Azure
/
sonic-openssh
зеркало из https://github.com/Azure/sonic-openssh.git
1
0
Форкнуть 0
Код Задачи Пакеты Проекты Релизы Вики Активность

upstream: Add support for a PQC KEX/KEM: 

sntrup4591761x25519-sha512@tinyssh.org using the Streamlined NTRU Prime
4591^761 implementation from SUPERCOP coupled with X25519 as a stop-loss. Not
enabled by default.

introduce KEM API; a simplified framework for DH-ish KEX methods.

from markus@ feedback & ok djm@

OpenBSD-Commit-ID: d687f76cffd3561dd73eb302d17a1c3bf321d1a7
This commit is contained in:
djm@openbsd.org 2019-01-21 10:20:12 +00:00 коммит произвёл Damien Miller
Родитель b1b2ff4ed5
Коммит dfd591618c
17 изменённых файлов: 1665 добавлений и 40 удалений
Показать статистику Скачать Patch файл Скачать Diff файл Показать все файлы Свернуть все файлы

2
Makefile.in
Просмотреть файл

@ -100,8 +100,10 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
kex.o kexdh.o kexgex.o kexecdh.o kexc25519.o \
kexdhc.o kexgexc.o kexecdhc.o kexc25519c.o \
kexdhs.o kexgexs.o kexecdhs.o kexc25519s.o \
sntrup4591761.o kexsntrup4591761x25519.o kexkemc.o kexkems.o \
platform-pledge.o platform-tracing.o platform-misc.o
SSHOBJS= ssh.o readconf.o clientloop.o sshtty.o \
sshconnect.o sshconnect2.o mux.o

18
crypto_api.h
Просмотреть файл

@ -1,4 +1,4 @@
/* $OpenBSD: crypto_api.h,v 1.4 2017/12/14 21:07:39 naddy Exp $ */
/* $OpenBSD: crypto_api.h,v 1.5 2019/01/21 10:20:12 djm Exp $ */
/*
* Assembled from generated headers and source files by Markus Friedl.
@ -15,10 +15,15 @@
#endif
#include <stdlib.h>
typedef int8_t crypto_int8;
typedef uint8_t crypto_uint8;
typedef int16_t crypto_int16;
typedef uint16_t crypto_uint16;
typedef int32_t crypto_int32;
typedef uint32_t crypto_uint32;
#define randombytes(buf, buf_len) arc4random_buf((buf), (buf_len))
#define small_random32() arc4random()
#define crypto_hash_sha512_BYTES 64U
@ -37,4 +42,15 @@ int crypto_sign_ed25519_open(unsigned char *, unsigned long long *,
const unsigned char *, unsigned long long, const unsigned char *);
int crypto_sign_ed25519_keypair(unsigned char *, unsigned char *);
#define crypto_kem_sntrup4591761_PUBLICKEYBYTES 1218
#define crypto_kem_sntrup4591761_SECRETKEYBYTES 1600
#define crypto_kem_sntrup4591761_CIPHERTEXTBYTES 1047
#define crypto_kem_sntrup4591761_BYTES 32
int crypto_kem_sntrup4591761_enc(unsigned char *cstr, unsigned char *k,
const unsigned char *pk);
int crypto_kem_sntrup4591761_dec(unsigned char *k,
const unsigned char *cstr, const unsigned char *sk);
int crypto_kem_sntrup4591761_keypair(unsigned char *pk, unsigned char *sk);
#endif /* crypto_api_h */

7
kex.c
Просмотреть файл

@ -1,4 +1,4 @@
/* $OpenBSD: kex.c,v 1.146 2019/01/21 10:07:22 djm Exp $ */
/* $OpenBSD: kex.c,v 1.147 2019/01/21 10:20:12 djm Exp $ */
/*
* Copyright (c) 2000, 2001 Markus Friedl. All rights reserved.
*
@ -108,6 +108,8 @@ static const struct kexalg kexalgs[] = {
#if defined(HAVE_EVP_SHA256) || !defined(WITH_OPENSSL)
{ KEX_CURVE25519_SHA256, KEX_C25519_SHA256, 0, SSH_DIGEST_SHA256 },
{ KEX_CURVE25519_SHA256_OLD, KEX_C25519_SHA256, 0, SSH_DIGEST_SHA256 },
{ KEX_SNTRUP4591761X25519_SHA512, KEX_KEM_SNTRUP4591761X25519_SHA512, 0,
SSH_DIGEST_SHA512 },
#endif /* HAVE_EVP_SHA256 || !WITH_OPENSSL */
{ NULL, -1, -1, -1},
};
@ -653,6 +655,7 @@ kex_free(struct kex *kex)
sshbuf_free(kex->my);
sshbuf_free(kex->client_version);
sshbuf_free(kex->server_version);
sshbuf_free(kex->kem_client_pub);
free(kex->session_id);
free(kex->failed_choice);
free(kex->hostkey_alg);
@ -1089,7 +1092,7 @@ kex_verify_host_key(struct ssh *ssh, struct sshkey *server_host_key)
#if defined(DEBUG_KEX) || defined(DEBUG_KEXDH) || defined(DEBUG_KEXECDH)
void
dump_digest(char *msg, u_char *digest, int len)
dump_digest(const char *msg, const u_char *digest, int len)
{
fprintf(stderr, "%s\n", msg);
sshbuf_dump_data(digest, len, stderr);

