg.h>
#include <stdio.h>
#include <string.h>
#include <signal.h>

#include "sshkey.h"
#include "kex.h"
#include "log.h"
#include "packet.h"
#include "ssh2.h"
#include "sshbuf.h"
#include "digest.h"
#include "ssherr.h"

static int input_kex_gen_init(int, u_int32_t, struct ssh *);
static int input_kex_gen_reply(int type, u_int32_t seq, struct ssh *ssh);

static int
kex_gen_hash(
    int hash_alg,
    const struct sshbuf *client_version,
    const struct sshbuf *server_version,
    const struct sshbuf *client_kexinit,
    const struct sshbuf *server_kexinit,
    const struct sshbuf *server_host_key_blob,
    const struct sshbuf *client_pub,
    const struct sshbuf *server_pub,
    const struct sshbuf *shared_secret,
    u_char *hash, size_t *hashlen)
{
  struct sshbuf *b;
  int r;

  if (*hashlen < ssh_digest_bytes(hash_alg))
    return SSH_ERR_INVALID_ARGUMENT;
  if ((b = sshbuf_new()) == NULL)
    return SSH_ERR_ALLOC_FAIL;
  if ((r = sshbuf_put_stringb(b, client_version)) != 0 ||
      (r = sshbuf_put_stringb(b, server_version)) != 0 ||
      /* kexinit messages: fake header: len+SSH2_MSG_KEXINIT */
      (r = sshbuf_put_u32(b, sshbuf_len(client_kexinit) + 1)) != 0 ||
      (r = sshbuf_put_u8(b, SSH2_MSG_KEXINIT)) != 0 ||
      (r = sshbuf_putb(b, client_kexinit)) != 0 ||
      (r = sshbuf_put_u32(b, sshbuf_len(server_kexinit) + 1)) != 0 ||
      (r = sshbuf_put_u8(b, SSH2_MSG_KEXINIT)) != 0 ||
      (r = sshbuf_putb(b, server_kexinit)) != 0 ||
      (r = sshbuf_put_stringb(b, server_host_key_blob)) != 0 ||
      (r = sshbuf_put_stringb(b, client_pub)) != 0 ||
      (r = sshbuf_put_stringb(b, server_pub)) != 0 ||
      (r = sshbuf_putb(b, shared_secret)) != 0) {
    sshbuf_free(b);
    return r;
  }
#ifdef DEBUG_KEX
  sshbuf_dump(b, stderr);
#endif
  if (ssh_digest_buffer(hash_alg, b, hash, *hashlen) != 0) {
    sshbuf_free(b);
    return SSH_ERR_LIBCRYPTO_ERROR;
  }
  sshbuf_free(b);
  *hashlen = ssh_digest_bytes(hash_alg);
#ifdef DEBUG_KEX
  dump_digest("hash", hash, *hashlen);
#endif
  return 0;
}

int
kex_gen_client(struct ssh *ssh)
{
  struct kex *kex = ssh->kex;
  int r;

  switch (kex->kex_type) {
#ifdef WITH_OPENSSL
  case KEX_DH_GRP1_SHA1:
  case KEX_DH_GRP14_SHA1:
  case KEX_DH_GRP14_SHA256:
  case KEX_DH_GRP16_SHA512:
  case KEX_DH_GRP18_SHA512:
    r = kex_dh_keypair(kex);
    break;
  case KEX_ECDH_SHA2:
    r = kex_ecdh_keypair(kex);
    break;
#endif
  case KEX_C25519_SHA256:
    r = kex_c25519_keypair(kex);
    break;
  case KEX_KEM_SNTRUP761X25519_SHA512:
    r = kex_kem_sntrup761x25519_keypair(kex);
    break;
  case KEX_KEM_MLKEM768X25519_SHA256:
    r = kex_kem_mlkem768x25519_keypair(kex);
    break;
  default:
    r = SSH_ERR_INVALID_ARGUMENT;
    break;
  }
  if (r != 0)
    return r;
  if ((r = sshpkt_start(ssh, SSH2_MSG_KEX_ECDH_INIT)) != 0 ||
      (r = sshpkt_put_stringb(ssh, kex->client_pub)) != 0 ||
      (r = sshpkt_send(ssh)) != 0)
    return r;
  debug("expecting SSH2_MSG_KEX_ECDH_REPLY");
  ssh_dispatch_set(ssh, SSH2_MSG_KEX_ECDH_REPLY, &input_kex_gen_reply);
  return 0;
}

