/src/openssh/kexgen.c

Source
/* $OpenBSD: kexgen.c,v 1.14 2026/07/30 07:29:09 dtucker Exp $ */
/*
 * Copyright (c) 2019 Markus Friedl.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */

#include "includes.h"

#include <sys/types.h>

#include <stdarg.h>
#include <stdio.h>
#include <string.h>
#include <signal.h>

#include "sshkey.h"
#include "kex.h"
#include "log.h"
#include "packet.h"
#include "ssh2.h"
#include "sshbuf.h"
#include "digest.h"
#include "ssherr.h"

static int input_kex_gen_init(int, uint32_t, struct ssh *);
static int input_kex_gen_reply(int type, uint32_t seq, struct ssh *ssh);

static int
kex_gen_hash(
    int hash_alg,
    const struct sshbuf *client_version,
    const struct sshbuf *server_version,
    const struct sshbuf *client_kexinit,
    const struct sshbuf *server_kexinit,
    const struct sshbuf *server_host_key_blob,
    const struct sshbuf *client_pub,
    const struct sshbuf *server_pub,
    const struct sshbuf *shared_secret,
    u_char *hash, size_t *hashlen)
{
  struct sshbuf *b;
  int r;

  if (*hashlen < ssh_digest_bytes(hash_alg))
    return SSH_ERR_INVALID_ARGUMENT;
  if ((b = sshbuf_new()) == NULL)
    return SSH_ERR_ALLOC_FAIL;
  if ((r = sshbuf_put_stringb(b, client_version)) != 0 ||
      (r = sshbuf_put_stringb(b, server_version)) != 0 ||
      /* kexinit messages: fake header: len+SSH2_MSG_KEXINIT */
      (r = sshbuf_put_u32(b, sshbuf_len(client_kexinit) + 1)) != 0 ||
      (r = sshbuf_put_u8(b, SSH2_MSG_KEXINIT)) != 0 ||
      (r = sshbuf_putb(b, client_kexinit)) != 0 ||
      (r = sshbuf_put_u32(b, sshbuf_len(server_kexinit) + 1)) != 0 ||
      (r = sshbuf_put_u8(b, SSH2_MSG_KEXINIT)) != 0 ||
      (r = sshbuf_putb(b, server_kexinit)) != 0 ||
      (r = sshbuf_put_stringb(b, server_host_key_blob)) != 0 ||
      (r = sshbuf_put_stringb(b, client_pub)) != 0 ||
      (r = sshbuf_put_stringb(b, server_pub)) != 0 ||
      (r = sshbuf_putb(b, shared_secret)) != 0) {
    sshbuf_free(b);
    return r;
  }
#ifdef DEBUG_KEX
  sshbuf_dump(b, stderr);
#endif
  if (ssh_digest_buffer(hash_alg, b, hash, *hashlen) != 0) {
    sshbuf_free(b);
    return SSH_ERR_LIBCRYPTO_ERROR;
  }
  sshbuf_free(b);
  *hashlen = ssh_digest_bytes(hash_alg);
#ifdef DEBUG_KEX
  dump_digest("hash", hash, *hashlen);
#endif
  return 0;
}

int
kex_gen_client(struct ssh *ssh)
{
  struct kex *kex = ssh->kex;
  int r;

  switch (kex->kex_type) {
#ifdef WITH_OPENSSL
  case KEX_DH_GRP1_SHA1:
  case KEX_DH_GRP14_SHA1:
  case KEX_DH_GRP14_SHA256:
  case KEX_DH_GRP16_SHA512:
  case KEX_DH_GRP18_SHA512:
    r = kex_dh_keypair(kex);
    break;
  case KEX_ECDH_SHA2:
    r = kex_ecdh_keypair(kex);
    break;
  case KEX_KEM_MLKEM768ECDH_SHA256:
    r = kex_kem_mlkem768ecdh_keypair(kex);
    break;
#endif /* WITH_OPENSSL */
  case KEX_C25519_SHA256:
    r = kex_c25519_keypair(kex);
    break;
  case KEX_KEM_SNTRUP761X25519_SHA512:
    r = kex_kem_sntrup761x25519_keypair(kex);
    break;
  case KEX_KEM_MLKEM768X25519_SHA256:
    r = kex_kem_mlkem768x25519_keypair(kex);
    break;
  default:
    r = SSH_ERR_INVALID_ARGUMENT;
    break;
  }
  if (r != 0)
    return r;
  if ((r = sshpkt_start(ssh, SSH2_MSG_KEX_ECDH_INIT)) != 0 ||
      (r = sshpkt_put_stringb(ssh, kex->client_pub)) != 0 ||
      (r = sshpkt_send(ssh)) != 0)
    return r;
  debug("expecting SSH2_MSG_KEX_ECDH_REPLY");
  ssh_dispatch_set(ssh, SSH2_MSG_KEX_ECDH_REPLY, &input_kex_gen_reply);
  return 0;
}