25
kex.h
Просмотреть файл

@ -1,4 +1,4 @@
/* $OpenBSD: kex.h,v 1.98 2019/01/21 10:07:22 djm Exp $ */
/* $OpenBSD: kex.h,v 1.99 2019/01/21 10:20:12 djm Exp $ */
/*
* Copyright (c) 2000, 2001 Markus Friedl. All rights reserved.
@ -27,6 +27,7 @@
#define KEX_H
#include "mac.h"
#include "crypto_api.h"
#ifdef WITH_LEAKMALLOC
#include "leakmalloc.h"
@ -62,6 +63,7 @@
#define KEX_ECDH_SHA2_NISTP521 "ecdh-sha2-nistp521"
#define KEX_CURVE25519_SHA256 "curve25519-sha256"
#define KEX_CURVE25519_SHA256_OLD "curve25519-sha256@libssh.org"
#define KEX_SNTRUP4591761X25519_SHA512 "sntrup4591761x25519-sha512@tinyssh.org"
#define COMP_NONE 0
/* pre-auth compression (COMP_ZLIB) is only supported in the client */
@ -100,6 +102,7 @@ enum kex_exchange {
KEX_DH_GEX_SHA256,
KEX_ECDH_SHA2,
KEX_C25519_SHA256,
KEX_KEM_SNTRUP4591761X25519_SHA512,
KEX_MAX
};
@ -164,8 +167,10 @@ struct kex {
u_int min, max, nbits; /* GEX */
EC_KEY *ec_client_key; /* ECDH */
const EC_GROUP *ec_group; /* ECDH */
u_char c25519_client_key[CURVE25519_SIZE]; /* 25519 */
u_char c25519_client_key[CURVE25519_SIZE]; /* 25519 + KEM */
u_char c25519_client_pubkey[CURVE25519_SIZE]; /* 25519 */
u_char sntrup4591761_client_key[crypto_kem_sntrup4591761_SECRETKEYBYTES]; /* KEM */
struct sshbuf *kem_client_pub; /* KEM */
};
int kex_names_valid(const char *);
@ -203,6 +208,14 @@ int kexecdh_client(struct ssh *);
int kexecdh_server(struct ssh *);
int kexc25519_client(struct ssh *);
int kexc25519_server(struct ssh *);
int kex_kem_client(struct ssh *);
int kex_kem_server(struct ssh *);
int kex_kem_sntrup4591761x25519_keypair(struct kex *);
int kex_kem_sntrup4591761x25519_enc(struct kex *, const u_char *, size_t,
struct sshbuf **, struct sshbuf **);
int kex_kem_sntrup4591761x25519_dec(struct kex *, const u_char *, size_t,
struct sshbuf **);
int kex_dh_keygen(struct kex *);
int kex_dh_compute_key(struct kex *, BIGNUM *, struct sshbuf *);
@ -224,7 +237,7 @@ int kex_ecdh_hash(int, const EC_GROUP *,
int kex_c25519_hash(int, const struct sshbuf *, const struct sshbuf *,
const u_char *, size_t, const u_char *, size_t,
const u_char *, size_t, const u_char *, const u_char *,
const u_char *, size_t, const u_char *, size_t, const u_char *, size_t,
const u_char *, size_t, u_char *, size_t *);
void kexc25519_keygen(u_char key[CURVE25519_SIZE], u_char pub[CURVE25519_SIZE])
@ -234,9 +247,13 @@ int kexc25519_shared_key(const u_char key[CURVE25519_SIZE],
const u_char pub[CURVE25519_SIZE], struct sshbuf *out)
__attribute__((__bounded__(__minbytes__, 1, CURVE25519_SIZE)))
__attribute__((__bounded__(__minbytes__, 2, CURVE25519_SIZE)));
int kexc25519_shared_key_ext(const u_char key[CURVE25519_SIZE],
const u_char pub[CURVE25519_SIZE], struct sshbuf *out, int)
__attribute__((__bounded__(__minbytes__, 1, CURVE25519_SIZE)))
__attribute__((__bounded__(__minbytes__, 2, CURVE25519_SIZE)));
#if defined(DEBUG_KEX) || defined(DEBUG_KEXDH) || defined(DEBUG_KEXECDH)
void dump_digest(char *, u_char *, int);
void dump_digest(const char *, const u_char *, int);
#endif
#if !defined(WITH_OPENSSL) || !defined(OPENSSL_HAS_ECC)

