From 35205e5cb764dca5afaf1e90dc6d485fcc5ed283 Mon Sep 17 00:00:00 2001
From: Simon Tatham <anakin@pobox.com>
Date: Tue, 5 Sep 2000 14:28:17 +0000
Subject: [PATCH] SSH 2 support, phase 1, debugging. Currently does
 Diffie-Hellman and gets the same results as the server, which is a pretty
 good start.

[originally from svn r569]
---
 Makefile   |  10 +-
 ssh.c      | 800 ++++++++++++++++++++++++++++++++++++++++++++++-------
 ssh.h      |  60 ++++
 sshblowf.c |   4 +-
 sshbn.c    | 239 ++++++++++++++++
 sshdes.c   |   8 +-
 sshdh.c    | 115 ++++++++
 sshdss.c   |   5 +
 sshrsa.c   | 202 +-------------
 sshsha.c   | 185 ++++++++++++-
 10 files changed, 1324 insertions(+), 304 deletions(-)
 create mode 100644 sshbn.c
 create mode 100644 sshdh.c
 create mode 100644 sshdss.c

diff --git a/Makefile b/Makefile
index dd7b0672..dc671ffa 100644
--- a/Makefile
+++ b/Makefile
@@ -57,7 +57,8 @@ SOBJS = scp.$(OBJ) windlg.$(OBJ) ssh.$(OBJ) be_none.$(OBJ)
 MOBJS = misc.$(OBJ) version.$(OBJ)
 ##-- objects putty pscp
 OBJS1 = sshcrc.$(OBJ) sshdes.$(OBJ) sshmd5.$(OBJ) sshrsa.$(OBJ) sshrand.$(OBJ)
-OBJS2 = sshsha.$(OBJ) sshblowf.$(OBJ) noise.$(OBJ)
+OBJS2 = sshsha.$(OBJ) sshblowf.$(OBJ) noise.$(OBJ) sshdh.$(OBJ) sshdss.$(OBJ)
+OBJS3 = sshbn.$(OBJ)
 ##-- resources putty
 PRESRC = win_res.$(RES)
 ##-- resources puttytel
@@ -78,7 +79,7 @@ LIBS2 = wsock32.lib comctl32.lib comdlg32.lib
 
 all: putty.exe puttytel.exe pscp.exe
 
-putty.exe: $(GOBJS1) $(GOBJS2) $(POBJS) $(MOBJS) $(OBJS1) $(OBJS2) $(PRESRC) putty.rsp
+putty.exe: $(GOBJS1) $(GOBJS2) $(POBJS) $(MOBJS) $(OBJS1) $(OBJS2) $(OBJS3) $(PRESRC) putty.rsp
 	link $(LFLAGS) -out:putty.exe @putty.rsp
 
 puttytel.exe: $(GOBJS1) $(GOBJS2) $(TOBJS) $(MOBJS) $(TRESRC) puttytel.rsp
@@ -95,6 +96,7 @@ putty.rsp: makefile
 	echo $(MOBJS) >> putty.rsp
 	echo $(OBJS1) >> putty.rsp
 	echo $(OBJS2) >> putty.rsp
+	echo $(OBJS3) >> putty.rsp
 	echo $(PRESRC) >> putty.rsp
 	echo $(LIBS1) >> putty.rsp
 	echo $(LIBS2) >> putty.rsp
@@ -115,6 +117,7 @@ pscp.rsp: makefile
 	echo $(MOBJS) >> pscp.rsp
 	echo $(OBJS1) >> pscp.rsp
 	echo $(OBJS2) >> pscp.rsp
+	echo $(OBJS3) >> pscp.rsp
 	echo $(SRESRC) >> pscp.rsp
 	echo $(LIBS1) >> pscp.rsp
 	echo $(LIBS2) >> pscp.rsp
@@ -138,6 +141,9 @@ sshrsa.$(OBJ): sshrsa.c ssh.h
 sshsha.$(OBJ): sshsha.c ssh.h
 sshrand.$(OBJ): sshrand.c ssh.h
 sshblowf.$(OBJ): sshblowf.c ssh.h
+sshdh.$(OBJ): sshdh.c ssh.h
+sshdss.$(OBJ): sshdss.c ssh.h
+sshbn.$(OBJ): sshbn.c ssh.h
 scp.$(OBJ): scp.c putty.h scp.h
 version.$(OBJ): version.c
 be_all.$(OBJ): be_all.c
diff --git a/ssh.c b/ssh.c
index 65f0075c..ae41a80e 100644
--- a/ssh.c
+++ b/ssh.c
@@ -19,30 +19,41 @@
                       if (IS_SCP && (scp_flags & SCP_VERBOSE) != 0) \
                       fprintf(stderr, "%s\n", s); }
 
-#define SSH_MSG_DISCONNECT	1
-#define SSH_SMSG_PUBLIC_KEY	2
-#define SSH_CMSG_SESSION_KEY	3
-#define SSH_CMSG_USER		4
-#define SSH_CMSG_AUTH_PASSWORD	9
-#define SSH_CMSG_REQUEST_PTY	10
-#define SSH_CMSG_WINDOW_SIZE	11
-#define SSH_CMSG_EXEC_SHELL	12
-#define SSH_CMSG_EXEC_CMD	13
-#define SSH_SMSG_SUCCESS	14
-#define SSH_SMSG_FAILURE	15
-#define SSH_CMSG_STDIN_DATA	16
-#define SSH_SMSG_STDOUT_DATA	17
-#define SSH_SMSG_STDERR_DATA	18
-#define SSH_CMSG_EOF		19
-#define SSH_SMSG_EXIT_STATUS	20
-#define SSH_CMSG_EXIT_CONFIRMATION	33
-#define SSH_MSG_IGNORE		32
-#define SSH_MSG_DEBUG		36
-#define SSH_CMSG_AUTH_TIS	39
-#define SSH_SMSG_AUTH_TIS_CHALLENGE	40
-#define SSH_CMSG_AUTH_TIS_RESPONSE	41
+#define SSH1_MSG_DISCONNECT	1
+#define SSH1_SMSG_PUBLIC_KEY	2
+#define SSH1_CMSG_SESSION_KEY	3
+#define SSH1_CMSG_USER		4
+#define SSH1_CMSG_AUTH_PASSWORD	9
+#define SSH1_CMSG_REQUEST_PTY	10
+#define SSH1_CMSG_WINDOW_SIZE	11
+#define SSH1_CMSG_EXEC_SHELL	12
+#define SSH1_CMSG_EXEC_CMD	13
+#define SSH1_SMSG_SUCCESS	14
+#define SSH1_SMSG_FAILURE	15
+#define SSH1_CMSG_STDIN_DATA	16
+#define SSH1_SMSG_STDOUT_DATA	17
+#define SSH1_SMSG_STDERR_DATA	18
+#define SSH1_CMSG_EOF		19
+#define SSH1_SMSG_EXIT_STATUS	20
+#define SSH1_CMSG_EXIT_CONFIRMATION	33
+#define SSH1_MSG_IGNORE		32
+#define SSH1_MSG_DEBUG		36
+#define SSH1_CMSG_AUTH_TIS	39
+#define SSH1_SMSG_AUTH_TIS_CHALLENGE	40
+#define SSH1_CMSG_AUTH_TIS_RESPONSE	41
 
-#define SSH_AUTH_TIS		5
+#define SSH1_AUTH_TIS		5
+
+#define SSH2_MSG_DISCONNECT             1
+#define SSH2_MSG_IGNORE                 2
+#define SSH2_MSG_UNIMPLEMENTED          3
+#define SSH2_MSG_DEBUG                  4
+#define SSH2_MSG_SERVICE_REQUEST        5
+#define SSH2_MSG_SERVICE_ACCEPT         6
+#define SSH2_MSG_KEXINIT                20
+#define SSH2_MSG_NEWKEYS                21
+#define SSH2_MSG_KEXDH_INIT             30
+#define SSH2_MSG_KEXDH_REPLY            31
 
 #define GET_32BIT(cp) \
     (((unsigned long)(unsigned char)(cp)[0] << 24) | \
@@ -76,10 +87,48 @@ enum { PKT_END, PKT_INT, PKT_CHAR, PKT_DATA, PKT_STR };
 #define crStopV		do{ crLine = 0; return; }while(0)
 #define crWaitUntil(c)	do { crReturn(0); } while (!(c))
 
+extern struct ssh_cipher ssh_3des;
+extern struct ssh_cipher ssh_des;
+extern struct ssh_cipher ssh_blowfish;
+
+/* for ssh 2; we miss out single-DES because it isn't supported */
+struct ssh_cipher *ciphers[] = { &ssh_3des, &ssh_blowfish };
+
+extern struct ssh_kex ssh_diffiehellman;
+struct ssh_kex *kex_algs[] = { &ssh_diffiehellman };
+
+extern struct ssh_hostkey ssh_dss;
+struct ssh_hostkey *hostkey_algs[] = { &ssh_dss };
+
+extern struct ssh_mac ssh_sha1;
+
+SHA_State exhash;
+
+static void nullmac_sesskey(unsigned char *key, int len) { }
+static void nullmac_generate(unsigned char *blk, int len, unsigned long seq) { }
+static int nullmac_verify(unsigned char *blk, int len, unsigned long seq) { return 1; }
+struct ssh_mac ssh_mac_none = {
+    nullmac_sesskey, nullmac_generate, nullmac_verify, "none", 0
+};
+struct ssh_mac *macs[] = { &ssh_sha1, &ssh_mac_none };
+
+struct ssh_compress ssh_comp_none = {
+    "none"
+};
+struct ssh_compress *compressions[] = { &ssh_comp_none };
+
 static SOCKET s = INVALID_SOCKET;
 
 static unsigned char session_key[32];
 static struct ssh_cipher *cipher = NULL;
+static struct ssh_cipher *cscipher = NULL;
+static struct ssh_cipher *sccipher = NULL;
+static struct ssh_mac *csmac = NULL;
+static struct ssh_mac *scmac = NULL;
+static struct ssh_compress *cscomp = NULL;
+static struct ssh_compress *sccomp = NULL;
+static struct ssh_kex *kex = NULL;
+static struct ssh_hostkey *hostkey = NULL;
 int scp_flags = 0;
 int (*ssh_get_password)(const char *prompt, char *str, int maxlen) = NULL;
 
@@ -137,25 +186,29 @@ struct Packet {
     int type;
     unsigned char *data;
     unsigned char *body;
+    long savedpos;
     long maxlen;
 };
 
 static struct Packet pktin = { 0, 0, NULL, NULL, 0 };
 static struct Packet pktout = { 0, 0, NULL, NULL, 0 };
 