static int
input_kex_gen_reply(int type, uint32_t seq, struct ssh *ssh)
{
  struct kex *kex = ssh->kex;
  struct sshkey *server_host_key = NULL;
  struct sshbuf *shared_secret = NULL;
  struct sshbuf *server_blob = NULL;
  struct sshbuf *tmp = NULL, *server_host_key_blob = NULL;
  u_char *signature = NULL;
  u_char hash[SSH_DIGEST_MAX_LENGTH];
  size_t slen, hashlen;
  int r;

  debug("SSH2_MSG_KEX_ECDH_REPLY received");
  ssh_dispatch_set(ssh, SSH2_MSG_KEX_ECDH_REPLY, &kex_protocol_error);

  /* hostkey */
  if ((r = sshpkt_getb_froms(ssh, &server_host_key_blob)) != 0)
    goto out;
  /* sshkey_fromb() consumes its buffer, so make a copy */
  if ((tmp = sshbuf_fromb(server_host_key_blob)) == NULL) {
    r = SSH_ERR_ALLOC_FAIL;
    goto out;
  }
  if ((r = sshkey_fromb(tmp, &server_host_key)) != 0)
    goto out;
  if ((r = kex_verify_host_key(ssh, server_host_key)) != 0)
    goto out;

  /* Q_S, server public key */
  /* signed H */
  if ((r = sshpkt_getb_froms(ssh, &server_blob)) != 0 ||
      (r = sshpkt_get_string(ssh, &signature, &slen)) != 0 ||
      (r = sshpkt_get_end(ssh)) != 0)
    goto out;

  /* compute shared secret */
  switch (kex->kex_type) {
#ifdef WITH_OPENSSL
  case KEX_DH_GRP1_SHA1:
  case KEX_DH_GRP14_SHA1:
  case KEX_DH_GRP14_SHA256:
  case KEX_DH_GRP16_SHA512:
  case KEX_DH_GRP18_SHA512:
    r = kex_dh_dec(kex, server_blob, &shared_secret);
    break;
  case KEX_ECDH_SHA2:
    r = kex_ecdh_dec(kex, server_blob, &shared_secret);
    break;
  case KEX_KEM_MLKEM768ECDH_SHA256:
    r = kex_kem_mlkem768ecdh_dec(kex, server_blob,
        &shared_secret);
    break;
#endif /* WITH_OPENSSL */
  case KEX_C25519_SHA256:
    r = kex_c25519_dec(kex, server_blob, &shared_secret);
    break;
  case KEX_KEM_SNTRUP761X25519_SHA512:
    r = kex_kem_sntrup761x25519_dec(kex, server_blob,
        &shared_secret);
    break;
  case KEX_KEM_MLKEM768X25519_SHA256:
    r = kex_kem_mlkem768x25519_dec(kex, server_blob,
        &shared_secret);
    break;
  default:
    r = SSH_ERR_INVALID_ARGUMENT;
    break;
  }
  if (r !=0 )
    goto out;