47
kexc25519.c
Просмотреть файл

@ -1,4 +1,4 @@
/* $OpenBSD: kexc25519.c,v 1.12 2019/01/21 09:49:37 djm Exp $ */
/* $OpenBSD: kexc25519.c,v 1.13 2019/01/21 10:20:12 djm Exp $ */
/*
* Copyright (c) 2001, 2013 Markus Friedl. All rights reserved.
* Copyright (c) 2010 Damien Miller. All rights reserved.
@ -60,8 +60,8 @@ kexc25519_keygen(u_char key[CURVE25519_SIZE], u_char pub[CURVE25519_SIZE])
}
int
kexc25519_shared_key(const u_char key[CURVE25519_SIZE],
const u_char pub[CURVE25519_SIZE], struct sshbuf *out)
kexc25519_shared_key_ext(const u_char key[CURVE25519_SIZE],
const u_char pub[CURVE25519_SIZE], struct sshbuf *out, int raw)
{
u_char shared_key[CURVE25519_SIZE];
u_char zero[CURVE25519_SIZE];
@ -77,12 +77,21 @@ kexc25519_shared_key(const u_char key[CURVE25519_SIZE],
#ifdef DEBUG_KEXECDH
dump_digest("shared secret", shared_key, CURVE25519_SIZE);
#endif
sshbuf_reset(out);
r = sshbuf_put_bignum2_bytes(out, shared_key, CURVE25519_SIZE);
if (raw)
r = sshbuf_put(out, shared_key, CURVE25519_SIZE);
else
r = sshbuf_put_bignum2_bytes(out, shared_key, CURVE25519_SIZE);
explicit_bzero(shared_key, CURVE25519_SIZE);
return r;
}
int
kexc25519_shared_key(const u_char key[CURVE25519_SIZE],
const u_char pub[CURVE25519_SIZE], struct sshbuf *out)
{
return kexc25519_shared_key_ext(key, pub, out, 0);
}
int
kex_c25519_hash(
int hash_alg,
@ -91,8 +100,8 @@ kex_c25519_hash(
const u_char *ckexinit, size_t ckexinitlen,
const u_char *skexinit, size_t skexinitlen,
const u_char *serverhostkeyblob, size_t sbloblen,
const u_char client_dh_pub[CURVE25519_SIZE],
const u_char server_dh_pub[CURVE25519_SIZE],
const u_char *client_pub, size_t client_pub_len,
const u_char *server_pub, size_t server_pub_len,
const u_char *shared_secret, size_t secretlen,
u_char *hash, size_t *hashlen)
{
@ -103,19 +112,19 @@ kex_c25519_hash(
return SSH_ERR_INVALID_ARGUMENT;
if ((b = sshbuf_new()) == NULL)
return SSH_ERR_ALLOC_FAIL;
if ((r = sshbuf_put_stringb(b, client_version)) < 0 ||
(r = sshbuf_put_stringb(b, server_version)) < 0 ||
if ((r = sshbuf_put_stringb(b, client_version)) != 0 ||
(r = sshbuf_put_stringb(b, server_version)) != 0 ||
/* kexinit messages: fake header: len+SSH2_MSG_KEXINIT */
(r = sshbuf_put_u32(b, ckexinitlen+1)) < 0 ||
(r = sshbuf_put_u8(b, SSH2_MSG_KEXINIT)) < 0 ||
(r = sshbuf_put(b, ckexinit, ckexinitlen)) < 0 ||
(r = sshbuf_put_u32(b, skexinitlen+1)) < 0 ||
(r = sshbuf_put_u8(b, SSH2_MSG_KEXINIT)) < 0 ||
(r = sshbuf_put(b, skexinit, skexinitlen)) < 0 ||
(r = sshbuf_put_string(b, serverhostkeyblob, sbloblen)) < 0 ||
(r = sshbuf_put_string(b, client_dh_pub, CURVE25519_SIZE)) < 0 ||
(r = sshbuf_put_string(b, server_dh_pub, CURVE25519_SIZE)) < 0 ||
(r = sshbuf_put(b, shared_secret, secretlen)) < 0) {
(r = sshbuf_put_u32(b, ckexinitlen+1)) != 0 ||
(r = sshbuf_put_u8(b, SSH2_MSG_KEXINIT)) != 0 ||
(r = sshbuf_put(b, ckexinit, ckexinitlen)) != 0 ||
(r = sshbuf_put_u32(b, skexinitlen+1)) != 0 ||
(r = sshbuf_put_u8(b, SSH2_MSG_KEXINIT)) != 0 ||
(r = sshbuf_put(b, skexinit, skexinitlen)) != 0 ||
(r = sshbuf_put_string(b, serverhostkeyblob, sbloblen)) != 0 ||
(r = sshbuf_put_string(b, client_pub, client_pub_len)) != 0 ||
(r = sshbuf_put_string(b, server_pub, server_pub_len)) != 0 ||
(r = sshbuf_put(b, shared_secret, secretlen)) != 0) {
sshbuf_free(b);
return r;
}