-static void ssh_protocol(unsigned char *in, int inlen, int ispkt);
+static void (*ssh_protocol)(unsigned char *in, int inlen, int ispkt);
+static void ssh1_protocol(unsigned char *in, int inlen, int ispkt);
+static void ssh2_protocol(unsigned char *in, int inlen, int ispkt);
 static void ssh_size(void);
 
+static int (*s_rdpkt)(unsigned char **data, int *datalen);
 
 /*
  * Collect incoming data in the incoming packet buffer.
- * Decihper and verify the packet when it is completely read.
- * Drop SSH_MSG_DEBUG and SSH_MSG_IGNORE packets.
+ * Decipher and verify the packet when it is completely read.
+ * Drop SSH1_MSG_DEBUG and SSH1_MSG_IGNORE packets.
  * Update the *data and *datalen variables.
  * Return the additional nr of bytes needed, or 0 when
  * a complete packet is available.
  */
-static int s_rdpkt(unsigned char **data, int *datalen)
+static int ssh1_rdpkt(unsigned char **data, int *datalen)
 {
     static long len, pad, biglen, to_read;
     static unsigned long realcrc, gotcrc;
@@ -188,15 +241,8 @@ next_packet:
 
     if (pktin.maxlen < biglen) {
 	pktin.maxlen = biglen;
-#ifdef MSCRYPTOAPI
-	/* Allocate enough buffer space for extra block
-	 * for MS CryptEncrypt() */
-	pktin.data = (pktin.data == NULL ? malloc(biglen+8) :
-	              realloc(pktin.data, biglen+8));
-#else
-	pktin.data = (pktin.data == NULL ? malloc(biglen) :
-	              realloc(pktin.data, biglen));
-#endif
+	pktin.data = (pktin.data == NULL ? malloc(biglen+APIEXTRA) :
+	              realloc(pktin.data, biglen+APIEXTRA));
 	if (!pktin.data)
 	    fatalbox("Out of memory");
     }
@@ -229,16 +275,16 @@ next_packet:
 	fatalbox("Incorrect CRC received on packet");
     }
 
-    if (pktin.type == SSH_SMSG_STDOUT_DATA ||
-        pktin.type == SSH_SMSG_STDERR_DATA ||
-        pktin.type == SSH_MSG_DEBUG ||
-        pktin.type == SSH_SMSG_AUTH_TIS_CHALLENGE) {
+    if (pktin.type == SSH1_SMSG_STDOUT_DATA ||
+        pktin.type == SSH1_SMSG_STDERR_DATA ||
+        pktin.type == SSH1_MSG_DEBUG ||
+        pktin.type == SSH1_SMSG_AUTH_TIS_CHALLENGE) {
 	long strlen = GET_32BIT(pktin.body);
 	if (strlen + 4 != pktin.length)
 	    fatalbox("Received data packet with bogus string length");
     }
 
-    if (pktin.type == SSH_MSG_DEBUG) {
+    if (pktin.type == SSH1_MSG_DEBUG) {
 	/* log debug message */
 	char buf[80];
 	int strlen = GET_32BIT(pktin.body);
@@ -248,7 +294,7 @@ next_packet:
 	buf[8+strlen] = '\0';
 	logevent(buf);
 	goto next_packet;
-    } else if (pktin.type == SSH_MSG_IGNORE) {
+    } else if (pktin.type == SSH1_MSG_IGNORE) {
 	/* do nothing */
 	goto next_packet;
     }
@@ -256,6 +302,118 @@ next_packet:
     crFinish(0);
 }
 
+static int ssh2_rdpkt(unsigned char **data, int *datalen)
+{
+    static long len, pad, payload, packetlen, maclen;
+    static int i;
+    static int cipherblk;
+    static unsigned long incoming_sequence = 0;
+
+    crBegin;
+
+next_packet:
+
+    pktin.type = 0;
+    pktin.length = 0;
+
+    if (cipher)
+        cipherblk = cipher->blksize;
+    else
+        cipherblk = 8;
+    if (cipherblk < 8)
+        cipherblk = 8;
+
+    if (pktin.maxlen < cipherblk) {
+	pktin.maxlen = cipherblk;
+	pktin.data = (pktin.data == NULL ? malloc(cipherblk+APIEXTRA) :
+	              realloc(pktin.data, cipherblk+APIEXTRA));
+	if (!pktin.data)
+	    fatalbox("Out of memory");
+    }
+
+    /*
+     * Acquire and decrypt the first block of the packet. This will
+     * contain the length and padding details.
+     */
+     for (i = len = 0; i < cipherblk; i++) {
+	while ((*datalen) == 0)
+	    crReturn(cipherblk-i);
+	pktin.data[i] = *(*data)++;
+        (*datalen)--;
+    }
+#ifdef FWHACK
+    if (!memcmp(pktin.data, "Remo", 4)) {/* "Remo"te server has closed ... */
+        /* FIXME */
+    }
+#endif
+    if (sccipher)
+        sccipher->decrypt(pktin.data, cipherblk);
+
+    /*
+     * Now get the length and padding figures.
+     */
+    len = GET_32BIT(pktin.data);
+    pad = pktin.data[4];
+
+    /*
+     * This enables us to deduce the payload length.
+     */
+    payload = len - pad - 1;
+
+    pktin.length = payload + 5;
+
+    /*
+     * So now we can work out the total packet length.
+     */
+    packetlen = len + 4;
+    maclen = scmac ? scmac->len : 0;
+
+    /*
+     * Adjust memory allocation if packet is too big.
+     */
+    if (pktin.maxlen < packetlen) {
+	pktin.maxlen = packetlen;
+	pktin.data = (pktin.data == NULL ? malloc(packetlen+APIEXTRA) :
+	              realloc(pktin.data, packetlen+APIEXTRA));
+	if (!pktin.data)
+	    fatalbox("Out of memory");
+    }
+
+    /*
+     * Read and decrypt the remainder of the packet.
+     */
+    for (i = cipherblk; i < packetlen + maclen; i++) {
+	while ((*datalen) == 0)
+	    crReturn(packetlen + maclen - i);
+	pktin.data[i] = *(*data)++;
+        (*datalen)--;
+    }
+    /* Decrypt everything _except_ the MAC. */
+    if (sccipher)
+        sccipher->decrypt(pktin.data + cipherblk, packetlen - cipherblk);
+
+    /*
+     * Check the MAC.
+     */
+    if (scmac && !scmac->verify(pktin.data, incoming_sequence++, len+4))
+	fatalbox("Incorrect MAC received on packet");
+
+    pktin.savedpos = 6;
+    pktin.type = pktin.data[5];
+#if 0
+    debug(("Got packet len=%d pad=%d\r\n", len, pad));
+    for (i = 0; i < payload; i++)
+        debug(("  %02x", (unsigned char)pktin.data[i]));
+    debug(("\r\n"));
+#endif
+
+    /*
+     * FIXME: handle IGNORE and DEBUG messages.
+     */
+
+    crFinish(0);
+}
+
 static void ssh_gotdata(unsigned char *data, int datalen)
 {
     while (datalen > 0) {
@@ -509,6 +667,24 @@ static int ssh_versioncmp(char *a, char *b) {
     return 0;
 }
 
+
+/*
+ * Utility routine for putting an SSH-protocol `string' into a SHA
+ * state.
+ */
+#include <stdio.h>
+void sha_string(SHA_State *s, void *str, int len) {
+    unsigned char lenblk[4];
+static FILE *fp;
+    PUT_32BIT(lenblk, len);
+if (!fp) fp = fopen("h:\\statham\\windows\\putty\\data","wb");
+fwrite(lenblk, 4, 1, fp);
+    SHA_Bytes(s, lenblk, 4);
+fwrite(str, len, 1, fp);
+fflush(fp);
+    SHA_Bytes(s, str, len);
+}
+
 static int do_ssh_init(void) {
     char c, *vsp;
     char version[10];
@@ -554,19 +730,45 @@ static int do_ssh_init(void) {
     vlog[strcspn(vlog, "\r\n")] = '\0';
     logevent(vlog);
 
-    sprintf(vstring, "SSH-%s-PuTTY\n",
-	    (ssh_versioncmp(version, "1.5") <= 0 ? version : "1.5"));
-    sprintf(vlog, "We claim version: %s", vstring);
-    vlog[strcspn(vlog, "\r\n")] = '\0';
-    logevent(vlog);
-    s_write(vstring, strlen(vstring));
+    if (ssh_versioncmp(version, "1.99") >= 0) {
+        /*
+         * This is a v2 server. Begin v2 protocol.
+         */
+        char *verstring = "SSH-2.0-PuTTY";
+        SHA_Init(&exhash);
+        /*
+         * Hash our version string and their version string.
+         */
+        sha_string(&exhash, verstring, strlen(verstring));
+        sha_string(&exhash, vstring, strcspn(vstring, "\r\n"));
+        sprintf(vstring, "%s\n", verstring);
+        sprintf(vlog, "We claim version: %s", verstring);
+        logevent(vlog);
+        logevent("Using SSH protocol version 2");
+        s_write(vstring, strlen(vstring));
+        ssh_protocol = ssh2_protocol;
+        s_rdpkt = ssh2_rdpkt;
+    } else {
+        /*
+         * This is a v1 server. Begin v1 protocol.
+         */
+        sprintf(vstring, "SSH-%s-PuTTY\n",
+                (ssh_versioncmp(version, "1.5") <= 0 ? version : "1.5"));
+        sprintf(vlog, "We claim version: %s", vstring);
+        vlog[strcspn(vlog, "\r\n")] = '\0';
+        logevent(vlog);
+        logevent("Using SSH protocol version 1");
+        s_write(vstring, strlen(vstring));
+        ssh_protocol = ssh1_protocol;
+        s_rdpkt = ssh1_rdpkt;
+    }
     return 1;
 }
 
 /*
  * Handle the key exchange and user authentication phases.
  */
-static int do_ssh_login(unsigned char *in, int inlen, int ispkt)
+static int do_ssh1_login(unsigned char *in, int inlen, int ispkt)
 {
     int i, j, len;
     unsigned char session_id[16];
@@ -577,15 +779,11 @@ static int do_ssh_login(unsigned char *in, int inlen, int ispkt)
     static unsigned long supported_ciphers_mask, supported_auths_mask;
     int cipher_type;
 
-    extern struct ssh_cipher ssh_3des;
-    extern struct ssh_cipher ssh_des;
-    extern struct ssh_cipher ssh_blowfish;
-
     crBegin;
 
     if (!ispkt) crWaitUntil(ispkt);
 