static int
input_kex_gen_reply(int type, u_int32_t seq, struct ssh *ssh)
{
  struct kex *kex = ssh->kex;
  struct sshkey *server_host_key = NULL;
  struct sshbuf *shared_secret = NULL;
  struct sshbuf *server_blob = NULL;
  struct sshbuf *tmp = NULL, *server_host_key_blob = NULL;
  u_char *signature = NULL;
  u_char hash[SSH_DIGEST_MAX_LENGTH];
  size_t slen, hashlen;
  int r;

  debug("SSH2_MSG_KEX_ECDH_REPLY received");
  ssh_dispatch_set(ssh, SSH2_MSG_KEX_ECDH_REPLY, &kex_protocol_error);

  /* hostkey */
  if ((r = sshpkt_getb_froms(ssh, &server_host_key_blob)) != 0)
    goto out;
  /* sshkey_fromb() consumes its buffer, so make a copy */
  if ((tmp = sshbuf_fromb(server_host_key_blob)) == NULL) {
    r = SSH_ERR_ALLOC_FAIL;
    goto out;
  }
  if ((r = sshkey_fromb(tmp, &server_host_key)) != 0)
    goto out;
  if ((r = kex_verify_host_key(ssh, server_host_key)) != 0)
    goto out;

  /* Q_S, server public key */
  /* signed H */
  if ((r = sshpkt_getb_froms(ssh, &server_blob)) != 0 ||
      (r = sshpkt_get_string(ssh, &signature, &slen)) != 0 ||
      (r = sshpkt_get_end(ssh)) != 0)
    goto out;

  /* compute shared secret */
  switch (kex->kex_type) {
#ifdef WITH_OPENSSL
  case KEX_DH_GRP1_SHA1:
  case KEX_DH_GRP14_SHA1:
  case KEX_DH_GRP14_SHA256:
  case KEX_DH_GRP16_SHA512:
  case KEX_DH_GRP18_SHA512:
    r = kex_dh_dec(kex, server_blob, &shared_secret);
    break;
  case KEX_ECDH_SHA2:
    r = kex_ecdh_dec(kex, server_blob, &shared_secret);
    break;
#endif
  case KEX_C25519_SHA256:
    r = kex_c25519_dec(kex, server_blob, &shared_secret);
    break;
  case KEX_KEM_SNTRUP761X25519_SHA512:
    r = kex_kem_sntrup761x25519_dec(kex, server_blob,
        &shared_secret);
    break;
  case KEX_KEM_MLKEM768X25519_SHA256:
    r = kex_kem_mlkem768x25519_dec(kex, server_blob,
        &shared_secret);
    break;
  default:
    r = SSH_ERR_INVALID_ARGUMENT;
    break;
  }
  if (r !=0 )
    goto out;

  /* calc and verify H */
  hashlen = sizeof(hash);
  if ((r = kex_gen_hash(
      kex->hash_alg,
      kex->client_version,
      kex->server_version,
      kex->my,
      kex->peer,
      server_host_key_blob,
      kex->client_pub,
      server_blob,
      shared_secret,
      hash, &hashlen)) != 0)
    goto out;

  if ((r = sshkey_verify(server_host_key, signature, slen, hash, hashlen,
      kex->hostkey_alg, ssh->compat, NULL)) != 0)
    goto out;

  if ((r = kex_derive_keys(ssh, hash, hashlen, shared_secret)) != 0 ||
      (r = kex_send_newkeys(ssh)) != 0)
    goto out;