  /* calc and verify H */
  hashlen = sizeof(hash);
  if ((r = kex_gen_hash(
      kex->hash_alg,
      kex->client_version,
      kex->server_version,
      kex->my,
      kex->peer,
      server_host_key_blob,
      kex->client_pub,
      server_blob,
      shared_secret,
      hash, &hashlen)) != 0)
    goto out;

  if ((r = sshkey_verify(server_host_key, signature, slen, hash, hashlen,
      kex->hostkey_alg, ssh->compat, NULL)) != 0)
    goto out;

  if ((r = kex_derive_keys(ssh, hash, hashlen, shared_secret)) != 0 ||
      (r = kex_send_newkeys(ssh)) != 0)
    goto out;

  /* save initial signature and hostkey */
  if ((kex->flags & KEX_INITIAL) != 0) {
    if (kex->initial_hostkey != NULL || kex->initial_sig != NULL) {
      r = SSH_ERR_INTERNAL_ERROR;
      goto out;
    }
    if ((kex->initial_sig = sshbuf_new()) == NULL) {
      r = SSH_ERR_ALLOC_FAIL;
      goto out;
    }
    if ((r = sshbuf_put(kex->initial_sig, signature, slen)) != 0)
      goto out;
    kex->initial_hostkey = server_host_key;
    server_host_key = NULL;
  }
  /* success */
out:
  explicit_bzero(hash, sizeof(hash));
  explicit_bzero(kex->c25519_client_key, sizeof(kex->c25519_client_key));
  explicit_bzero(kex->sntrup761_client_key,
      sizeof(kex->sntrup761_client_key));
  explicit_bzero(kex->mlkem768_client_key,
      sizeof(kex->mlkem768_client_key));
  sshbuf_free(server_host_key_blob);
  free(signature);
  sshbuf_free(tmp);
  sshkey_free(server_host_key);
  sshbuf_free(server_blob);
  sshbuf_free(shared_secret);
  sshbuf_free(kex->client_pub);
  kex->client_pub = NULL;
  return r;
}

int
kex_gen_server(struct ssh *ssh)
{
  debug("expecting SSH2_MSG_KEX_ECDH_INIT");
  ssh_dispatch_set(ssh, SSH2_MSG_KEX_ECDH_INIT, &input_kex_gen_init);
  return 0;
}

static int
input_kex_gen_init(int type, uint32_t seq, struct ssh *ssh)
{
  struct kex *kex = ssh->kex;
  struct sshkey *server_host_private, *server_host_public;
  struct sshbuf *shared_secret = NULL;
  struct sshbuf *server_pubkey = NULL;
  struct sshbuf *client_pubkey = NULL;
  struct sshbuf *server_host_key_blob = NULL;
  u_char *signature = NULL, hash[SSH_DIGEST_MAX_LENGTH];
  size_t slen, hashlen;
  int r;

  debug("SSH2_MSG_KEX_ECDH_INIT received");
  ssh_dispatch_set(ssh, SSH2_MSG_KEX_ECDH_INIT, &kex_protocol_error);

  if ((r = kex_load_hostkey(ssh, &server_host_private,
      &server_host_public)) != 0)
    goto out;

  if ((r = sshpkt_getb_froms(ssh, &client_pubkey)) != 0 ||
      (r = sshpkt_get_end(ssh)) != 0)
    goto out;

  /* compute shared secret */
  switch (kex->kex_type) {
#ifdef WITH_OPENSSL
  case KEX_DH_GRP1_SHA1:
  case KEX_DH_GRP14_SHA1:
  case KEX_DH_GRP14_SHA256:
  case KEX_DH_GRP16_SHA512:
  case KEX_DH_GRP18_SHA512:
    r = kex_dh_enc(kex, client_pubkey, &server_pubkey,
        &shared_secret);
    break;
  case KEX_ECDH_SHA2:
    r = kex_ecdh_enc(kex, client_pubkey, &server_pubkey,
        &shared_secret);
    break;
  case KEX_KEM_MLKEM768ECDH_SHA256:
    r = kex_kem_mlkem768ecdh_enc(kex, client_pubkey,
        &server_pubkey, &shared_secret);
    break;
#endif /* WITH_OPENSSL */
  case KEX_C25519_SHA256:
    r = kex_c25519_enc(kex, client_pubkey, &server_pubkey,
        &shared_secret);
    break;
  case KEX_KEM_SNTRUP761X25519_SHA512:
    r = kex_kem_sntrup761x25519_enc(kex, client_pubkey,
        &server_pubkey, &shared_secret);
    break;
  case KEX_KEM_MLKEM768X25519_SHA256:
    r = kex_kem_mlkem768x25519_enc(kex, client_pubkey,
        &server_pubkey, &shared_secret);
    break;
  default:
    r = SSH_ERR_INVALID_ARGUMENT;
    break;
  }
  if (r !=0 )
    goto out;