-    if (pktin.type != SSH_SMSG_PUBLIC_KEY)
+    if (pktin.type != SSH1_SMSG_PUBLIC_KEY)
 	fatalbox("Public key packet not received");
 
     logevent("Received public keys");
@@ -677,7 +875,7 @@ static int do_ssh_login(unsigned char *in, int inlen, int ispkt)
       case SSH_CIPHER_BLOWFISH: logevent("Using Blowfish encryption"); break;
     }
 
-    send_packet(SSH_CMSG_SESSION_KEY,
+    send_packet(SSH1_CMSG_SESSION_KEY,
                 PKT_CHAR, cipher_type,
                 PKT_DATA, cookie, 8,
                 PKT_CHAR, (len*8) >> 8, PKT_CHAR, (len*8) & 0xFF,
@@ -696,7 +894,7 @@ static int do_ssh_login(unsigned char *in, int inlen, int ispkt)
 
     crWaitUntil(ispkt);
 
-    if (pktin.type != SSH_SMSG_SUCCESS)
+    if (pktin.type != SSH1_SMSG_SUCCESS)
 	fatalbox("Encryption not successfully enabled");
 
     logevent("Successfully started encryption");
@@ -752,7 +950,7 @@ static int do_ssh_login(unsigned char *in, int inlen, int ispkt)
 	    }
 	}
 
-	send_packet(SSH_CMSG_USER, PKT_STR, username, PKT_END);
+	send_packet(SSH1_CMSG_USER, PKT_STR, username, PKT_END);
 	{
 	    char userlog[20+sizeof(username)];
 	    sprintf(userlog, "Sent username \"%s\"", username);
@@ -762,7 +960,7 @@ static int do_ssh_login(unsigned char *in, int inlen, int ispkt)
 
     crWaitUntil(ispkt);
 
-    while (pktin.type == SSH_SMSG_FAILURE) {
+    while (pktin.type == SSH1_SMSG_FAILURE) {
 	static char password[100];
 	static int pos;
 	static char c;
@@ -772,7 +970,7 @@ static int do_ssh_login(unsigned char *in, int inlen, int ispkt)
          * Show password prompt, having first obtained it via a TIS
          * exchange if we're doing TIS authentication.
          */
-        pwpkt_type = SSH_CMSG_AUTH_PASSWORD;
+        pwpkt_type = SSH1_CMSG_AUTH_PASSWORD;
 
 	if (IS_SCP) {
 	    char prompt[200];
@@ -790,14 +988,14 @@ static int do_ssh_login(unsigned char *in, int inlen, int ispkt)
             }
 	} else {
 
-        if (pktin.type == SSH_SMSG_FAILURE &&
+        if (pktin.type == SSH1_SMSG_FAILURE &&
             cfg.try_tis_auth &&
-            (supported_auths_mask & (1<<SSH_AUTH_TIS))) {
-            pwpkt_type = SSH_CMSG_AUTH_TIS_RESPONSE;
+            (supported_auths_mask & (1<<SSH1_AUTH_TIS))) {
+            pwpkt_type = SSH1_CMSG_AUTH_TIS_RESPONSE;
 	    logevent("Requested TIS authentication");
-	    send_packet(SSH_CMSG_AUTH_TIS, PKT_END);
+	    send_packet(SSH1_CMSG_AUTH_TIS, PKT_END);
             crWaitUntil(ispkt);
-            if (pktin.type != SSH_SMSG_AUTH_TIS_CHALLENGE) {
+            if (pktin.type != SSH1_SMSG_AUTH_TIS_CHALLENGE) {
                 logevent("TIS authentication declined");
                 c_write("TIS authentication refused.\r\n", 29);
             } else {
@@ -809,7 +1007,7 @@ static int do_ssh_login(unsigned char *in, int inlen, int ispkt)
                 c_write(pktin.body+4, challengelen);
             }
         }
-        if (pwpkt_type == SSH_CMSG_AUTH_PASSWORD)
+        if (pwpkt_type == SSH1_CMSG_AUTH_PASSWORD)
             c_write("password: ", 10);
 
 	pos = 0;
@@ -846,14 +1044,14 @@ static int do_ssh_login(unsigned char *in, int inlen, int ispkt)
 	logevent("Sent password");
 	memset(password, 0, strlen(password));
 	crWaitUntil(ispkt);
-	if (pktin.type == SSH_SMSG_FAILURE) {
+	if (pktin.type == SSH1_SMSG_FAILURE) {
 	    c_write("Access denied\r\n", 15);
 	    logevent("Authentication refused");
-	} else if (pktin.type == SSH_MSG_DISCONNECT) {
+	} else if (pktin.type == SSH1_MSG_DISCONNECT) {
 	    logevent("Received disconnect request");
             ssh_state = SSH_STATE_CLOSED;
 	    crReturn(1);
-	} else if (pktin.type != SSH_SMSG_SUCCESS) {
+	} else if (pktin.type != SSH1_SMSG_SUCCESS) {
 	    fatalbox("Strange packet received, type %d", pktin.type);
 	}
     }
@@ -863,19 +1061,19 @@ static int do_ssh_login(unsigned char *in, int inlen, int ispkt)
     crFinish(1);
 }
 
-static void ssh_protocol(unsigned char *in, int inlen, int ispkt) {
+static void ssh1_protocol(unsigned char *in, int inlen, int ispkt) {
     crBegin;
 
     random_init();
 
-    while (!do_ssh_login(in, inlen, ispkt)) {
+    while (!do_ssh1_login(in, inlen, ispkt)) {
 	crReturnV;
     }
     if (ssh_state == SSH_STATE_CLOSED)
         crReturnV;
 
     if (!cfg.nopty) {
-	send_packet(SSH_CMSG_REQUEST_PTY,
+	send_packet(SSH1_CMSG_REQUEST_PTY,
 	            PKT_STR, cfg.termtype,
 	            PKT_INT, rows, PKT_INT, cols,
 	            PKT_INT, 0, PKT_INT, 0,
@@ -883,15 +1081,15 @@ static void ssh_protocol(unsigned char *in, int inlen, int ispkt) {
 	            PKT_END);
         ssh_state = SSH_STATE_INTERMED;
         do { crReturnV; } while (!ispkt);
-        if (pktin.type != SSH_SMSG_SUCCESS && pktin.type != SSH_SMSG_FAILURE) {
+        if (pktin.type != SSH1_SMSG_SUCCESS && pktin.type != SSH1_SMSG_FAILURE) {
             fatalbox("Protocol confusion");
-        } else if (pktin.type == SSH_SMSG_FAILURE) {
+        } else if (pktin.type == SSH1_SMSG_FAILURE) {
             c_write("Server refused to allocate pty\r\n", 32);
         }
 	logevent("Allocated pty");
     }
 
-    send_packet(SSH_CMSG_EXEC_SHELL, PKT_END);
+    send_packet(SSH1_CMSG_EXEC_SHELL, PKT_END);
     logevent("Started session");
 
     ssh_state = SSH_STATE_SESSION;
@@ -901,25 +1099,25 @@ static void ssh_protocol(unsigned char *in, int inlen, int ispkt) {
     while (1) {
 	crReturnV;
 	if (ispkt) {
-	    if (pktin.type == SSH_SMSG_STDOUT_DATA ||
-                pktin.type == SSH_SMSG_STDERR_DATA) {
+	    if (pktin.type == SSH1_SMSG_STDOUT_DATA ||
+                pktin.type == SSH1_SMSG_STDERR_DATA) {
 		long len = GET_32BIT(pktin.body);
 		c_write(pktin.body+4, len);
-	    } else if (pktin.type == SSH_MSG_DISCONNECT) {
+	    } else if (pktin.type == SSH1_MSG_DISCONNECT) {
                 ssh_state = SSH_STATE_CLOSED;
 		logevent("Received disconnect request");
-	    } else if (pktin.type == SSH_SMSG_SUCCESS) {
+	    } else if (pktin.type == SSH1_SMSG_SUCCESS) {
 		/* may be from EXEC_SHELL on some servers */
-	    } else if (pktin.type == SSH_SMSG_FAILURE) {
+	    } else if (pktin.type == SSH1_SMSG_FAILURE) {
 		/* may be from EXEC_SHELL on some servers
 		 * if no pty is available or in other odd cases. Ignore */
-	    } else if (pktin.type == SSH_SMSG_EXIT_STATUS) {
-		send_packet(SSH_CMSG_EXIT_CONFIRMATION, PKT_END);
+	    } else if (pktin.type == SSH1_SMSG_EXIT_STATUS) {
+		send_packet(SSH1_CMSG_EXIT_CONFIRMATION, PKT_END);
 	    } else {
 		fatalbox("Strange packet received: type %d", pktin.type);
 	    }
 	} else {
-	    send_packet(SSH_CMSG_STDIN_DATA,
+	    send_packet(SSH1_CMSG_STDIN_DATA,
 	                PKT_INT, inlen, PKT_DATA, in, inlen, PKT_END);
 	}
     }
@@ -927,6 +1125,420 @@ static void ssh_protocol(unsigned char *in, int inlen, int ispkt) {
     crFinishV;
 }
 