10
kexc25519c.c
Просмотреть файл

@ -1,4 +1,4 @@
/* $OpenBSD: kexc25519c.c,v 1.12 2019/01/21 10:07:22 djm Exp $ */
/* $OpenBSD: kexc25519c.c,v 1.13 2019/01/21 10:20:12 djm Exp $ */
/*
* Copyright (c) 2001 Markus Friedl. All rights reserved.
* Copyright (c) 2010 Damien Miller. All rights reserved.
@ -109,7 +109,7 @@ input_kex_c25519_reply(int type, u_int32_t seq, struct ssh *ssh)
goto out;
}
if ((r = kexc25519_shared_key(kex->c25519_client_key, server_pubkey,
shared_secret)) < 0)
shared_secret)) != 0)
goto out;
/* calc and verify H */
@ -121,10 +121,10 @@ input_kex_c25519_reply(int type, u_int32_t seq, struct ssh *ssh)
sshbuf_ptr(kex->my), sshbuf_len(kex->my),
sshbuf_ptr(kex->peer), sshbuf_len(kex->peer),
server_host_key_blob, sbloblen,
kex->c25519_client_pubkey,
server_pubkey,
kex->c25519_client_pubkey, sizeof(kex->c25519_client_pubkey),
server_pubkey, pklen,
sshbuf_ptr(shared_secret), sshbuf_len(shared_secret),
hash, &hashlen)) < 0)
hash, &hashlen)) != 0)
goto out;
if ((r = sshkey_verify(server_host_key, signature, slen, hash, hashlen,

8
kexc25519s.c
Просмотреть файл

@ -1,4 +1,4 @@
/* $OpenBSD: kexc25519s.c,v 1.15 2019/01/21 10:05:09 djm Exp $ */
/* $OpenBSD: kexc25519s.c,v 1.16 2019/01/21 10:20:12 djm Exp $ */
/*
* Copyright (c) 2001 Markus Friedl. All rights reserved.
* Copyright (c) 2010 Damien Miller. All rights reserved.
@ -104,10 +104,10 @@ input_kex_c25519_init(int type, u_int32_t seq, struct ssh *ssh)
sshbuf_ptr(kex->peer), sshbuf_len(kex->peer),
sshbuf_ptr(kex->my), sshbuf_len(kex->my),
server_host_key_blob, sbloblen,
client_pubkey,
server_pubkey,
client_pubkey, pklen,
server_pubkey, sizeof(server_pubkey),
sshbuf_ptr(shared_secret), sshbuf_len(shared_secret),
hash, &hashlen)) < 0)
hash, &hashlen)) != 0)
goto out;
/* sign H */

128
kexkemc.c Normal file
Просмотреть файл

@ -0,0 +1,128 @@
/* $OpenBSD: kexkemc.c,v 1.1 2019/01/21 10:20:12 djm Exp $ */
/*
* Copyright (c) 2019 Markus Friedl. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#include <sys/types.h>
#include <stdio.h>
#include <string.h>
#include <signal.h>
#include "sshkey.h"
#include "kex.h"
#include "log.h"
#include "packet.h"
#include "ssh2.h"
#include "sshbuf.h"
#include "digest.h"
#include "ssherr.h"
static int
input_kex_kem_reply(int type, u_int32_t seq, struct ssh *ssh);
int
kex_kem_client(struct ssh *ssh)
{
struct kex *kex = ssh->kex;
int r;
if ((r = kex_kem_sntrup4591761x25519_keypair(kex)) != 0)
return r;
if ((r = sshpkt_start(ssh, SSH2_MSG_KEX_ECDH_INIT)) != 0 ||
(r = sshpkt_put_stringb(ssh, kex->kem_client_pub)) != 0 ||
(r = sshpkt_send(ssh)) != 0)
return r;
debug("expecting SSH2_MSG_KEX_ECDH_REPLY");
ssh_dispatch_set(ssh, SSH2_MSG_KEX_ECDH_REPLY, &input_kex_kem_reply);
return 0;
}
static int
input_kex_kem_reply(int type, u_int32_t seq, struct ssh *ssh)
{
struct kex *kex = ssh->kex;
struct sshkey *server_host_key = NULL;
struct sshbuf *shared_secret = NULL;
u_char *server_pubkey = NULL;
u_char *server_host_key_blob = NULL, *signature = NULL;
u_char hash[SSH_DIGEST_MAX_LENGTH];
size_t slen, pklen, sbloblen, hashlen;
int r;
/* hostkey */
if ((r = sshpkt_get_string(ssh, &server_host_key_blob,
&sbloblen)) != 0 ||
(r = sshkey_from_blob(server_host_key_blob, sbloblen,
&server_host_key)) != 0)
goto out;
if ((r = kex_verify_host_key(ssh, server_host_key)) != 0)
goto out;
/* Q_S, server public key */
/* signed H */
if ((r = sshpkt_get_string(ssh, &server_pubkey, &pklen)) != 0 ||
(r = sshpkt_get_string(ssh, &signature, &slen)) != 0 ||
(r = sshpkt_get_end(ssh)) != 0)
goto out;
/* compute shared secret */
if ((r = kex_kem_sntrup4591761x25519_dec(kex, server_pubkey, pklen,
&shared_secret)) != 0)
goto out;
/* calc and verify H */
hashlen = sizeof(hash);
if ((r = kex_c25519_hash(
kex->hash_alg,
kex->client_version,
kex->server_version,
sshbuf_ptr(kex->my), sshbuf_len(kex->my),
sshbuf_ptr(kex->peer), sshbuf_len(kex->peer),
server_host_key_blob, sbloblen,
sshbuf_ptr(kex->kem_client_pub), sshbuf_len(kex->kem_client_pub),
server_pubkey, pklen,
sshbuf_ptr(shared_secret), sshbuf_len(shared_secret),
hash, &hashlen)) != 0)
goto out;
if ((r = sshkey_verify(server_host_key, signature, slen, hash, hashlen,
kex->hostkey_alg, ssh->compat)) != 0)
goto out;
if ((r = kex_derive_keys(ssh, hash, hashlen, shared_secret)) == 0)
r = kex_send_newkeys(ssh);
out:
explicit_bzero(hash, sizeof(hash));
explicit_bzero(kex->c25519_client_key, sizeof(kex->c25519_client_key));
explicit_bzero(kex->sntrup4591761_client_key,
sizeof(kex->sntrup4591761_client_key));
free(server_host_key_blob);
free(server_pubkey);
free(signature);
sshkey_free(server_host_key);
sshbuf_free(shared_secret);
sshbuf_free(kex->kem_client_pub);
kex->kem_client_pub = NULL;
return r;
}