  /* calc H */
  if ((server_host_key_blob = sshbuf_new()) == NULL) {
    r = SSH_ERR_ALLOC_FAIL;
    goto out;
  }
  if ((r = sshkey_putb(server_host_public, server_host_key_blob)) != 0)
    goto out;
  hashlen = sizeof(hash);
  if ((r = kex_gen_hash(
      kex->hash_alg,
      kex->client_version,
      kex->server_version,
      kex->peer,
      kex->my,
      server_host_key_blob,
      client_pubkey,
      server_pubkey,
      shared_secret,
      hash, &hashlen)) != 0)
    goto out;

  /* sign H */
  if ((r = kex->sign(ssh, server_host_private, server_host_public,
      &signature, &slen, hash, hashlen, kex->hostkey_alg)) != 0)
    goto out;

  /* send server hostkey, ECDH pubkey 'Q_S' and signed H */
  if ((r = sshpkt_start(ssh, SSH2_MSG_KEX_ECDH_REPLY)) != 0 ||
      (r = sshpkt_put_stringb(ssh, server_host_key_blob)) != 0 ||
      (r = sshpkt_put_stringb(ssh, server_pubkey)) != 0 ||
      (r = sshpkt_put_string(ssh, signature, slen)) != 0 ||
      (r = sshpkt_send(ssh)) != 0)
    goto out;

  if ((r = kex_derive_keys(ssh, hash, hashlen, shared_secret)) != 0 ||
      (r = kex_send_newkeys(ssh)) != 0)
    goto out;
  /* retain copy of hostkey used at initial KEX */
  if (kex->initial_hostkey == NULL &&
      (r = sshkey_from_private(server_host_public,
      &kex->initial_hostkey)) != 0)
    goto out;
  /* success */
out:
  explicit_bzero(hash, sizeof(hash));
  sshbuf_free(server_host_key_blob);
  free(signature);
  sshbuf_free(shared_secret);
  sshbuf_free(client_pubkey);
  sshbuf_free(server_pubkey);
  return r;
}