  /* save initial signature and hostkey */
  if ((kex->flags & KEX_INITIAL) != 0) {
    if (kex->initial_hostkey != NULL || kex->initial_sig != NULL) {
      r = SSH_ERR_INTERNAL_ERROR;
      goto out;
    }
    if ((kex->initial_sig = sshbuf_new()) == NULL) {
      r = SSH_ERR_ALLOC_FAIL;
      goto out;
    }
    if ((r = sshbuf_put(kex->initial_sig, signature, slen)) != 0)
      goto out;
    kex->initial_hostkey = server_host_key;
    server_host_key = NULL;
  }
  /* success */
out:
  explicit_bzero(hash, sizeof(hash));
  explicit_bzero(kex->c25519_client_key, sizeof(kex->c25519_client_key));
  explicit_bzero(kex->sntrup761_client_key,
      sizeof(kex->sntrup761_client_key));
  explicit_bzero(kex->mlkem768_client_key,
      sizeof(kex->mlkem768_client_key));
  sshbuf_free(server_host_key_blob);
  free(signature);
  sshbuf_free(tmp);
  sshkey_free(server_host_key);
  sshbuf_free(server_blob);
  sshbuf_free(shared_secret);
  sshbuf_free(kex->client_pub);
  kex->client_pub = NULL;
  return r;
}

int
kex_gen_server(struct ssh *ssh)
{
  debug("expecting SSH2_MSG_KEX_ECDH_INIT");
  ssh_dispatch_set(ssh, SSH2_MSG_KEX_ECDH_INIT, &input_kex_gen_init);
  return 0;
}

static int
input_kex_gen_init(int type, u_int32_t seq, struct ssh *ssh)
{
  struct kex *kex = ssh->kex;
  struct sshkey *server_host_private, *server_host_public;
  struct sshbuf *shared_secret = NULL;
  struct sshbuf *server_pubkey = NULL;
  struct sshbuf *client_pubkey = NULL;
  struct sshbuf *server_host_key_blob = NULL;
  u_char *signature = NULL, hash[SSH_DIGEST_MAX_LENGTH];
  size_t slen, hashlen;
  int r;

  debug("SSH2_MSG_KEX_ECDH_INIT received");
  ssh_dispatch_set(ssh, SSH2_MSG_KEX_ECDH_INIT, &kex_protocol_error);

  if ((r = kex_load_hostkey(ssh, &server_host_private,
      &server_host_public)) != 0)
    goto out;

  if ((r = sshpkt_getb_froms(ssh, &client_pubkey)) != 0 ||
      (r = sshpkt_get_end(ssh)) != 0)
    goto out;

  /* compute shared secret */
  switch (kex->kex_type) {
#ifdef WITH_OPENSSL
  case KEX_DH_GRP1_SHA1:
  case KEX_DH_GRP14_SHA1:
  case KEX_DH_GRP14_SHA256:
  case KEX_DH_GRP16_SHA512:
  case KEX_DH_GRP18_SHA512:
    r = kex_dh_enc(kex, client_pubkey, &server_pubkey,
        &shared_secret);
    break;
  case KEX_ECDH_SHA2:
    r = kex_ecdh_enc(kex, client_pubkey, &server_pubkey,
        &shared_secret);
    break;
#endif
  case KEX_C25519_SHA256:
    r = kex_c25519_enc(kex, client_pubkey, &server_pubkey,
        &shared_secret);
    break;
  case KEX_KEM_SNTRUP761X25519_SHA512:
    r = kex_kem_sntrup761x25519_enc(kex, client_pubkey,
        &server_pubkey, &shared_secret);
    break;
  case KEX_KEM_MLKEM768X25519_SHA256:
    r = kex_kem_mlkem768x25519_enc(kex, client_pubkey,
        &server_pubkey, &shared_secret);
    break;
  default:
    r = SSH_ERR_INVALID_ARGUMENT;
    break;
  }
  if (r !=0 )
    goto out;