116
kexkems.c Normal file
Просмотреть файл

@ -0,0 +1,116 @@
/* $OpenBSD: kexkems.c,v 1.1 2019/01/21 10:20:12 djm Exp $ */
/*
* Copyright (c) 2019 Markus Friedl. All rights reserved.
*
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#include <sys/types.h>
#include <stdio.h>
#include <string.h>
#include <signal.h>
#include "sshkey.h"
#include "digest.h"
#include "kex.h"
#include "log.h"
#include "packet.h"
#include "ssh2.h"
#include "sshbuf.h"
#include "ssherr.h"
static int input_kex_kem_init(int, u_int32_t, struct ssh *);
int
kex_kem_server(struct ssh *ssh)
{
debug("expecting SSH2_MSG_KEX_ECDH_INIT");
ssh_dispatch_set(ssh, SSH2_MSG_KEX_ECDH_INIT, &input_kex_kem_init);
return 0;
}
static int
input_kex_kem_init(int type, u_int32_t seq, struct ssh *ssh)
{
struct kex *kex = ssh->kex;
struct sshkey *server_host_private, *server_host_public;
struct sshbuf *shared_secret = NULL;
struct sshbuf *server_pubkey = NULL;
u_char *server_host_key_blob = NULL, *signature = NULL;
u_char *client_pubkey = NULL;
u_char hash[SSH_DIGEST_MAX_LENGTH];
size_t slen, pklen, sbloblen, hashlen;
int r;
if ((r = kex_load_hostkey(ssh, &server_host_private,
&server_host_public)) != 0)
goto out;
if ((r = sshpkt_get_string(ssh, &client_pubkey, &pklen)) != 0 ||
(r = sshpkt_get_end(ssh)) != 0)
goto out;
/* compute shared secret */
if ((r = kex_kem_sntrup4591761x25519_enc(kex, client_pubkey, pklen,
&server_pubkey, &shared_secret)) != 0)
goto out;
/* calc H */
if ((r = sshkey_to_blob(server_host_public, &server_host_key_blob,
&sbloblen)) != 0)
goto out;
hashlen = sizeof(hash);
if ((r = kex_c25519_hash(
kex->hash_alg,
kex->client_version,
kex->server_version,
sshbuf_ptr(kex->peer), sshbuf_len(kex->peer),
sshbuf_ptr(kex->my), sshbuf_len(kex->my),
server_host_key_blob, sbloblen,
client_pubkey, pklen,
sshbuf_ptr(server_pubkey), sshbuf_len(server_pubkey),
sshbuf_ptr(shared_secret), sshbuf_len(shared_secret),
hash, &hashlen)) != 0)
goto out;
/* sign H */
if ((r = kex->sign(ssh, server_host_private, server_host_public,
&signature, &slen, hash, hashlen, kex->hostkey_alg)) != 0)
goto out;
/* send server hostkey, ECDH pubkey 'Q_S' and signed H */
if ((r = sshpkt_start(ssh, SSH2_MSG_KEX_ECDH_REPLY)) != 0 ||
(r = sshpkt_put_string(ssh, server_host_key_blob, sbloblen)) != 0 ||
(r = sshpkt_put_stringb(ssh, server_pubkey)) != 0 ||
(r = sshpkt_put_string(ssh, signature, slen)) != 0 ||
(r = sshpkt_send(ssh)) != 0)
goto out;
if ((r = kex_derive_keys(ssh, hash, hashlen, shared_secret)) == 0)
r = kex_send_newkeys(ssh);
out:
explicit_bzero(hash, sizeof(hash));
free(server_host_key_blob);
free(signature);
free(client_pubkey);
sshbuf_free(shared_secret);
sshbuf_free(server_pubkey);
return r;
}