+/*
+ * SSH2 packet construction functions.
+ */
+void ssh2_pkt_adddata(void *data, int len) {
+    pktout.length += len;
+    if (pktout.maxlen < pktout.length) {
+        pktout.maxlen = pktout.length + 256;
+	pktout.data = (pktout.data == NULL ? malloc(pktout.maxlen+APIEXTRA) :
+                       realloc(pktout.data, pktout.maxlen+APIEXTRA));
+        if (!pktout.data)
+            fatalbox("Out of memory");
+    }
+    memcpy(pktout.data+pktout.length-len, data, len);
+}
+void ssh2_pkt_addbyte(unsigned char byte) {
+    ssh2_pkt_adddata(&byte, 1);
+}
+void ssh2_pkt_init(int pkt_type) {
+    pktout.length = 5;
+    ssh2_pkt_addbyte((unsigned char)pkt_type);
+}
+void ssh2_pkt_addbool(unsigned char value) {
+    ssh2_pkt_adddata(&value, 1);
+}
+void ssh2_pkt_adduint32(unsigned long value) {
+    unsigned char x[4];
+    PUT_32BIT(x, value);
+    ssh2_pkt_adddata(x, 4);
+}
+void ssh2_pkt_addstring_start(void) {
+    ssh2_pkt_adduint32(0);
+    pktout.savedpos = pktout.length;
+}
+void ssh2_pkt_addstring_str(char *data) {
+    ssh2_pkt_adddata(data, strlen(data));
+    PUT_32BIT(pktout.data + pktout.savedpos - 4,
+              pktout.length - pktout.savedpos);
+}
+void ssh2_pkt_addstring_data(char *data, int len) {
+    ssh2_pkt_adddata(data, len);
+    PUT_32BIT(pktout.data + pktout.savedpos - 4,
+              pktout.length - pktout.savedpos);
+}
+void ssh2_pkt_addstring(char *data) {
+    ssh2_pkt_addstring_start();
+    ssh2_pkt_addstring_str(data);
+}
+char *ssh2_mpint_fmt(Bignum b, int *len) {
+    unsigned char *p;
+    int i, n = b[0];
+    p = malloc(n * 2 + 1);
+    if (!p)
+        fatalbox("out of memory");
+    p[0] = 0;
+    for (i = 0; i < n; i++) {
+        p[i*2+1] = (b[n-i] >> 8) & 0xFF;
+        p[i*2+2] = (b[n-i]     ) & 0xFF;
+    }
+    i = 0;
+    while (p[i] == 0 && (p[i+1] & 0x80) == 0)
+        i++;
+    memmove(p, p+i, n*2+1-i);
+    *len = n*2+1-i;
+    return p;
+}
+void ssh2_pkt_addmp(Bignum b) {
+    unsigned char *p;
+    int len;
+    p = ssh2_mpint_fmt(b, &len);
+    ssh2_pkt_addstring_start();
+    ssh2_pkt_addstring_data(p, len);
+    free(p);
+}
+void ssh2_pkt_send(void) {
+    int cipherblk, maclen, padding, i;
+    unsigned long outgoing_sequence = 0;
+
+    /*
+     * Add padding. At least four bytes, and must also bring total
+     * length (minus MAC) up to a multiple of the block size.
+     */
+    cipherblk = cipher ? cipher->blksize : 8;   /* block size */
+    cipherblk = cipherblk < 8 ? 8 : cipherblk;   /* or 8 if blksize < 8 */
+    padding = 4;
+    padding += (cipherblk - (pktout.length + padding) % cipherblk) % cipherblk;
+    pktout.data[4] = padding;
+    for (i = 0; i < padding; i++)
+        pktout.data[pktout.length + i] = random_byte();
+    PUT_32BIT(pktout.data, pktout.length + padding - 4);
+    if (csmac)
+        csmac->generate(pktout.data, outgoing_sequence++,
+                      pktout.length + padding);
+    if (cscipher)
+        cscipher->encrypt(pktout.data, pktout.length + padding);
+    maclen = csmac ? csmac->len : 0;
+#if 0
+    debug(("Sending packet len=%d\r\n", pktout.length+padding+maclen));
+    for (i = 0; i < pktout.length+padding+maclen; i++)
+        debug(("  %02x", (unsigned char)pktout.data[i]));
+    debug(("\r\n"));
+#endif
+    s_write(pktout.data, pktout.length + padding + maclen);
+}
+
+void sha_mpint(SHA_State *s, Bignum b) {
+    unsigned char *p;
+    int len;
+    p = ssh2_mpint_fmt(b, &len);
+    sha_string(s, p, len);
+    free(p);
+}
+
+/*
+ * SSH2 packet decode functions.
+ */
+void ssh2_pkt_getstring(char **p, int *length) {
+    *p = NULL;
+    if (pktin.length - pktin.savedpos < 4)
+        return;
+    *length = GET_32BIT(pktin.data+pktin.savedpos);
+    pktin.savedpos += 4;
+    if (pktin.length - pktin.savedpos < *length)
+        return;
+    *p = pktin.data+pktin.savedpos;
+    pktin.savedpos += *length;
+}
+Bignum ssh2_pkt_getmp(void) {
+    char *p;
+    int i, j, length;
+    Bignum b;
+
+    ssh2_pkt_getstring(&p, &length);
+    if (!p)
+        return NULL;
+    if (p[0] & 0x80)
+        fatalbox("internal error: Can't handle negative mpints");
+    b = newbn((length+1)/2);
+    for (i = 0; i < length; i++) {
+        j = length - 1 - i;
+        if (j & 1)
+            b[j/2+1] |= ((unsigned char)p[i]) << 8;
+        else
+            b[j/2+1] |= ((unsigned char)p[i]);
+    }
+    return b;
+}
+
+void bndebug(char *string, Bignum b) {
+    unsigned char *p;
+    int i, len;
+    p = ssh2_mpint_fmt(b, &len);
+    debug(("%s", string));
+    for (i = 0; i < len; i++)
+        debug(("  %02x", p[i]));
+    debug(("\r\n"));
+    free(p);
+}
+
+/*
+ * Utility routine for decoding comma-separated strings in KEXINIT.
+ */
+int in_commasep_string(char *needle, char *haystack, int haylen) {
+    int needlen = strlen(needle);
+    while (1) {
+        /*
+         * Is it at the start of the string?
+         */
+        if (haylen >= needlen &&       /* haystack is long enough */
+            !memcmp(needle, haystack, needlen) &&    /* initial match */
+            (haylen == needlen || haystack[needlen] == ',')
+                                       /* either , or EOS follows */
+            )
+            return 1;
+        /*
+         * If not, search for the next comma and resume after that.
+         * If no comma found, terminate.
+         */
+        while (haylen > 0 && *haystack != ',')
+            haylen--, haystack++;
+        if (haylen == 0)
+            return 0;
+        haylen--, haystack++;          /* skip over comma itself */
+    }
+}
+
+/*
+ * Handle the SSH2 key exchange phase.
+ */
+static int do_ssh2_kex(unsigned char *in, int inlen, int ispkt)
+{
+    static int i, len;
+    static char *str;
+    static Bignum e, f, K;
+    static struct ssh_cipher *cscipher_tobe = NULL;
+    static struct ssh_cipher *sccipher_tobe = NULL;
+    static struct ssh_mac *csmac_tobe = NULL;
+    static struct ssh_mac *scmac_tobe = NULL;
+    static struct ssh_compress *cscomp_tobe = NULL;
+    static struct ssh_compress *sccomp_tobe = NULL;
+    static char *hostkeydata, *sigdata;
+    static int hostkeylen, siglen;
+    static unsigned char exchange_hash[20];
+
+    crBegin;
+
+    /*
+     * Construct and send our key exchange packet.
+     */
+    ssh2_pkt_init(SSH2_MSG_KEXINIT);
+    for (i = 0; i < 16; i++)
+        ssh2_pkt_addbyte((unsigned char)random_byte());
+    /* List key exchange algorithms. */
+    ssh2_pkt_addstring_start();
+    for (i = 0; i < lenof(kex_algs); i++) {
+        ssh2_pkt_addstring_str(kex_algs[i]->name);
+        if (i < lenof(kex_algs)-1)
+            ssh2_pkt_addstring_str(",");
+    }
+    /* List server host key algorithms. */
+    ssh2_pkt_addstring_start();
+    for (i = 0; i < lenof(hostkey_algs); i++) {
+        ssh2_pkt_addstring_str(hostkey_algs[i]->name);
+        if (i < lenof(hostkey_algs)-1)
+            ssh2_pkt_addstring_str(",");
+    }
+    /* List client->server encryption algorithms. */
+    ssh2_pkt_addstring_start();
+    for (i = 0; i < lenof(ciphers); i++) {
+        ssh2_pkt_addstring_str(ciphers[i]->name);
+        if (i < lenof(ciphers)-1)
+            ssh2_pkt_addstring_str(",");
+    }
+    /* List server->client encryption algorithms. */
+    ssh2_pkt_addstring_start();
+    for (i = 0; i < lenof(ciphers); i++) {
+        ssh2_pkt_addstring_str(ciphers[i]->name);
+        if (i < lenof(ciphers)-1)
+            ssh2_pkt_addstring_str(",");
+    }
+    /* List client->server MAC algorithms. */
+    ssh2_pkt_addstring_start();
+    for (i = 0; i < lenof(macs); i++) {
+        ssh2_pkt_addstring_str(macs[i]->name);
+        if (i < lenof(macs)-1)
+            ssh2_pkt_addstring_str(",");
+    }
+    /* List server->client MAC algorithms. */
+    ssh2_pkt_addstring_start();
+    for (i = 0; i < lenof(macs); i++) {
+        ssh2_pkt_addstring_str(macs[i]->name);
+        if (i < lenof(macs)-1)
+            ssh2_pkt_addstring_str(",");
+    }
+    /* List client->server compression algorithms. */
+    ssh2_pkt_addstring_start();
+    for (i = 0; i < lenof(compressions); i++) {
+        ssh2_pkt_addstring_str(compressions[i]->name);
+        if (i < lenof(compressions)-1)
+            ssh2_pkt_addstring_str(",");
+    }
+    /* List server->client compression algorithms. */
+    ssh2_pkt_addstring_start();
+    for (i = 0; i < lenof(compressions); i++) {
+        ssh2_pkt_addstring_str(compressions[i]->name);
+        if (i < lenof(compressions)-1)
+            ssh2_pkt_addstring_str(",");
+    }
+    /* List client->server languages. Empty list. */
+    ssh2_pkt_addstring_start();
+    /* List server->client languages. Empty list. */
+    ssh2_pkt_addstring_start();
+    /* First KEX packet does _not_ follow, because we're not that brave. */
+    ssh2_pkt_addbool(FALSE);
+    /* Reserved. */
+    ssh2_pkt_adduint32(0);
+    sha_string(&exhash, pktout.data+5, pktout.length-5);
+    ssh2_pkt_send();
+
+    if (!ispkt) crWaitUntil(ispkt);
+    sha_string(&exhash, pktin.data+5, pktin.length-5);
+
+    /*
+     * Now examine the other side's KEXINIT to see what we're up
+     * to.
+     */
+    if (pktin.type != SSH2_MSG_KEXINIT)
+        fatalbox("expected key exchange packet from server");
+    kex = NULL; hostkey = NULL; cscipher_tobe = NULL; sccipher_tobe = NULL;
+    csmac_tobe = NULL; scmac_tobe = NULL; cscomp_tobe = NULL; sccomp_tobe = NULL;
+    pktin.savedpos += 16;              /* skip garbage cookie */
+    ssh2_pkt_getstring(&str, &len);    /* key exchange algorithms */
+    for (i = 0; i < lenof(kex_algs); i++) {
+        if (in_commasep_string(kex_algs[i]->name, str, len)) {
+            kex = kex_algs[i];
+            break;
+        }
+    }
+    ssh2_pkt_getstring(&str, &len);    /* host key algorithms */
+    for (i = 0; i < lenof(hostkey_algs); i++) {
+        if (in_commasep_string(hostkey_algs[i]->name, str, len)) {
+            hostkey = hostkey_algs[i];
+            break;
+        }
+    }
+    ssh2_pkt_getstring(&str, &len);    /* client->server cipher */
+    for (i = 0; i < lenof(ciphers); i++) {
+        if (in_commasep_string(ciphers[i]->name, str, len)) {
+            cscipher_tobe = ciphers[i];
+            break;
+        }
+    }
+    ssh2_pkt_getstring(&str, &len);    /* server->client cipher */
+    for (i = 0; i < lenof(ciphers); i++) {
+        if (in_commasep_string(ciphers[i]->name, str, len)) {
+            sccipher_tobe = ciphers[i];
+            break;
+        }
+    }
+    ssh2_pkt_getstring(&str, &len);    /* client->server mac */
+    for (i = 0; i < lenof(macs); i++) {
+        if (in_commasep_string(macs[i]->name, str, len)) {
+            csmac_tobe = macs[i];
+            break;
+        }
+    }
+    ssh2_pkt_getstring(&str, &len);    /* server->client mac */
+    for (i = 0; i < lenof(macs); i++) {
+        if (in_commasep_string(macs[i]->name, str, len)) {
+            scmac_tobe = macs[i];
+            break;
+        }
+    }
+    ssh2_pkt_getstring(&str, &len);    /* client->server compression */
+    for (i = 0; i < lenof(compressions); i++) {
+        if (in_commasep_string(compressions[i]->name, str, len)) {
+            cscomp_tobe = compressions[i];
+            break;
+        }
+    }
+    ssh2_pkt_getstring(&str, &len);    /* server->client compression */
+    for (i = 0; i < lenof(compressions); i++) {
+        if (in_commasep_string(compressions[i]->name, str, len)) {
+            sccomp_tobe = compressions[i];
+            break;
+        }
+    }
+    debug(("key exchange is %s\r\n", kex ? kex->name : NULL));
+    debug(("host key alg is %s\r\n", hostkey ? hostkey->name : NULL));
+    debug(("cscipher alg is %s\r\n", cscipher_tobe ? cscipher_tobe->name : NULL));
+    debug(("sccipher alg is %s\r\n", sccipher_tobe ? sccipher_tobe->name : NULL));
+    debug(("csmac alg is %s\r\n", csmac_tobe ? csmac_tobe->name : NULL));
+    debug(("scmac alg is %s\r\n", scmac_tobe ? scmac_tobe->name : NULL));
+    debug(("cscomp alg is %s\r\n", cscomp_tobe ? cscomp_tobe->name : NULL));
+    debug(("sccomp alg is %s\r\n", sccomp_tobe ? sccomp_tobe->name : NULL));
+
+    /*
+     * Currently we only support Diffie-Hellman and DSS, so let's
+     * bomb out if those aren't selected.
+     */
+    if (kex != &ssh_diffiehellman || hostkey != &ssh_dss)
+        fatalbox("internal fault: chaos in SSH 2 transport layer");
+
+    /*
+     * Now we begin the fun. Generate and send e for Diffie-Hellman.
+     */
+    e = dh_create_e();
+    bndebug("e=", e);
+    ssh2_pkt_init(SSH2_MSG_KEXDH_INIT);
+    ssh2_pkt_addmp(e);
+    ssh2_pkt_send();
+
+    crWaitUntil(ispkt);
+    if (pktin.type != SSH2_MSG_KEXDH_REPLY)
+        fatalbox("expected key exchange packet from server");
+    ssh2_pkt_getstring(&hostkeydata, &hostkeylen);
+    f = ssh2_pkt_getmp();
+    bndebug("f=", f);
+    ssh2_pkt_getstring(&sigdata, &siglen);
+
+    K = dh_find_K(f);
+    bndebug("K=", K);
+
+    sha_string(&exhash, hostkeydata, hostkeylen);
+    sha_mpint(&exhash, e);
+    sha_mpint(&exhash, f);
+    sha_mpint(&exhash, K);
+    SHA_Final(&exhash, exchange_hash);
+
+    debug(("Exchange hash is:\r\n"));
+    for (i = 0; i < 20; i++)
+        debug((" %02x", exchange_hash[i]));
+    debug(("\r\n"));
+
+    /*
+     * FIXME: verify hostkeydata and sigdata.
+     */
+    
+    crWaitUntil(0);
+
+    crFinish(1);
+}
+
+static void ssh2_protocol(unsigned char *in, int inlen, int ispkt) {
+    crBegin;
+
+    random_init();
+
+    while (!do_ssh2_kex(in, inlen, ispkt)) {
+	crReturnV;
+    }
+
+    crFinishV;
+}
+
 /*
  * Called to set up the connection. Will arrange for WM_NETEVENT
  * messages to be passed to the specified window, whose window
@@ -1025,7 +1637,7 @@ static void ssh_size(void) {
 	break;
       case SSH_STATE_SESSION:
         if (!cfg.nopty) {
-	    send_packet(SSH_CMSG_WINDOW_SIZE,
+	    send_packet(SSH1_CMSG_WINDOW_SIZE,
 	                PKT_INT, rows, PKT_INT, cols,
 	                PKT_INT, 0, PKT_INT, 0, PKT_END);
         }
@@ -1102,7 +1714,7 @@ int ssh_scp_recv(unsigned char *buf, int len)
 	get_packet();
 	if (s == INVALID_SOCKET)
 	    return 0;
-	if (pktin.type == SSH_SMSG_STDOUT_DATA) {
+	if (pktin.type == SSH1_SMSG_STDOUT_DATA) {
 	    int plen = GET_32BIT(pktin.body);
 	    if (plen <= to_read) {
 		memcpy(buf, pktin.body + 4, plen);
@@ -1114,19 +1726,19 @@ int ssh_scp_recv(unsigned char *buf, int len)
 		pending_input_ptr = pktin.body + 4 + to_read;
 		to_read = 0;
 	    }
-	} else if (pktin.type == SSH_SMSG_STDERR_DATA) {
+	} else if (pktin.type == SSH1_SMSG_STDERR_DATA) {
 	    int plen = GET_32BIT(pktin.body);
 	    fwrite(pktin.body + 4, plen, 1, stderr);
-	} else if (pktin.type == SSH_MSG_DISCONNECT) {
+	} else if (pktin.type == SSH1_MSG_DISCONNECT) {
 		logevent("Received disconnect request");
-	} else if (pktin.type == SSH_SMSG_SUCCESS ||
-	           pktin.type == SSH_SMSG_FAILURE) {
+	} else if (pktin.type == SSH1_SMSG_SUCCESS ||
+	           pktin.type == SSH1_SMSG_FAILURE) {
 		/* ignore */
-	} else if (pktin.type == SSH_SMSG_EXIT_STATUS) {
+	} else if (pktin.type == SSH1_SMSG_EXIT_STATUS) {
 	    char logbuf[100];
 	    sprintf(logbuf, "Remote exit status: %d", GET_32BIT(pktin.body));
 	    logevent(logbuf);
-	    send_packet(SSH_CMSG_EXIT_CONFIRMATION, PKT_END);
+	    send_packet(SSH1_CMSG_EXIT_CONFIRMATION, PKT_END);
 	    logevent("Closing connection");
 	    closesocket(s);
 	    s = INVALID_SOCKET;
@@ -1148,7 +1760,7 @@ void ssh_scp_send(unsigned char *buf, int len)
     assert(IS_SCP);
     if (s == INVALID_SOCKET)
 	return;
-    send_packet(SSH_CMSG_STDIN_DATA,
+    send_packet(SSH1_CMSG_STDIN_DATA,
                 PKT_INT, len, PKT_DATA, buf, len, PKT_END);
 }
 