  /* calc H */
  if ((server_host_key_blob = sshbuf_new()) == NULL) {
    r = SSH_ERR_ALLOC_FAIL;
    goto out;
  }
  if ((r = sshkey_putb(server_host_public, server_host_key_blob)) != 0)
    goto out;
  hashlen = sizeof(hash);
  if ((r = kex_gen_hash(
      kex->hash_alg,
      kex->client_version,
      kex->server_version,
      kex->peer,
      kex->my,
      server_host_key_blob,
      client_pubkey,
      server_pubkey,
      shared_secret,
      hash, &hashlen)) != 0)
    goto out;

  /* sign H */
  if ((r = kex->sign(ssh, server_host_private, server_host_public,
      &signature, &slen, hash, hashlen, kex->hostkey_alg)) != 0)
    goto out;

  /* send server hostkey, ECDH pubkey 'Q_S' and signed H */
  if ((r = sshpkt_start(ssh, SSH2_MSG_KEX_ECDH_REPLY)) != 0 ||
      (r = sshpkt_put_stringb(ssh, server_host_key_blob)) != 0 ||
      (r = sshpkt_put_stringb(ssh, server_pubkey)) != 0 ||
      (r = sshpkt_put_string(ssh, signature, slen)) != 0 ||
      (r = sshpkt_send(ssh)) != 0)
    goto out;

  if ((r = kex_derive_keys(ssh, hash, hashlen, shared_secret)) != 0 ||
      (r = kex_send_newkeys(ssh)) != 0)
    goto out;
  /* retain copy of hostkey used at initial KEX */
  if (kex->initial_hostkey == NULL &&
      (r = sshkey_from_private(server_host_public,
      &kex->initial_hostkey)) != 0)
    goto out;
  /* success */
out:
  explicit_bzero(hash, sizeof(hash));
  sshbuf_free(server_host_key_blob);
  free(signature);
  sshbuf_free(shared_secret);
  sshbuf_free(client_pubkey);
  sshbuf_free(server_pubkey);
  return r;
}