213
kexsntrup4591761x25519.c Normal file
Просмотреть файл

@ -0,0 +1,213 @@
/* $OpenBSD: kexsntrup4591761x25519.c,v 1.1 2019/01/21 10:20:12 djm Exp $ */
/*
* Copyright (c) 2019 Markus Friedl. All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#include <sys/types.h>
#include <stdio.h>
#include <string.h>
#include <signal.h>
#include "sshkey.h"
#include "kex.h"
#include "sshbuf.h"
#include "digest.h"
#include "ssherr.h"
int
kex_kem_sntrup4591761x25519_keypair(struct kex *kex)
{
struct sshbuf *buf = NULL;
u_char *cp = NULL;
size_t need;
int r;
if ((buf = sshbuf_new()) == NULL)
return SSH_ERR_ALLOC_FAIL;
need = crypto_kem_sntrup4591761_PUBLICKEYBYTES + CURVE25519_SIZE;
if ((r = sshbuf_reserve(buf, need, &cp)) != 0)
goto out;
crypto_kem_sntrup4591761_keypair(cp, kex->sntrup4591761_client_key);
#ifdef DEBUG_KEXECDH
dump_digest("client public key sntrup4591761:", cp,
crypto_kem_sntrup4591761_PUBLICKEYBYTES);
#endif
cp += crypto_kem_sntrup4591761_PUBLICKEYBYTES;
kexc25519_keygen(kex->c25519_client_key, cp);
#ifdef DEBUG_KEXECDH
dump_digest("client public key c25519:", cp, CURVE25519_SIZE);
#endif
kex->kem_client_pub = buf;
buf = NULL;
out:
sshbuf_free(buf);
return r;
}
int
kex_kem_sntrup4591761x25519_enc(struct kex *kex, const u_char *pkblob,
size_t pklen, struct sshbuf **server_blobp, struct sshbuf **shared_secretp)
{
struct sshbuf *server_blob = NULL;
struct sshbuf *buf = NULL;
u_char *kem_key, *ciphertext, *server_pub;
u_char server_key[CURVE25519_SIZE];
u_char hash[SSH_DIGEST_MAX_LENGTH];
size_t need;
int r;
*server_blobp = NULL;
*shared_secretp = NULL;
/* pkblob contains both KEM and ECDH client pubkeys */
need = crypto_kem_sntrup4591761_PUBLICKEYBYTES + CURVE25519_SIZE;
if (pklen != need) {
r = SSH_ERR_SIGNATURE_INVALID;
goto out;
}
#ifdef DEBUG_KEXECDH
dump_digest("client public key sntrup4591761:", pkblob,
crypto_kem_sntrup4591761_PUBLICKEYBYTES);
dump_digest("client public key 25519:",
pkblob + crypto_kem_sntrup4591761_PUBLICKEYBYTES, CURVE25519_SIZE);
#endif
/* allocate buffer for concatenation of KEM key and ECDH shared key */
/* the buffer will be hashed and the result is the shared secret */
if ((buf = sshbuf_new()) == NULL) {
r = SSH_ERR_ALLOC_FAIL;
goto out;
}
if ((r = sshbuf_reserve(buf, crypto_kem_sntrup4591761_BYTES,
&kem_key)) != 0)
goto out;
/* allocate space for encrypted KEM key and ECDH pub key */
if ((server_blob = sshbuf_new()) == NULL) {
r = SSH_ERR_ALLOC_FAIL;
goto out;
}
need = crypto_kem_sntrup4591761_CIPHERTEXTBYTES + CURVE25519_SIZE;
if ((r = sshbuf_reserve(server_blob, need, &ciphertext)) != 0)
goto out;
/* generate and encrypt KEM key with client key */
crypto_kem_sntrup4591761_enc(ciphertext, kem_key, pkblob);
/* generate ECDH key pair, store server pubkey after ciphertext */
server_pub = ciphertext + crypto_kem_sntrup4591761_CIPHERTEXTBYTES;
kexc25519_keygen(server_key, server_pub);
/* append ECDH shared key */
if ((r = kexc25519_shared_key_ext(server_key,
pkblob + crypto_kem_sntrup4591761_PUBLICKEYBYTES, buf, 1)) < 0)
goto out;
if ((r = ssh_digest_buffer(kex->hash_alg, buf, hash, sizeof(hash))) != 0)
goto out;
#ifdef DEBUG_KEXECDH
dump_digest("server public key 25519:", server_pub, CURVE25519_SIZE);
dump_digest("server cipher text:", ciphertext,
crypto_kem_sntrup4591761_CIPHERTEXTBYTES);
dump_digest("server kem key:", kem_key, sizeof(kem_key));
dump_digest("concatenation of KEM key and ECDH shared key:",
sshbuf_ptr(buf), sshbuf_len(buf));
#endif
/* string-encoded hash is resulting shared secret */
sshbuf_reset(buf);
if ((r = sshbuf_put_string(buf, hash,
ssh_digest_bytes(kex->hash_alg))) != 0)
goto out;
#ifdef DEBUG_KEXECDH
dump_digest("encoded shared secret:", sshbuf_ptr(buf), sshbuf_len(buf));
#endif
*server_blobp = server_blob;
*shared_secretp = buf;
server_blob = NULL;
buf = NULL;
out:
explicit_bzero(hash, sizeof(hash));
explicit_bzero(server_key, sizeof(server_key));
sshbuf_free(server_blob);
sshbuf_free(buf);
return r;
}
int
kex_kem_sntrup4591761x25519_dec(struct kex *kex, const u_char *pkblob,
size_t pklen, struct sshbuf **shared_secretp)
{
struct sshbuf *buf = NULL;
u_char *kem_key = NULL;
const u_char *ciphertext, *server_pub;
u_char hash[SSH_DIGEST_MAX_LENGTH];
size_t need;
int r, decoded;
*shared_secretp = NULL;
need = crypto_kem_sntrup4591761_CIPHERTEXTBYTES + CURVE25519_SIZE;
if (pklen != need) {
r = SSH_ERR_SIGNATURE_INVALID;
goto out;
}
ciphertext = pkblob;
server_pub = pkblob + crypto_kem_sntrup4591761_CIPHERTEXTBYTES;
#ifdef DEBUG_KEXECDH
dump_digest("server cipher text:", ciphertext,
crypto_kem_sntrup4591761_CIPHERTEXTBYTES);
dump_digest("server public key c25519:", server_pub, CURVE25519_SIZE);
#endif
/* hash concatenation of KEM key and ECDH shared key */
if ((buf = sshbuf_new()) == NULL) {
r = SSH_ERR_ALLOC_FAIL;
goto out;
}
if ((r = sshbuf_reserve(buf, crypto_kem_sntrup4591761_BYTES,
&kem_key)) != 0)
goto out;
decoded = crypto_kem_sntrup4591761_dec(kem_key, ciphertext,
kex->sntrup4591761_client_key);
if ((r = kexc25519_shared_key_ext(kex->c25519_client_key, server_pub,
buf, 1)) < 0)
goto out;
if ((r = ssh_digest_buffer(kex->hash_alg, buf, hash, sizeof(hash))) != 0)
goto out;
#ifdef DEBUG_KEXECDH
dump_digest("client kem key:", kem_key, sizeof(kem_key));
dump_digest("concatenation of KEM key and ECDH shared key:",
sshbuf_ptr(buf), sshbuf_len(buf));
#endif
sshbuf_reset(buf);
if ((r = sshbuf_put_string(buf, hash,
ssh_digest_bytes(kex->hash_alg))) != 0)
goto out;
#ifdef DEBUG_KEXECDH
dump_digest("encoded shared secret:", sshbuf_ptr(buf), sshbuf_len(buf));
#endif
if (decoded != 0) {
r = SSH_ERR_SIGNATURE_INVALID;
goto out;
}
*shared_secretp = buf;
buf = NULL;
out:
explicit_bzero(hash, sizeof(hash));
sshbuf_free(buf);
return r;
}