@@ -1161,7 +1773,7 @@ void ssh_scp_send_eof(void)
     assert(IS_SCP);
     if (s == INVALID_SOCKET)
 	return;
-    send_packet(SSH_CMSG_EOF, PKT_END);
+    send_packet(SSH1_CMSG_EOF, PKT_END);
 }
 
 /*
@@ -1195,7 +1807,7 @@ char *ssh_scp_init(char *host, int port, char *cmd, char **realhost)
 	get_packet();
 	if (s == INVALID_SOCKET)
 	    return "Connection closed by remote host";
-    } while (!do_ssh_login(NULL, 0, 1));
+    } while (!do_ssh1_login(NULL, 0, 1));
 
     if (ssh_state == SSH_STATE_CLOSED) {
         closesocket(s);
@@ -1206,7 +1818,7 @@ char *ssh_scp_init(char *host, int port, char *cmd, char **realhost)
     /* Execute command */
     sprintf(buf, "Sending command: %.100s", cmd);
     logevent(buf);
-    send_packet(SSH_CMSG_EXEC_CMD, PKT_STR, cmd, PKT_END);
+    send_packet(SSH1_CMSG_EXEC_CMD, PKT_STR, cmd, PKT_END);
 
     return NULL;
 }
diff --git a/ssh.h b/ssh.h
index a9057e72..e7be138c 100644
--- a/ssh.h
+++ b/ssh.h
@@ -1,10 +1,23 @@
 #include <string.h>
 
+/*
+ * Useful thing.
+ */
+#ifndef lenof
+#define lenof(x) ( (sizeof((x))) / (sizeof(*(x))))
+#endif
+
 #define SSH_CIPHER_IDEA		1
 #define SSH_CIPHER_DES		2
 #define SSH_CIPHER_3DES		3
 #define SSH_CIPHER_BLOWFISH	6
 
+#ifdef MSCRYPTOAPI
+#define APIEXTRA 8
+#else
+#define APIEXTRA 0
+#endif
+
 struct RSAKey {
     int bits;
     int bytes;
@@ -48,10 +61,43 @@ void MD5Update(struct MD5Context *context, unsigned char const *buf,
                unsigned len);
 void MD5Final(unsigned char digest[16], struct MD5Context *context);
 
+typedef struct {
+    uint32 h[5];
+    unsigned char block[64];
+    int blkused;
+    uint32 lenhi, lenlo;
+} SHA_State;
+
+void SHA_Init(SHA_State *s);
+void SHA_Bytes(SHA_State *s, void *p, int len);
+void SHA_Final(SHA_State *s, unsigned char *output);
+
 struct ssh_cipher {
     void (*sesskey)(unsigned char *key);
     void (*encrypt)(unsigned char *blk, int len);
     void (*decrypt)(unsigned char *blk, int len);
+    char *name;
+    int blksize;
+};
+
+struct ssh_mac {
+    void (*sesskey)(unsigned char *key, int len);
+    void (*generate)(unsigned char *blk, int len, unsigned long seq);
+    int (*verify)(unsigned char *blk, int len, unsigned long seq);
+    char *name;
+    int len;
+};
+
+struct ssh_kex {
+    char *name;
+};
+
+struct ssh_hostkey {
+    char *name;
+};
+
+struct ssh_compress {
+    char *name;
 };
 