Coverage Report

Created: 2026-08-13 07:14

Line	Count	Source
1		/* $OpenBSD: kexgen.c,v 1.14 2026/07/30 07:29:09 dtucker Exp $ */
2		/*
3		* Copyright (c) 2019 Markus Friedl. All rights reserved.
4		*
5		* Redistribution and use in source and binary forms, with or without
6		* modification, are permitted provided that the following conditions
7		* are met:
8		* 1. Redistributions of source code must retain the above copyright
9		* notice, this list of conditions and the following disclaimer.
10		* 2. Redistributions in binary form must reproduce the above copyright
11		* notice, this list of conditions and the following disclaimer in the
12		* documentation and/or other materials provided with the distribution.
13		*
14		* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
15		* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16		* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17		* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
18		* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19		* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20		* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21		* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22		* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23		* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24		*/
25
26		#include "includes.h"
27
28		#include <sys/types.h>
29
30		#include <stdarg.h>
31		#include <stdio.h>
32		#include <string.h>
33		#include <signal.h>
34
35		#include "sshkey.h"
36		#include "kex.h"
37		#include "log.h"
38		#include "packet.h"
39		#include "ssh2.h"
40		#include "sshbuf.h"
41		#include "digest.h"
42		#include "ssherr.h"
43
44		static int input_kex_gen_init(int, uint32_t, struct ssh *);
45		static int input_kex_gen_reply(int type, uint32_t seq, struct ssh *ssh);
46
47		static int
48		kex_gen_hash(
49		int hash_alg,
50		const struct sshbuf *client_version,
51		const struct sshbuf *server_version,
52		const struct sshbuf *client_kexinit,
53		const struct sshbuf *server_kexinit,
54		const struct sshbuf *server_host_key_blob,
55		const struct sshbuf *client_pub,
56		const struct sshbuf *server_pub,
57		const struct sshbuf *shared_secret,
58		u_char hash, size_t hashlen)
59	0	{
60	0	struct sshbuf *b;
61	0	int r;
62
63	0	if (*hashlen < ssh_digest_bytes(hash_alg))
64	0	return SSH_ERR_INVALID_ARGUMENT;
65	0	if ((b = sshbuf_new()) == NULL)
66	0	return SSH_ERR_ALLOC_FAIL;
67	0	if ((r = sshbuf_put_stringb(b, client_version)) != 0 \|\|
68	0	(r = sshbuf_put_stringb(b, server_version)) != 0 \|\|
69		/* kexinit messages: fake header: len+SSH2_MSG_KEXINIT */
70	0	(r = sshbuf_put_u32(b, sshbuf_len(client_kexinit) + 1)) != 0 \|\|
71	0	(r = sshbuf_put_u8(b, SSH2_MSG_KEXINIT)) != 0 \|\|
72	0	(r = sshbuf_putb(b, client_kexinit)) != 0 \|\|
73	0	(r = sshbuf_put_u32(b, sshbuf_len(server_kexinit) + 1)) != 0 \|\|
74	0	(r = sshbuf_put_u8(b, SSH2_MSG_KEXINIT)) != 0 \|\|
75	0	(r = sshbuf_putb(b, server_kexinit)) != 0 \|\|
76	0	(r = sshbuf_put_stringb(b, server_host_key_blob)) != 0 \|\|
77	0	(r = sshbuf_put_stringb(b, client_pub)) != 0 \|\|
78	0	(r = sshbuf_put_stringb(b, server_pub)) != 0 \|\|
79	0	(r = sshbuf_putb(b, shared_secret)) != 0) {
80	0	sshbuf_free(b);