3
monitor.c
Просмотреть файл

@ -1,4 +1,4 @@
/* $OpenBSD: monitor.c,v 1.192 2019/01/19 21:43:56 djm Exp $ */
/* $OpenBSD: monitor.c,v 1.193 2019/01/21 10:20:12 djm Exp $ */
/*
* Copyright 2002 Niels Provos <provos@citi.umich.edu>
* Copyright 2002 Markus Friedl <markus@openbsd.org>
@ -1689,6 +1689,7 @@ monitor_apply_keystate(struct ssh *ssh, struct monitor *pmonitor)
# endif
#endif /* WITH_OPENSSL */
kex->kex[KEX_C25519_SHA256] = kexc25519_server;
kex->kex[KEX_KEM_SNTRUP4591761X25519_SHA512] = kex_kem_server;
kex->load_host_public_key=&get_hostkey_public_by_type;
kex->load_host_private_key=&get_hostkey_private_by_type;
kex->host_key_index=&get_hostkey_index;

1068
sntrup4591761.c Normal file
Просмотреть файл

Разница между файлами не показана из-за своего большого размера Загрузить разницу

47
sntrup4591761.sh Normal file
Просмотреть файл

@ -0,0 +1,47 @@
#!/bin/sh
FILES="
supercop-20181216/crypto_sort/int32/portable3/int32_minmax.inc
supercop-20181216/crypto_sort/int32/portable3/sort.c
supercop-20181216/crypto_kem/sntrup4591761/ref/small.h
supercop-20181216/crypto_kem/sntrup4591761/ref/mod3.h
supercop-20181216/crypto_kem/sntrup4591761/ref/modq.h
supercop-20181216/crypto_kem/sntrup4591761/ref/params.h
supercop-20181216/crypto_kem/sntrup4591761/ref/r3.h
supercop-20181216/crypto_kem/sntrup4591761/ref/rq.h
supercop-20181216/crypto_kem/sntrup4591761/ref/swap.h
supercop-20181216/crypto_kem/sntrup4591761/ref/dec.c
supercop-20181216/crypto_kem/sntrup4591761/ref/enc.c
supercop-20181216/crypto_kem/sntrup4591761/ref/keypair.c
supercop-20181216/crypto_kem/sntrup4591761/ref/r3_mult.c
supercop-20181216/crypto_kem/sntrup4591761/ref/r3_recip.c
supercop-20181216/crypto_kem/sntrup4591761/ref/randomsmall.c
supercop-20181216/crypto_kem/sntrup4591761/ref/randomweightw.c
supercop-20181216/crypto_kem/sntrup4591761/ref/rq.c
supercop-20181216/crypto_kem/sntrup4591761/ref/rq_mult.c
supercop-20181216/crypto_kem/sntrup4591761/ref/rq_recip3.c
supercop-20181216/crypto_kem/sntrup4591761/ref/rq_round3.c
supercop-20181216/crypto_kem/sntrup4591761/ref/rq_rounded.c
supercop-20181216/crypto_kem/sntrup4591761/ref/small.c
supercop-20181216/crypto_kem/sntrup4591761/ref/swap.c
"
###
set -e
DIR=/data/git/mfriedl
cd $DIR
echo '#include <string.h>'
echo '#include "crypto_api.h"'
echo
for i in $FILES; do
echo "/* from $i */"
b=$(basename $i .c)
grep \
-v '#include' $i | \
grep -v "extern crypto_int32 small_random32" |
sed -e "s/crypto_kem_/crypto_kem_sntrup4591761_/g" \
-e "s/smaller_mask/smaller_mask_${b}/g" \
-e "s/void crypto_sort/void crypto_sort_int32/" \
-e "s/^extern void /static void /" \
-e "s/^void /static void /"
echo
done