 #ifndef MSCRYPTOAPI
@@ -62,3 +108,17 @@ int random_byte(void);
 void random_add_noise(void *noise, int length);
 
 void logevent (char *);
+
+/*
+ * A Bignum is stored as a sequence of `unsigned short' words. The
+ * first tells how many remain; the remaining ones are digits, LS
+ * first.
+ */
+typedef unsigned short *Bignum;
+
+Bignum newbn(int length);
+void freebn(Bignum b);
+void modpow(Bignum base, Bignum exp, Bignum mod, Bignum result);
+
+Bignum dh_create_e(void);
+Bignum dh_find_K(Bignum f);
diff --git a/sshblowf.c b/sshblowf.c
index 7b97496b..364067a1 100644
--- a/sshblowf.c
+++ b/sshblowf.c
@@ -414,5 +414,7 @@ static void blowfish_decrypt_blk(unsigned char *blk, int len)
 struct ssh_cipher ssh_blowfish = {
     blowfish_sesskey,
     blowfish_encrypt_blk,
-    blowfish_decrypt_blk
+    blowfish_decrypt_blk,
+    "blowfish-cbc",
+    8
 };
diff --git a/sshbn.c b/sshbn.c
new file mode 100644
index 00000000..a9eae859
--- /dev/null
+++ b/sshbn.c
@@ -0,0 +1,239 @@
+/*
+ * Bignum routines for RSA and DH and stuff.
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "ssh.h"
+
+static unsigned short Zero[1] = { 0 };
+
+#if defined TESTMODE || defined RSADEBUG
+#ifndef DLVL
+#define DLVL 10000
+#endif
+#define debug(x) bndebug(#x,x)
+static int level = 0;
+static void bndebug(char *name, Bignum b) {
+    int i;
+    int w = 50-level-strlen(name)-5*b[0];
+    if (level >= DLVL)
+	return;
+    if (w < 0) w = 0;
+    dprintf("%*s%s%*s", level, "", name, w, "");
+    for (i=b[0]; i>0; i--)
+	dprintf(" %04x", b[i]);
+    dprintf("\n");
+}
+#define dmsg(x) do {if(level<DLVL){dprintf("%*s",level,"");printf x;}} while(0)
+#define enter(x) do { dmsg(x); level += 4; } while(0)
+#define leave(x) do { level -= 4; dmsg(x); } while(0)
+#else
+#define debug(x)
+#define dmsg(x)
+#define enter(x)
+#define leave(x)
+#endif
+
+Bignum newbn(int length) {
+    Bignum b = malloc((length+1)*sizeof(unsigned short));
+    if (!b)
+	abort();		       /* FIXME */
+    memset(b, 0, (length+1)*sizeof(*b));
+    b[0] = length;
+    return b;
+}
+
+void freebn(Bignum b) {
+    /*
+     * Burn the evidence, just in case.
+     */
+    memset(b, 0, sizeof(b[0]) * (b[0] + 1));
+    free(b);
+}
+
+/*
+ * Compute c = a * b.
+ * Input is in the first len words of a and b.
+ * Result is returned in the first 2*len words of c.
+ */
+static void bigmul(unsigned short *a, unsigned short *b, unsigned short *c,
+                   int len)
+{
+    int i, j;
+    unsigned long ai, t;
+
+    for (j = len - 1; j >= 0; j--)
+	c[j+len] = 0;
+
+    for (i = len - 1; i >= 0; i--) {
+	ai = a[i];
+	t = 0;
+	for (j = len - 1; j >= 0; j--) {
+	    t += ai * (unsigned long) b[j];
+	    t += (unsigned long) c[i+j+1];
+	    c[i+j+1] = (unsigned short)t;
+	    t = t >> 16;
+	}
+	c[i] = (unsigned short)t;
+    }
+}
+
+/*
+ * Compute a = a % m.
+ * Input in first 2*len words of a and first len words of m.
+ * Output in first 2*len words of a (of which first len words will be zero).
+ * The MSW of m MUST have its high bit set.
+ */
+static void bigmod(unsigned short *a, unsigned short *m, int len)
+{
+    unsigned short m0, m1;
+    unsigned int h;
+    int i, k;
+
+    /* Special case for len == 1 */
+    if (len == 1) {
+	a[1] = (((long) a[0] << 16) + a[1]) % m[0];
+	a[0] = 0;
+	return;
+    }
+
+    m0 = m[0];
+    m1 = m[1];
+
+    for (i = 0; i <= len; i++) {
+	unsigned long t;
+	unsigned int q, r, c;
+
+	if (i == 0) {
+	    h = 0;
+	} else {
+	    h = a[i-1];
+	    a[i-1] = 0;
+	}
+
+	/* Find q = h:a[i] / m0 */
+	t = ((unsigned long) h << 16) + a[i];
+	q = t / m0;
+	r = t % m0;
+
+	/* Refine our estimate of q by looking at
+	 h:a[i]:a[i+1] / m0:m1 */
+	t = (long) m1 * (long) q;
+	if (t > ((unsigned long) r << 16) + a[i+1]) {
+	    q--;
+	    t -= m1;
+	    r = (r + m0) & 0xffff; /* overflow? */
+	    if (r >= (unsigned long)m0 &&
+                t > ((unsigned long) r << 16) + a[i+1])
+		q--;
+	}
+
+	/* Substract q * m from a[i...] */
+	c = 0;
+	for (k = len - 1; k >= 0; k--) {
+	    t = (long) q * (long) m[k];
+	    t += c;
+	    c = t >> 16;
+	    if ((unsigned short) t > a[i+k]) c++;
+	    a[i+k] -= (unsigned short) t;
+	}
+
+	/* Add back m in case of borrow */
+	if (c != h) {
+	    t = 0;
+	    for (k = len - 1; k >= 0; k--) {
+		t += m[k];
+		t += a[i+k];
+		a[i+k] = (unsigned short)t;
+		t = t >> 16;
+	    }
+	}
+    }
+}
+
+/*
+ * Compute (base ^ exp) % mod.
+ * The base MUST be smaller than the modulus.
+ * The most significant word of mod MUST be non-zero.
+ * We assume that the result array is the same size as the mod array.
+ */
+void modpow(Bignum base, Bignum exp, Bignum mod, Bignum result)
+{
+    unsigned short *a, *b, *n, *m;
+    int mshift;
+    int mlen, i, j;
+
+    /* Allocate m of size mlen, copy mod to m */
+    /* We use big endian internally */
+    mlen = mod[0];
+    m = malloc(mlen * sizeof(unsigned short));
+    for (j = 0; j < mlen; j++) m[j] = mod[mod[0] - j];
+
+    /* Shift m left to make msb bit set */
+    for (mshift = 0; mshift < 15; mshift++)
+	if ((m[0] << mshift) & 0x8000) break;
+    if (mshift) {
+	for (i = 0; i < mlen - 1; i++)
+	    m[i] = (m[i] << mshift) | (m[i+1] >> (16-mshift));
+	m[mlen-1] = m[mlen-1] << mshift;
+    }
+
+    /* Allocate n of size mlen, copy base to n */
+    n = malloc(mlen * sizeof(unsigned short));
+    i = mlen - base[0];
+    for (j = 0; j < i; j++) n[j] = 0;
+    for (j = 0; j < base[0]; j++) n[i+j] = base[base[0] - j];
+
+    /* Allocate a and b of size 2*mlen. Set a = 1 */
+    a = malloc(2 * mlen * sizeof(unsigned short));
+    b = malloc(2 * mlen * sizeof(unsigned short));
+    for (i = 0; i < 2*mlen; i++) a[i] = 0;
+    a[2*mlen-1] = 1;
+
+    /* Skip leading zero bits of exp. */
+    i = 0; j = 15;
+    while (i < exp[0] && (exp[exp[0] - i] & (1 << j)) == 0) {
+	j--;
+	if (j < 0) { i++; j = 15; }
+    }
+
+    /* Main computation */
+    while (i < exp[0]) {
+	while (j >= 0) {
+	    bigmul(a + mlen, a + mlen, b, mlen);
+	    bigmod(b, m, mlen);
+	    if ((exp[exp[0] - i] & (1 << j)) != 0) {
+		bigmul(b + mlen, n, a, mlen);
+		bigmod(a, m, mlen);
+	    } else {
+		unsigned short *t;
+		t = a;  a = b;  b = t;
+	    }
+	    j--;
+	}
+	i++; j = 15;
+    }
+
+    /* Fixup result in case the modulus was shifted */
+    if (mshift) {
+	for (i = mlen - 1; i < 2*mlen - 1; i++)
+	    a[i] = (a[i] << mshift) | (a[i+1] >> (16-mshift));
+	a[2*mlen-1] = a[2*mlen-1] << mshift;
+	bigmod(a, m, mlen);
+	for (i = 2*mlen - 1; i >= mlen; i--)
+	    a[i] = (a[i] >> mshift) | (a[i-1] << (16-mshift));
+    }
+
+    /* Copy result to buffer */
+    for (i = 0; i < mlen; i++)
+	result[result[0] - i] = a[i+mlen];
+
+    /* Free temporary arrays */
+    for (i = 0; i < 2*mlen; i++) a[i] = 0; free(a);
+    for (i = 0; i < 2*mlen; i++) b[i] = 0; free(b);
+    for (i = 0; i < mlen; i++) m[i] = 0; free(m);
+    for (i = 0; i < mlen; i++) n[i] = 0; free(n);
+}
diff --git a/sshdes.c b/sshdes.c
index 1b684796..0e90e644 100644
--- a/sshdes.c
+++ b/sshdes.c
@@ -685,7 +685,9 @@ static void des3_decrypt_blk(unsigned char *blk, int len) {
 struct ssh_cipher ssh_3des = {
     des3_sesskey,
     des3_encrypt_blk,
-    des3_decrypt_blk
+    des3_decrypt_blk,
+    "3des-cbc",
+    8
 };
 