81	0	return r;
82	0	}
83		#ifdef DEBUG_KEX
84		sshbuf_dump(b, stderr);
85		#endif
86	0	if (ssh_digest_buffer(hash_alg, b, hash, *hashlen) != 0) {
87	0	sshbuf_free(b);
88	0	return SSH_ERR_LIBCRYPTO_ERROR;
89	0	}
90	0	sshbuf_free(b);
91	0	*hashlen = ssh_digest_bytes(hash_alg);
92		#ifdef DEBUG_KEX
93		dump_digest("hash", hash, *hashlen);
94		#endif
95	0	return 0;
96	0	}
97
98		int
99		kex_gen_client(struct ssh *ssh)
100	0	{
101	0	struct kex *kex = ssh->kex;
102	0	int r;
103
104	0	switch (kex->kex_type) {
105	0	#ifdef WITH_OPENSSL
106	0	case KEX_DH_GRP1_SHA1:
107	0	case KEX_DH_GRP14_SHA1:
108	0	case KEX_DH_GRP14_SHA256:
109	0	case KEX_DH_GRP16_SHA512:
110	0	case KEX_DH_GRP18_SHA512:
111	0	r = kex_dh_keypair(kex);
112	0	break;
113	0	case KEX_ECDH_SHA2:
114	0	r = kex_ecdh_keypair(kex);
115	0	break;
116	0	case KEX_KEM_MLKEM768ECDH_SHA256:
117	0	r = kex_kem_mlkem768ecdh_keypair(kex);
118	0	break;
119	0	#endif /* WITH_OPENSSL */
120	0	case KEX_C25519_SHA256:
121	0	r = kex_c25519_keypair(kex);
122	0	break;
123	0	case KEX_KEM_SNTRUP761X25519_SHA512:
124	0	r = kex_kem_sntrup761x25519_keypair(kex);
125	0	break;
126	0	case KEX_KEM_MLKEM768X25519_SHA256:
127	0	r = kex_kem_mlkem768x25519_keypair(kex);
128	0	break;
129	0	default:
130	0	r = SSH_ERR_INVALID_ARGUMENT;
131	0	break;
132	0	}
133	0	if (r != 0)
134	0	return r;
135	0	if ((r = sshpkt_start(ssh, SSH2_MSG_KEX_ECDH_INIT)) != 0 \|\|
136	0	(r = sshpkt_put_stringb(ssh, kex->client_pub)) != 0 \|\|
137	0	(r = sshpkt_send(ssh)) != 0)
138	0	return r;
139	0	debug("expecting SSH2_MSG_KEX_ECDH_REPLY");
140	0	ssh_dispatch_set(ssh, SSH2_MSG_KEX_ECDH_REPLY, &input_kex_gen_reply);
141	0	return 0;
142	0	}
143
144		static int
145		input_kex_gen_reply(int type, uint32_t seq, struct ssh *ssh)
146	0	{
147	0	struct kex *kex = ssh->kex;
148	0	struct sshkey *server_host_key = NULL;
149	0	struct sshbuf *shared_secret = NULL;
150	0	struct sshbuf *server_blob = NULL;
151	0	struct sshbuf tmp = NULL, server_host_key_blob = NULL;
152	0	u_char *signature = NULL;
153	0	u_char hash[SSH_DIGEST_MAX_LENGTH];
154	0	size_t slen, hashlen;
155	0	int r;
156
157	0	debug("SSH2_MSG_KEX_ECDH_REPLY received");
158	0	ssh_dispatch_set(ssh, SSH2_MSG_KEX_ECDH_REPLY, &kex_protocol_error);
159
160		/* hostkey */
161	0	if ((r = sshpkt_getb_froms(ssh, &server_host_key_blob)) != 0)
162	0	goto out;
163		/* sshkey_fromb() consumes its buffer, so make a copy */
164	0	if ((tmp = sshbuf_fromb(server_host_key_blob)) == NULL) {
165	0	r = SSH_ERR_ALLOC_FAIL;
166	0	goto out;
167	0	}
168	0	if ((r = sshkey_fromb(tmp, &server_host_key)) != 0)
169	0	goto out;
170	0	if ((r = kex_verify_host_key(ssh, server_host_key)) != 0)
171	0	goto out;
172
173		/* Q_S, server public key */
174		/* signed H */
175	0	if ((r = sshpkt_getb_froms(ssh, &server_blob)) != 0 \|\|
176	0	(r = sshpkt_get_string(ssh, &signature, &slen)) != 0 \|\|
177	0	(r = sshpkt_get_end(ssh)) != 0)
178	0	goto out;
179
180		/* compute shared secret */
181	0	switch (kex->kex_type) {
182	0	#ifdef WITH_OPENSSL
183	0	case KEX_DH_GRP1_SHA1:
184	0	case KEX_DH_GRP14_SHA1:
185	0	case KEX_DH_GRP14_SHA256:
186	0	case KEX_DH_GRP16_SHA512:
187	0	case KEX_DH_GRP18_SHA512:
188	0	r = kex_dh_dec(kex, server_blob, &shared_secret);