3
ssh-keyscan.c
Просмотреть файл

@ -1,4 +1,4 @@
/* $OpenBSD: ssh-keyscan.c,v 1.120 2018/06/06 18:29:18 markus Exp $ */
/* $OpenBSD: ssh-keyscan.c,v 1.121 2019/01/21 10:20:12 djm Exp $ */
/*
* Copyright 1995, 1996 by David Mazieres <dm@lcs.mit.edu>.
*
@ -272,6 +272,7 @@ keygrab_ssh2(con *c)
# endif
#endif
c->c_ssh->kex->kex[KEX_C25519_SHA256] = kexc25519_client;
c->c_ssh->kex->kex[KEX_KEM_SNTRUP4591761X25519_SHA512] = kex_kem_client;
ssh_set_verify_host_key_callback(c->c_ssh, key_print_wrapper);
/*
* do the key-exchange until an error occurs or until

4
ssh_api.c
Просмотреть файл

@ -1,4 +1,4 @@
/* $OpenBSD: ssh_api.c,v 1.10 2019/01/19 21:43:56 djm Exp $ */
/* $OpenBSD: ssh_api.c,v 1.11 2019/01/21 10:20:12 djm Exp $ */
/*
* Copyright (c) 2012 Markus Friedl. All rights reserved.
*
@ -111,6 +111,7 @@ ssh_init(struct ssh **sshp, int is_server, struct kex_params *kex_params)
# endif
#endif /* WITH_OPENSSL */
ssh->kex->kex[KEX_C25519_SHA256] = kexc25519_server;
ssh->kex->kex[KEX_KEM_SNTRUP4591761X25519_SHA512] = kex_kem_server;
ssh->kex->load_host_public_key=&_ssh_host_public_key;
ssh->kex->load_host_private_key=&_ssh_host_private_key;
ssh->kex->sign=&_ssh_host_key_sign;
@ -128,6 +129,7 @@ ssh_init(struct ssh **sshp, int is_server, struct kex_params *kex_params)
# endif
#endif /* WITH_OPENSSL */
ssh->kex->kex[KEX_C25519_SHA256] = kexc25519_client;
ssh->kex->kex[KEX_KEM_SNTRUP4591761X25519_SHA512] = kex_kem_client;
ssh->kex->verify_host_key =&_ssh_verify_host_key;
}
*sshp = ssh;

3
sshconnect2.c
Просмотреть файл

@ -1,4 +1,4 @@
/* $OpenBSD: sshconnect2.c,v 1.296 2019/01/21 01:05:00 djm Exp $ */
/* $OpenBSD: sshconnect2.c,v 1.297 2019/01/21 10:20:12 djm Exp $ */
/*
* Copyright (c) 2000 Markus Friedl. All rights reserved.
* Copyright (c) 2008 Damien Miller. All rights reserved.
@ -213,6 +213,7 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port)
# endif
#endif
ssh->kex->kex[KEX_C25519_SHA256] = kexc25519_client;
ssh->kex->kex[KEX_KEM_SNTRUP4591761X25519_SHA512] = kex_kem_client;
ssh->kex->verify_host_key=&verify_host_key_callback;
ssh_dispatch_run_fatal(ssh, DISPATCH_BLOCK, &ssh->kex->done);

3
sshd.c
Просмотреть файл

@ -1,4 +1,4 @@
/* $OpenBSD: sshd.c,v 1.527 2019/01/19 21:43:56 djm Exp $ */
/* $OpenBSD: sshd.c,v 1.528 2019/01/21 10:20:12 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@ -2219,6 +2219,7 @@ do_ssh2_kex(struct ssh *ssh)
# endif
#endif
kex->kex[KEX_C25519_SHA256] = kexc25519_server;
kex->kex[KEX_KEM_SNTRUP4591761X25519_SHA512] = kex_kem_server;
kex->load_host_public_key=&get_hostkey_public_by_type;
kex->load_host_private_key=&get_hostkey_private_by_type;
kex->host_key_index=&get_hostkey_index;