 static void des_sesskey(unsigned char *key) {
@@ -705,5 +707,7 @@ static void des_decrypt_blk(unsigned char *blk, int len) {
 struct ssh_cipher ssh_des = {
     des_sesskey,
     des_encrypt_blk,
-    des_decrypt_blk
+    des_decrypt_blk,
+    "des-cbc", /* should never be used - not a valid cipher in ssh2 */
+    8
 };
diff --git a/sshdh.c b/sshdh.c
new file mode 100644
index 00000000..d556a252
--- /dev/null
+++ b/sshdh.c
@@ -0,0 +1,115 @@
+#include "ssh.h"
+
+struct ssh_kex ssh_diffiehellman = {
+    "diffie-hellman-group1-sha1"
+};
+
+/*
+ * The prime p used in the key exchange. 
+ */
+static unsigned short P[] = {
+    64,
+    0xFFFF, 0xFFFF, 0xFFFF, 0xFFFF, 0x5381, 0xECE6, 0x6651, 0x4928,
+    0x1FE6, 0x7C4B, 0x2411, 0xAE9F, 0x9FA5, 0x5A89, 0x6BFB, 0xEE38,
+    0xB7ED, 0xF406, 0x5CB6, 0x0BFF, 0xED6B, 0xA637, 0x42E9, 0xF44C,
+    0x7EC6, 0x625E, 0xB576, 0xE485, 0xC245, 0x6D51, 0x356D, 0x4FE1,
+    0x1437, 0xF25F, 0x0A6D, 0x302B, 0x431B, 0xCD3A, 0x19B3, 0xEF95,
+    0x04DD, 0x8E34, 0x0879, 0x514A, 0x9B22, 0x3B13, 0xBEA6, 0x020B,
+    0xCC74, 0x8A67, 0x4E08, 0x2902, 0x1CD1, 0x80DC, 0x628B, 0xC4C6,
+    0xC234, 0x2168, 0xDAA2, 0xC90F, 0xFFFF, 0xFFFF, 0xFFFF, 0xFFFF,
+};
+
+/*
+ * The order q of the group: (p-1)/2.
+ */
+static unsigned short Q[] = {
+    64,
+    0xFFFF, 0xFFFF, 0xFFFF, 0xFFFF, 0x29C0, 0xF673, 0x3328, 0x2494,
+    0x8FF3, 0xBE25, 0x9208, 0xD74F, 0xCFD2, 0xAD44, 0x35FD, 0xF71C,
+    0x5BF6, 0x7A03, 0xAE5B, 0x85FF, 0xF6B5, 0xD31B, 0x2174, 0x7A26,
+    0x3F63, 0x312F, 0xDABB, 0xF242, 0xE122, 0xB6A8, 0x9AB6, 0xA7F0,
+    0x8A1B, 0xF92F, 0x8536, 0x9815, 0x218D, 0xE69D, 0x8CD9, 0xF7CA,
+    0x026E, 0xC71A, 0x043C, 0x28A5, 0xCD91, 0x1D89, 0xDF53, 0x0105,
+    0xE63A, 0x4533, 0x2704, 0x9481, 0x0E68, 0xC06E, 0x3145, 0x6263,
+    0x611A, 0x10B4, 0xED51, 0xE487, 0xFFFF, 0xFFFF, 0xFFFF, 0x7FFF,
+};
+
+/*
+ * The bitmask covering q (for ease of generation of x).
+ */
+static unsigned short Qmask[] = {
+    64,
+    0xFFFF, 0xFFFF, 0xFFFF, 0xFFFF, 0xFFFF, 0xFFFF, 0xFFFF, 0xFFFF,
+    0xFFFF, 0xFFFF, 0xFFFF, 0xFFFF, 0xFFFF, 0xFFFF, 0xFFFF, 0xFFFF,
+    0xFFFF, 0xFFFF, 0xFFFF, 0xFFFF, 0xFFFF, 0xFFFF, 0xFFFF, 0xFFFF,
+    0xFFFF, 0xFFFF, 0xFFFF, 0xFFFF, 0xFFFF, 0xFFFF, 0xFFFF, 0xFFFF,
+    0xFFFF, 0xFFFF, 0xFFFF, 0xFFFF, 0xFFFF, 0xFFFF, 0xFFFF, 0xFFFF,
+    0xFFFF, 0xFFFF, 0xFFFF, 0xFFFF, 0xFFFF, 0xFFFF, 0xFFFF, 0xFFFF,
+    0xFFFF, 0xFFFF, 0xFFFF, 0xFFFF, 0xFFFF, 0xFFFF, 0xFFFF, 0xFFFF,
+    0xFFFF, 0xFFFF, 0xFFFF, 0xFFFF, 0xFFFF, 0xFFFF, 0xFFFF, 0x7FFF,
+};
+
+/*
+ * The generator g = 2.
+ */
+static unsigned short G[] = { 1, 2 };
+
+/*
+ * Variables.
+ */
+static Bignum x, e;
+
+/*
+ * DH stage 1: invent a number x between 1 and q, and compute e =
+ * g^x mod p. Return e.
+ */
+Bignum dh_create_e(void) {
+    int i;
+
+    x = newbn(Q[0]);
+
+    tryagain:
+
+    /*
+     * Create a potential x, by ANDing a string of random bytes
+     * with Qmask.
+     */
+    for (i = 1; i <= x[0]; i++)
+        x[i] = ((random_byte() << 8) + random_byte()) & Qmask[i];
+
+    /*
+     * If x <= 1, go round again.
+     */
+    for (i = 2; i <= x[0]; i++)
+        if (x[i] != 0)
+            break;
+    if (i > x[0] && x[1] <= 1)
+        goto tryagain;
+
+    /*
+     * If x >= q, go round again.
+     */
+    for (i = x[0]; i > 0; i--) {
+        if (x[i] > Q[i])
+            goto tryagain;
+        if (x[i] < Q[i])
+            break;
+    }
+
+    /*
+     * Done. Now compute e = g^x mod p.
+     */
+    e = newbn(P[0]);
+    modpow(G, x, P, e);
+
+    return e;
+}
+
+/*
+ * DH stage 2: given a number f, compute K = f^x mod p.
+ */
+Bignum dh_find_K(Bignum f) {
+    Bignum K = newbn(P[0]);
+    modpow(f, x, P, K);
+    return K;
+}
diff --git a/sshdss.c b/sshdss.c
new file mode 100644
index 00000000..c651140e
--- /dev/null
+++ b/sshdss.c
@@ -0,0 +1,5 @@
+#include "ssh.h"
+
+struct ssh_hostkey ssh_dss = {
+    "ssh-dss"
+};
diff --git a/sshrsa.c b/sshrsa.c
index d13f6cfe..bf54e409 100644
--- a/sshrsa.c
+++ b/sshrsa.c
@@ -9,12 +9,6 @@
 #include <stdlib.h>
 #include <string.h>
 
-#include "ssh.h"
-
-typedef unsigned short *Bignum;
-
-static unsigned short Zero[1] = { 0 };
-
 #if defined TESTMODE || defined RSADEBUG
 #ifndef DLVL
 #define DLVL 10000
@@ -42,201 +36,7 @@ static void bndebug(char *name, Bignum b) {
 #define leave(x)
 #endif
 
-static Bignum newbn(int length) {
-    Bignum b = malloc((length+1)*sizeof(unsigned short));
-    if (!b)
-	abort();		       /* FIXME */
-    b[0] = length;
-    return b;
-}
-
-static void freebn(Bignum b) {
-    free(b);
-}
-
-/*
- * Compute c = a * b.
- * Input is in the first len words of a and b.
- * Result is returned in the first 2*len words of c.
- */
-static void bigmul(unsigned short *a, unsigned short *b, unsigned short *c,
-                   int len)
-{
-    int i, j;
-    unsigned long ai, t;
-
-    for (j = len - 1; j >= 0; j--)
-	c[j+len] = 0;
-
-    for (i = len - 1; i >= 0; i--) {
-	ai = a[i];
-	t = 0;
-	for (j = len - 1; j >= 0; j--) {
-	    t += ai * (unsigned long) b[j];
-	    t += (unsigned long) c[i+j+1];
-	    c[i+j+1] = (unsigned short)t;
-	    t = t >> 16;
-	}
-	c[i] = (unsigned short)t;
-    }
-}
-
-/*
- * Compute a = a % m.
- * Input in first 2*len words of a and first len words of m.
- * Output in first 2*len words of a (of which first len words will be zero).
- * The MSW of m MUST have its high bit set.
- */
-static void bigmod(unsigned short *a, unsigned short *m, int len)
-{
-    unsigned short m0, m1;
-    unsigned int h;
-    int i, k;
-
-    /* Special case for len == 1 */
-    if (len == 1) {
-	a[1] = (((long) a[0] << 16) + a[1]) % m[0];
-	a[0] = 0;
-	return;
-    }
-
-    m0 = m[0];
-    m1 = m[1];
-
-    for (i = 0; i <= len; i++) {
-	unsigned long t;
-	unsigned int q, r, c;
-
-	if (i == 0) {
-	    h = 0;
-	} else {
-	    h = a[i-1];
-	    a[i-1] = 0;
-	}
-
-	/* Find q = h:a[i] / m0 */
-	t = ((unsigned long) h << 16) + a[i];
-	q = t / m0;
-	r = t % m0;
-
-	/* Refine our estimate of q by looking at
-	 h:a[i]:a[i+1] / m0:m1 */
-	t = (long) m1 * (long) q;
-	if (t > ((unsigned long) r << 16) + a[i+1]) {
-	    q--;
-	    t -= m1;
-	    r = (r + m0) & 0xffff; /* overflow? */
-	    if (r >= (unsigned long)m0 &&
-                t > ((unsigned long) r << 16) + a[i+1])
-		q--;
-	}
-
-	/* Substract q * m from a[i...] */
-	c = 0;
-	for (k = len - 1; k >= 0; k--) {
-	    t = (long) q * (long) m[k];
-	    t += c;
-	    c = t >> 16;
-	    if ((unsigned short) t > a[i+k]) c++;
-	    a[i+k] -= (unsigned short) t;
-	}
-
-	/* Add back m in case of borrow */
-	if (c != h) {
-	    t = 0;
-	    for (k = len - 1; k >= 0; k--) {
-		t += m[k];
-		t += a[i+k];
-		a[i+k] = (unsigned short)t;
-		t = t >> 16;
-	    }
-	}
-    }
-}
-
-/*
- * Compute (base ^ exp) % mod.
- * The base MUST be smaller than the modulus.
- * The most significant word of mod MUST be non-zero.
- * We assume that the result array is the same size as the mod array.
- */
-static void modpow(Bignum base, Bignum exp, Bignum mod, Bignum result)
-{
-    unsigned short *a, *b, *n, *m;
-    int mshift;
-    int mlen, i, j;
-
-    /* Allocate m of size mlen, copy mod to m */
-    /* We use big endian internally */
-    mlen = mod[0];
-    m = malloc(mlen * sizeof(unsigned short));
-    for (j = 0; j < mlen; j++) m[j] = mod[mod[0] - j];
-
-    /* Shift m left to make msb bit set */
-    for (mshift = 0; mshift < 15; mshift++)
-	if ((m[0] << mshift) & 0x8000) break;
-    if (mshift) {
-	for (i = 0; i < mlen - 1; i++)
-	    m[i] = (m[i] << mshift) | (m[i+1] >> (16-mshift));
-	m[mlen-1] = m[mlen-1] << mshift;
-    }
-
-    /* Allocate n of size mlen, copy base to n */
-    n = malloc(mlen * sizeof(unsigned short));
-    i = mlen - base[0];
-    for (j = 0; j < i; j++) n[j] = 0;
-    for (j = 0; j < base[0]; j++) n[i+j] = base[base[0] - j];
-
-    /* Allocate a and b of size 2*mlen. Set a = 1 */
-    a = malloc(2 * mlen * sizeof(unsigned short));
-    b = malloc(2 * mlen * sizeof(unsigned short));
-    for (i = 0; i < 2*mlen; i++) a[i] = 0;
-    a[2*mlen-1] = 1;
-
-    /* Skip leading zero bits of exp. */
-    i = 0; j = 15;
-    while (i < exp[0] && (exp[exp[0] - i] & (1 << j)) == 0) {
-	j--;
-	if (j < 0) { i++; j = 15; }
-    }
-
-    /* Main computation */
-    while (i < exp[0]) {
-	while (j >= 0) {
-	    bigmul(a + mlen, a + mlen, b, mlen);
-	    bigmod(b, m, mlen);
-	    if ((exp[exp[0] - i] & (1 << j)) != 0) {
-		bigmul(b + mlen, n, a, mlen);
-		bigmod(a, m, mlen);
-	    } else {
-		unsigned short *t;
-		t = a;  a = b;  b = t;
-	    }
-	    j--;
-	}
-	i++; j = 15;
-    }
-
-    /* Fixup result in case the modulus was shifted */
-    if (mshift) {
-	for (i = mlen - 1; i < 2*mlen - 1; i++)
-	    a[i] = (a[i] << mshift) | (a[i+1] >> (16-mshift));
-	a[2*mlen-1] = a[2*mlen-1] << mshift;
-	bigmod(a, m, mlen);
-	for (i = 2*mlen - 1; i >= mlen; i--)
-	    a[i] = (a[i] >> mshift) | (a[i-1] << (16-mshift));
-    }
-
-    /* Copy result to buffer */
-    for (i = 0; i < mlen; i++)
-	result[result[0] - i] = a[i+mlen];
-
-    /* Free temporary arrays */
-    for (i = 0; i < 2*mlen; i++) a[i] = 0; free(a);
-    for (i = 0; i < 2*mlen; i++) b[i] = 0; free(b);
-    for (i = 0; i < mlen; i++) m[i] = 0; free(m);
-    for (i = 0; i < mlen; i++) n[i] = 0; free(n);
-}
+#include "ssh.h"
 