189	0	break;
190	0	case KEX_ECDH_SHA2:
191	0	r = kex_ecdh_dec(kex, server_blob, &shared_secret);
192	0	break;
193	0	case KEX_KEM_MLKEM768ECDH_SHA256:
194	0	r = kex_kem_mlkem768ecdh_dec(kex, server_blob,
195	0	&shared_secret);
196	0	break;
197	0	#endif /* WITH_OPENSSL */
198	0	case KEX_C25519_SHA256:
199	0	r = kex_c25519_dec(kex, server_blob, &shared_secret);
200	0	break;
201	0	case KEX_KEM_SNTRUP761X25519_SHA512:
202	0	r = kex_kem_sntrup761x25519_dec(kex, server_blob,
203	0	&shared_secret);
204	0	break;
205	0	case KEX_KEM_MLKEM768X25519_SHA256:
206	0	r = kex_kem_mlkem768x25519_dec(kex, server_blob,
207	0	&shared_secret);
208	0	break;
209	0	default:
210	0	r = SSH_ERR_INVALID_ARGUMENT;
211	0	break;
212	0	}
213	0	if (r !=0 )
214	0	goto out;
215
216		/* calc and verify H */
217	0	hashlen = sizeof(hash);
218	0	if ((r = kex_gen_hash(
219	0	kex->hash_alg,
220	0	kex->client_version,
221	0	kex->server_version,
222	0	kex->my,
223	0	kex->peer,
224	0	server_host_key_blob,
225	0	kex->client_pub,
226	0	server_blob,
227	0	shared_secret,
228	0	hash, &hashlen)) != 0)
229	0	goto out;
230
231	0	if ((r = sshkey_verify(server_host_key, signature, slen, hash, hashlen,
232	0	kex->hostkey_alg, ssh->compat, NULL)) != 0)
233	0	goto out;
234
235	0	if ((r = kex_derive_keys(ssh, hash, hashlen, shared_secret)) != 0 \|\|
236	0	(r = kex_send_newkeys(ssh)) != 0)
237	0	goto out;
238
239		/* save initial signature and hostkey */
240	0	if ((kex->flags & KEX_INITIAL) != 0) {
241	0	if (kex->initial_hostkey != NULL \|\| kex->initial_sig != NULL) {
242	0	r = SSH_ERR_INTERNAL_ERROR;
243	0	goto out;
244	0	}
245	0	if ((kex->initial_sig = sshbuf_new()) == NULL) {
246	0	r = SSH_ERR_ALLOC_FAIL;
247	0	goto out;
248	0	}
249	0	if ((r = sshbuf_put(kex->initial_sig, signature, slen)) != 0)
250	0	goto out;
251	0	kex->initial_hostkey = server_host_key;
252	0	server_host_key = NULL;
253	0	}
254		/* success */
255	0	out:
256	0	explicit_bzero(hash, sizeof(hash));
257	0	explicit_bzero(kex->c25519_client_key, sizeof(kex->c25519_client_key));
258	0	explicit_bzero(kex->sntrup761_client_key,
259	0	sizeof(kex->sntrup761_client_key));
260	0	explicit_bzero(kex->mlkem768_client_key,
261	0	sizeof(kex->mlkem768_client_key));
262	0	sshbuf_free(server_host_key_blob);
263	0	free(signature);
264	0	sshbuf_free(tmp);
265	0	sshkey_free(server_host_key);
266	0	sshbuf_free(server_blob);
267	0	sshbuf_free(shared_secret);
268	0	sshbuf_free(kex->client_pub);
269	0	kex->client_pub = NULL;
270	0	return r;
271	0	}
272
273		int
274		kex_gen_server(struct ssh *ssh)
275	0	{
276	0	debug("expecting SSH2_MSG_KEX_ECDH_INIT");
277	0	ssh_dispatch_set(ssh, SSH2_MSG_KEX_ECDH_INIT, &input_kex_gen_init);
278	0	return 0;
279	0	}
280
281		static int
282		input_kex_gen_init(int type, uint32_t seq, struct ssh *ssh)
283	0	{
284	0	struct kex *kex = ssh->kex;
285	0	struct sshkey server_host_private, server_host_public;
286	0	struct sshbuf *shared_secret = NULL;
287	0	struct sshbuf *server_pubkey = NULL;
288	0	struct sshbuf *client_pubkey = NULL;
289	0	struct sshbuf *server_host_key_blob = NULL;
290	0	u_char *signature = NULL, hash[SSH_DIGEST_MAX_LENGTH];
291	0	size_t slen, hashlen;
292	0	int r;
293