Coverage Report

Created: 2025-07-18 06:59

Line	Count	Source (jump to first uncovered line)
1		/* $OpenBSD: kexgen.c,v 1.10 2024/09/09 02:39:57 djm Exp $ */
2		/*
3		* Copyright (c) 2019 Markus Friedl. All rights reserved.
4		*
5		* Redistribution and use in source and binary forms, with or without
6		* modification, are permitted provided that the following conditions
7		* are met:
8		* 1. Redistributions of source code must retain the above copyright
9		* notice, this list of conditions and the following disclaimer.
10		* 2. Redistributions in binary form must reproduce the above copyright
11		* notice, this list of conditions and the following disclaimer in the
12		* documentation and/or other materials provided with the distribution.
13		*
14		* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
15		* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16		* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17		* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
18		* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19		* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20		* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21		* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22		* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23		* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24		*/
25
26		#include "includes.h"
27
28		#include <sys/types.h>
29
30		#include <stdarg.h>
31		#include <stdio.h>
32		#include <string.h>
33		#include <signal.h>
34
35		#include "sshkey.h"
36		#include "kex.h"
37		#include "log.h"
38		#include "packet.h"
39		#include "ssh2.h"
40		#include "sshbuf.h"
41		#include "digest.h"
42		#include "ssherr.h"
43
44		static int input_kex_gen_init(int, u_int32_t, struct ssh *);
45		static int input_kex_gen_reply(int type, u_int32_t seq, struct ssh *ssh);
46
47		static int
48		kex_gen_hash(
49		int hash_alg,
50		const struct sshbuf *client_version,
51		const struct sshbuf *server_version,
52		const struct sshbuf *client_kexinit,
53		const struct sshbuf *server_kexinit,
54		const struct sshbuf *server_host_key_blob,
55		const struct sshbuf *client_pub,
56		const struct sshbuf *server_pub,
57		const struct sshbuf *shared_secret,
58		u_char hash, size_t hashlen)
59	0	{
60	0	struct sshbuf *b;
61	0	int r;
62
63	0	if (*hashlen < ssh_digest_bytes(hash_alg))
64	0	return SSH_ERR_INVALID_ARGUMENT;
65	0	if ((b = sshbuf_new()) == NULL)
66	0	return SSH_ERR_ALLOC_FAIL;
67	0	if ((r = sshbuf_put_stringb(b, client_version)) != 0 \|\|
68	0	(r = sshbuf_put_stringb(b, server_version)) != 0 \|\|
69		/* kexinit messages: fake header: len+SSH2_MSG_KEXINIT */
70	0	(r = sshbuf_put_u32(b, sshbuf_len(client_kexinit) + 1)) != 0 \|\|
71	0	(r = sshbuf_put_u8(b, SSH2_MSG_KEXINIT)) != 0 \|\|
72	0	(r = sshbuf_putb(b, client_kexinit)) != 0 \|\|
73	0	(r = sshbuf_put_u32(b, sshbuf_len(server_kexinit) + 1)) != 0 \|\|
74	0	(r = sshbuf_put_u8(b, SSH2_MSG_KEXINIT)) != 0 \|\|
75	0	(r = sshbuf_putb(b, server_kexinit)) != 0 \|\|
76	0	(r = sshbuf_put_stringb(b, server_host_key_blob)) != 0 \|\|
77	0	(r = sshbuf_put_stringb(b, client_pub)) != 0 \|\|