 int makekey(unsigned char *data, struct RSAKey *result,
 	    unsigned char **keystr) {
diff --git a/sshsha.c b/sshsha.c
index d766743f..487d1733 100644
--- a/sshsha.c
+++ b/sshsha.c
@@ -1,12 +1,27 @@
 /*
- * SHA core transform algorithm, used here solely as a `stirring'
- * function for the PuTTY random number pool. Implemented directly
- * from the specification by Simon Tatham.
+ * SHA1 hash algorithm. Used in SSH2 as a MAC, and the transform is
+ * also used as a `stirring' function for the PuTTY random number
+ * pool. Implemented directly from the specification by Simon
+ * Tatham.
  */
 
 #include "ssh.h"
 
-#define rol(x,y) ( ((x) << (y)) | (((word32)x) >> (32-y)) )
+typedef unsigned int uint32;
+
+/* ----------------------------------------------------------------------
+ * Core SHA algorithm: processes 16-word blocks into a message digest.
+ */
+
+#define rol(x,y) ( ((x) << (y)) | (((uint32)x) >> (32-y)) )
+
+void SHA_Core_Init(uint32 h[5]) {
+    h[0] = 0x67452301;
+    h[1] = 0xefcdab89;
+    h[2] = 0x98badcfe;
+    h[3] = 0x10325476;
+    h[4] = 0xc3d2e1f0;
+}
 
 void SHATransform(word32 *digest, word32 *block) {
     word32 w[80];
@@ -50,3 +65,165 @@ void SHATransform(word32 *digest, word32 *block) {
     digest[3] += d;
     digest[4] += e;
 }
+
+/* ----------------------------------------------------------------------
+ * Outer SHA algorithm: take an arbitrary length byte string,
+ * convert it into 16-word blocks with the prescribed padding at
+ * the end, and pass those blocks to the core SHA algorithm.
+ */
+
+void SHA_Init(SHA_State *s) {
+    SHA_Core_Init(s->h);
+    s->blkused = 0;
+    s->lenhi = s->lenlo = 0;
+}
+
+void SHA_Bytes(SHA_State *s, void *p, int len) {
+    unsigned char *q = (unsigned char *)p;
+    uint32 wordblock[16];
+    uint32 lenw = len;
+    int i;
+
+    /*
+     * Update the length field.
+     */
+    s->lenlo += lenw;
+    s->lenhi += (s->lenlo < lenw);
+
+    if (s->blkused && s->blkused+len < 64) {
+        /*
+         * Trivial case: just add to the block.
+         */
+        memcpy(s->block + s->blkused, q, len);
+        s->blkused += len;
+    } else {
+        /*
+         * We must complete and process at least one block.
+         */
+        while (s->blkused + len >= 64) {
+            memcpy(s->block + s->blkused, q, 64 - s->blkused);
+            q += 64 - s->blkused;
+            len -= 64 - s->blkused;
+            /* Now process the block. Gather bytes big-endian into words */
+            for (i = 0; i < 16; i++) {
+                wordblock[i] =
+                    ( ((uint32)s->block[i*4+0]) << 24 ) |
+                    ( ((uint32)s->block[i*4+1]) << 16 ) |
+                    ( ((uint32)s->block[i*4+2]) <<  8 ) |
+                    ( ((uint32)s->block[i*4+3]) <<  0 );
+            }
+            SHATransform(s->h, wordblock);
+            s->blkused = 0;
+        }
+        memcpy(s->block, q, len);
+        s->blkused = len;
+    }
+}
+
+void SHA_Final(SHA_State *s, unsigned char *output) {
+    int i;
+    int pad;
+    unsigned char c[64];
+    uint32 lenhi, lenlo;
+
+    if (s->blkused >= 56)
+        pad = 56 + 64 - s->blkused;
+    else
+        pad = 56 - s->blkused;
+
+    lenhi = (s->lenhi << 3) | (s->lenlo >> (32-3));
+    lenlo = (s->lenlo << 3);
+
+    memset(c, 0, pad);
+    c[0] = 0x80;
+    SHA_Bytes(s, &c, pad);
+
+    c[0] = (lenhi >> 24) & 0xFF;
+    c[1] = (lenhi >> 16) & 0xFF;
+    c[2] = (lenhi >>  8) & 0xFF;
+    c[3] = (lenhi >>  0) & 0xFF;
+    c[4] = (lenlo >> 24) & 0xFF;
+    c[5] = (lenlo >> 16) & 0xFF;
+    c[6] = (lenlo >>  8) & 0xFF;
+    c[7] = (lenlo >>  0) & 0xFF;
+
+    SHA_Bytes(s, &c, 8);
+
+    for (i = 0; i < 5; i++) {
+        output[i*4  ] = (s->h[i] >> 24) & 0xFF;
+        output[i*4+1] = (s->h[i] >> 16) & 0xFF;
+        output[i*4+2] = (s->h[i] >>  8) & 0xFF;
+        output[i*4+3] = (s->h[i]      ) & 0xFF;
+    }
+}
+
+void SHA_Simple(void *p, int len, unsigned char *output) {
+    SHA_State s;
+
+    SHA_Init(&s);
+    SHA_Bytes(&s, p, len);
+    SHA_Final(&s, output);
+}
+
+/* ----------------------------------------------------------------------
+ * The above is the SHA-1 algorithm itself. Now we implement the
+ * HMAC wrapper on it.
+ */
+
+static SHA_State sha1_mac_s1, sha1_mac_s2;
+
+static void sha1_sesskey(unsigned char *key, int len) {
+    unsigned char foo[64];
+    int i;
+
+    memset(foo, 0x36, 64);
+    for (i = 0; i < len && i < 64; i++)
+        foo[i] ^= key[i];
+    SHA_Init(&sha1_mac_s1);
+    SHA_Bytes(&sha1_mac_s1, foo, 64);
+
+    memset(foo, 0x5C, 64);
+    for (i = 0; i < len && i < 64; i++)
+        foo[i] ^= key[i];
+    SHA_Init(&sha1_mac_s2);
+    SHA_Bytes(&sha1_mac_s2, foo, 64);
+
+    memset(foo, 0, 64);                /* burn the evidence */
+}
+
+static void sha1_do_hmac(unsigned char *blk, int len, unsigned long seq,
+                         unsigned char *hmac) {
+    SHA_State s;
+    unsigned char intermediate[20];
+
+    intermediate[0] = (unsigned char)((seq >> 24) & 0xFF);
+    intermediate[1] = (unsigned char)((seq >> 16) & 0xFF);
+    intermediate[2] = (unsigned char)((seq >>  8) & 0xFF);
+    intermediate[3] = (unsigned char)((seq      ) & 0xFF);
+
+    s = sha1_mac_s1;                   /* structure copy */
+    SHA_Bytes(&s, intermediate, 4);
+    SHA_Bytes(&s, blk, len);
+    SHA_Final(&s, intermediate);
+    s = sha1_mac_s2;                   /* structure copy */
+    SHA_Bytes(&s, intermediate, 20);
+    SHA_Final(&s, hmac);
+}
+
+static void sha1_generate(unsigned char *blk, int len, unsigned long seq) {
+    sha1_do_hmac(blk, len, seq, blk+len);
+}
+
+static int sha1_verify(unsigned char *blk, int len, unsigned long seq) {
+    unsigned char correct[20];
+    sha1_do_hmac(blk, len, seq, correct);
+    return !memcmp(correct, blk+len, 20);
+}
+
+struct ssh_mac ssh_sha1 = {
+    sha1_sesskey,
+    sha1_generate,
+    sha1_verify,
+    "hmac-sha1",
+    20
+};