294	0	debug("SSH2_MSG_KEX_ECDH_INIT received");
295	0	ssh_dispatch_set(ssh, SSH2_MSG_KEX_ECDH_INIT, &kex_protocol_error);
296
297	0	if ((r = kex_load_hostkey(ssh, &server_host_private,
298	0	&server_host_public)) != 0)
299	0	goto out;
300
301	0	if ((r = sshpkt_getb_froms(ssh, &client_pubkey)) != 0 \|\|
302	0	(r = sshpkt_get_end(ssh)) != 0)
303	0	goto out;
304
305		/* compute shared secret */
306	0	switch (kex->kex_type) {
307	0	#ifdef WITH_OPENSSL
308	0	case KEX_DH_GRP1_SHA1:
309	0	case KEX_DH_GRP14_SHA1:
310	0	case KEX_DH_GRP14_SHA256:
311	0	case KEX_DH_GRP16_SHA512:
312	0	case KEX_DH_GRP18_SHA512:
313	0	r = kex_dh_enc(kex, client_pubkey, &server_pubkey,
314	0	&shared_secret);
315	0	break;
316	0	case KEX_ECDH_SHA2:
317	0	r = kex_ecdh_enc(kex, client_pubkey, &server_pubkey,
318	0	&shared_secret);
319	0	break;
320	0	case KEX_KEM_MLKEM768ECDH_SHA256:
321	0	r = kex_kem_mlkem768ecdh_enc(kex, client_pubkey,
322	0	&server_pubkey, &shared_secret);
323	0	break;
324	0	#endif /* WITH_OPENSSL */
325	0	case KEX_C25519_SHA256:
326	0	r = kex_c25519_enc(kex, client_pubkey, &server_pubkey,
327	0	&shared_secret);
328	0	break;
329	0	case KEX_KEM_SNTRUP761X25519_SHA512:
330	0	r = kex_kem_sntrup761x25519_enc(kex, client_pubkey,
331	0	&server_pubkey, &shared_secret);
332	0	break;
333	0	case KEX_KEM_MLKEM768X25519_SHA256:
334	0	r = kex_kem_mlkem768x25519_enc(kex, client_pubkey,
335	0	&server_pubkey, &shared_secret);
336	0	break;
337	0	default:
338	0	r = SSH_ERR_INVALID_ARGUMENT;
339	0	break;
340	0	}
341	0	if (r !=0 )
342	0	goto out;
343
344		/* calc H */
345	0	if ((server_host_key_blob = sshbuf_new()) == NULL) {
346	0	r = SSH_ERR_ALLOC_FAIL;
347	0	goto out;
348	0	}
349	0	if ((r = sshkey_putb(server_host_public, server_host_key_blob)) != 0)
350	0	goto out;
351	0	hashlen = sizeof(hash);
352	0	if ((r = kex_gen_hash(
353	0	kex->hash_alg,
354	0	kex->client_version,
355	0	kex->server_version,
356	0	kex->peer,
357	0	kex->my,
358	0	server_host_key_blob,
359	0	client_pubkey,
360	0	server_pubkey,
361	0	shared_secret,
362	0	hash, &hashlen)) != 0)
363	0	goto out;
364
365		/* sign H */
366	0	if ((r = kex->sign(ssh, server_host_private, server_host_public,
367	0	&signature, &slen, hash, hashlen, kex->hostkey_alg)) != 0)
368	0	goto out;
369
370		/* send server hostkey, ECDH pubkey 'Q_S' and signed H */
371	0	if ((r = sshpkt_start(ssh, SSH2_MSG_KEX_ECDH_REPLY)) != 0 \|\|
372	0	(r = sshpkt_put_stringb(ssh, server_host_key_blob)) != 0 \|\|
373	0	(r = sshpkt_put_stringb(ssh, server_pubkey)) != 0 \|\|
374	0	(r = sshpkt_put_string(ssh, signature, slen)) != 0 \|\|
375	0	(r = sshpkt_send(ssh)) != 0)
376	0	goto out;
377
378	0	if ((r = kex_derive_keys(ssh, hash, hashlen, shared_secret)) != 0 \|\|
379	0	(r = kex_send_newkeys(ssh)) != 0)
380	0	goto out;
381		/* retain copy of hostkey used at initial KEX */
382	0	if (kex->initial_hostkey == NULL &&
383	0	(r = sshkey_from_private(server_host_public,
384	0	&kex->initial_hostkey)) != 0)
385	0	goto out;
386		/* success */
387	0	out:
388	0	explicit_bzero(hash, sizeof(hash));
389	0	sshbuf_free(server_host_key_blob);
390	0	free(signature);
391	0	sshbuf_free(shared_secret);
392	0	sshbuf_free(client_pubkey);
393	0	sshbuf_free(server_pubkey);
394	0	return r;
395	0	}