78	0	(r = sshbuf_put_stringb(b, server_pub)) != 0 \|\|
79	0	(r = sshbuf_putb(b, shared_secret)) != 0) {
80	0	sshbuf_free(b);
81	0	return r;
82	0	}
83		#ifdef DEBUG_KEX
84		sshbuf_dump(b, stderr);
85		#endif
86	0	if (ssh_digest_buffer(hash_alg, b, hash, *hashlen) != 0) {
87	0	sshbuf_free(b);
88	0	return SSH_ERR_LIBCRYPTO_ERROR;
89	0	}
90	0	sshbuf_free(b);
91	0	*hashlen = ssh_digest_bytes(hash_alg);
92		#ifdef DEBUG_KEX
93		dump_digest("hash", hash, *hashlen);
94		#endif
95	0	return 0;
96	0	}
97
98		int
99		kex_gen_client(struct ssh *ssh)
100	0	{
101	0	struct kex *kex = ssh->kex;
102	0	int r;
103
104	0	switch (kex->kex_type) {
105	0	#ifdef WITH_OPENSSL
106	0	case KEX_DH_GRP1_SHA1:
107	0	case KEX_DH_GRP14_SHA1:
108	0	case KEX_DH_GRP14_SHA256:
109	0	case KEX_DH_GRP16_SHA512:
110	0	case KEX_DH_GRP18_SHA512:
111	0	r = kex_dh_keypair(kex);
112	0	break;
113	0	case KEX_ECDH_SHA2:
114	0	r = kex_ecdh_keypair(kex);
115	0	break;
116	0	#endif
117	0	case KEX_C25519_SHA256:
118	0	r = kex_c25519_keypair(kex);
119	0	break;
120	0	case KEX_KEM_SNTRUP761X25519_SHA512:
121	0	r = kex_kem_sntrup761x25519_keypair(kex);
122	0	break;
123	0	case KEX_KEM_MLKEM768X25519_SHA256:
124	0	r = kex_kem_mlkem768x25519_keypair(kex);
125	0	break;
126	0	default:
127	0	r = SSH_ERR_INVALID_ARGUMENT;
128	0	break;
129	0	}
130	0	if (r != 0)
131	0	return r;
132	0	if ((r = sshpkt_start(ssh, SSH2_MSG_KEX_ECDH_INIT)) != 0 \|\|
133	0	(r = sshpkt_put_stringb(ssh, kex->client_pub)) != 0 \|\|
134	0	(r = sshpkt_send(ssh)) != 0)
135	0	return r;
136	0	debug("expecting SSH2_MSG_KEX_ECDH_REPLY");
137	0	ssh_dispatch_set(ssh, SSH2_MSG_KEX_ECDH_REPLY, &input_kex_gen_reply);
138	0	return 0;
139	0	}
140
141		static int
142		input_kex_gen_reply(int type, u_int32_t seq, struct ssh *ssh)
143	0	{
144	0	struct kex *kex = ssh->kex;
145	0	struct sshkey *server_host_key = NULL;
146	0	struct sshbuf *shared_secret = NULL;
147	0	struct sshbuf *server_blob = NULL;
148	0	struct sshbuf tmp = NULL, server_host_key_blob = NULL;
149	0	u_char *signature = NULL;
150	0	u_char hash[SSH_DIGEST_MAX_LENGTH];
151	0	size_t slen, hashlen;
152	0	int r;
153
154	0	debug("SSH2_MSG_KEX_ECDH_REPLY received");
155	0	ssh_dispatch_set(ssh, SSH2_MSG_KEX_ECDH_REPLY, &kex_protocol_error);
156
157		/* hostkey */
158	0	if ((r = sshpkt_getb_froms(ssh, &server_host_key_blob)) != 0)
159	0	goto out;
160		/* sshkey_fromb() consumes its buffer, so make a copy */
161	0	if ((tmp = sshbuf_fromb(server_host_key_blob)) == NULL) {
162	0	r = SSH_ERR_ALLOC_FAIL;
163	0	goto out;
164	0	}
165	0	if ((r = sshkey_fromb(tmp, &server_host_key)) != 0)
166	0	goto out;
167	0	if ((r = kex_verify_host_key(ssh, server_host_key)) != 0)
168	0	goto out;
169
170		/* Q_S, server public key */
171		/* signed H */
172	0	if ((r = sshpkt_getb_froms(ssh, &server_blob)) != 0 \|\|
173	0	(r = sshpkt_get_string(ssh, &signature, &slen)) != 0 \|\|
174	0	(r = sshpkt_get_end(ssh)) != 0)
175	0	goto out;
176
177		/* compute shared secret */
178	0	switch (kex->kex_type) {
179	0	#ifdef WITH_OPENSSL
180	0	case KEX_DH_GRP1_SHA1:
181	0	case KEX_DH_GRP14_SHA1:
182	0	case KEX_DH_GRP14_SHA256:
183	0	case KEX_DH_GRP16_SHA512:
184	0	case KEX_DH_GRP18_SHA512:
185	0	r = kex_dh_dec(kex, server_blob, &shared_secret);
186	0	break;
187	0	case KEX_ECDH_SHA2:
188	0	r = kex_ecdh_dec(kex, server_blob, &shared_secret);
189	0	break;
190	0	#endif
191	0	case KEX_C25519_SHA256:
192	0	r = kex_c25519_dec(kex, server_blob, &shared_secret);
193	0	break;
194	0	case KEX_KEM_SNTRUP761X25519_SHA512:
195	0	r = kex_kem_sntrup761x25519_dec(kex, server_blob,
196	0	&shared_secret);
197	0	break;
198	0	case KEX_KEM_MLKEM768X25519_SHA256:
199	0	r = kex_kem_mlkem768x25519_dec(kex, server_blob,
200	0	&shared_secret);
201	0	break;
202	0	default:
203	0	r = SSH_ERR_INVALID_ARGUMENT;
204	0	break;
205	0	}
206	0	if (r !=0 )
207	0	goto out;
208
209		/* calc and verify H */
210	0	hashlen = sizeof(hash);
211	0	if ((r = kex_gen_hash(
212	0	kex->hash_alg,
213	0	kex->client_version,
214	0	kex->server_version,
215	0	kex->my,
216	0	kex->peer,
217	0	server_host_key_blob,
218	0	kex->client_pub,
219	0	server_blob,
220	0	shared_secret,
221	0	hash, &hashlen)) != 0)
222	0	goto out;
223
224	0	if ((r = sshkey_verify(server_host_key, signature, slen, hash, hashlen,
225	0	kex->hostkey_alg, ssh->compat, NULL)) != 0)
226	0	goto out;
227
228	0	if ((r = kex_derive_keys(ssh, hash, hashlen, shared_secret)) != 0 \|\|
229	0	(r = kex_send_newkeys(ssh)) != 0)
230	0	goto out;
231
232		/* save initial signature and hostkey */
233	0	if ((kex->flags & KEX_INITIAL) != 0) {
234	0	if (kex->initial_hostkey != NULL \|\| kex->initial_sig != NULL) {
235	0	r = SSH_ERR_INTERNAL_ERROR;
236	0	goto out;
237	0	}
238	0	if ((kex->initial_sig = sshbuf_new()) == NULL) {
239	0	r = SSH_ERR_ALLOC_FAIL;
240	0	goto out;
241	0	}
242	0	if ((r = sshbuf_put(kex->initial_sig, signature, slen)) != 0)
243	0	goto out;
244	0	kex->initial_hostkey = server_host_key;
245	0	server_host_key = NULL;
246	0	}
247		/* success */
248	0	out:
249	0	explicit_bzero(hash, sizeof(hash));
250	0	explicit_bzero(kex->c25519_client_key, sizeof(kex->c25519_client_key));
251	0	explicit_bzero(kex->sntrup761_client_key,
252	0	sizeof(kex->sntrup761_client_key));
253	0	explicit_bzero(kex->mlkem768_client_key,
254	0	sizeof(kex->mlkem768_client_key));
255	0	sshbuf_free(server_host_key_blob);
256	0	free(signature);
257	0	sshbuf_free(tmp);
258	0	sshkey_free(server_host_key);
259	0	sshbuf_free(server_blob);
260	0	sshbuf_free(shared_secret);
261	0	sshbuf_free(kex->client_pub);
262	0	kex->client_pub = NULL;
263	0	return r;
264	0	}
265
266		int
267		kex_gen_server(struct ssh *ssh)
268	0	{
269	0	debug("expecting SSH2_MSG_KEX_ECDH_INIT");
270	0	ssh_dispatch_set(ssh, SSH2_MSG_KEX_ECDH_INIT, &input_kex_gen_init);
271	0	return 0;
272	0	}
273
274		static int
275		input_kex_gen_init(int type, u_int32_t seq, struct ssh *ssh)
276	0	{
277	0	struct kex *kex = ssh->kex;
278	0	struct sshkey server_host_private, server_host_public;
279	0	struct sshbuf *shared_secret = NULL;
280	0	struct sshbuf *server_pubkey = NULL;
281	0	struct sshbuf *client_pubkey = NULL;
282	0	struct sshbuf *server_host_key_blob = NULL;
283	0	u_char *signature = NULL, hash[SSH_DIGEST_MAX_LENGTH];
284	0	size_t slen, hashlen;
285	0	int r;
286
287	0	debug("SSH2_MSG_KEX_ECDH_INIT received");
288	0	ssh_dispatch_set(ssh, SSH2_MSG_KEX_ECDH_INIT, &kex_protocol_error);
289
290	0	if ((r = kex_load_hostkey(ssh, &server_host_private,
291	0	&server_host_public)) != 0)
292	0	goto out;
293
294	0	if ((r = sshpkt_getb_froms(ssh, &client_pubkey)) != 0 \|\|
295	0	(r = sshpkt_get_end(ssh)) != 0)
296	0	goto out;
297
298		/* compute shared secret */
299	0	switch (kex->kex_type) {
300	0	#ifdef WITH_OPENSSL
301	0	case KEX_DH_GRP1_SHA1:
302	0	case KEX_DH_GRP14_SHA1:
303	0	case KEX_DH_GRP14_SHA256:
304	0	case KEX_DH_GRP16_SHA512:
305	0	case KEX_DH_GRP18_SHA512:
306	0	r = kex_dh_enc(kex, client_pubkey, &server_pubkey,
307	0	&shared_secret);
308	0	break;
309	0	case KEX_ECDH_SHA2:
310	0	r = kex_ecdh_enc(kex, client_pubkey, &server_pubkey,
311	0	&shared_secret);
312	0	break;
313	0	#endif
314	0	case KEX_C25519_SHA256:
315	0	r = kex_c25519_enc(kex, client_pubkey, &server_pubkey,
316	0	&shared_secret);
317	0	break;
318	0	case KEX_KEM_SNTRUP761X25519_SHA512:
319	0	r = kex_kem_sntrup761x25519_enc(kex, client_pubkey,
320	0	&server_pubkey, &shared_secret);
321	0	break;
322	0	case KEX_KEM_MLKEM768X25519_SHA256:
323	0	r = kex_kem_mlkem768x25519_enc(kex, client_pubkey,
324	0	&server_pubkey, &shared_secret);
325	0	break;
326	0	default:
327	0	r = SSH_ERR_INVALID_ARGUMENT;
328	0	break;
329	0	}
330	0	if (r !=0 )
331	0	goto out;
332
333		/* calc H */
334	0	if ((server_host_key_blob = sshbuf_new()) == NULL) {
335	0	r = SSH_ERR_ALLOC_FAIL;
336	0	goto out;
337	0	}
338	0	if ((r = sshkey_putb(server_host_public, server_host_key_blob)) != 0)
339	0	goto out;
340	0	hashlen = sizeof(hash);
341	0	if ((r = kex_gen_hash(
342	0	kex->hash_alg,
343	0	kex->client_version,
344	0	kex->server_version,
345	0	kex->peer,
346	0	kex->my,
347	0	server_host_key_blob,
348	0	client_pubkey,
349	0	server_pubkey,
350	0	shared_secret,
351	0	hash, &hashlen)) != 0)
352	0	goto out;
353
354		/* sign H */
355	0	if ((r = kex->sign(ssh, server_host_private, server_host_public,
356	0	&signature, &slen, hash, hashlen, kex->hostkey_alg)) != 0)
357	0	goto out;
358
359		/* send server hostkey, ECDH pubkey 'Q_S' and signed H */
360	0	if ((r = sshpkt_start(ssh, SSH2_MSG_KEX_ECDH_REPLY)) != 0 \|\|
361	0	(r = sshpkt_put_stringb(ssh, server_host_key_blob)) != 0 \|\|
362	0	(r = sshpkt_put_stringb(ssh, server_pubkey)) != 0 \|\|
363	0	(r = sshpkt_put_string(ssh, signature, slen)) != 0 \|\|
364	0	(r = sshpkt_send(ssh)) != 0)
365	0	goto out;
366
367	0	if ((r = kex_derive_keys(ssh, hash, hashlen, shared_secret)) != 0 \|\|
368	0	(r = kex_send_newkeys(ssh)) != 0)
369	0	goto out;
370		/* retain copy of hostkey used at initial KEX */
371	0	if (kex->initial_hostkey == NULL &&
372	0	(r = sshkey_from_private(server_host_public,
373	0	&kex->initial_hostkey)) != 0)
374	0	goto out;
375		/* success */
376	0	out:
377	0	explicit_bzero(hash, sizeof(hash));
378	0	sshbuf_free(server_host_key_blob);
379	0	free(signature);
380	0	sshbuf_free(shared_secret);
381	0	sshbuf_free(client_pubkey);
382	0	sshbuf_free(server_pubkey);
383	0	return r;
384	0	}