upstream: use KEM API for vanilla DH KEX

from markus@ ok djm@

OpenBSD-Commit-ID: af56466426b08a8be275412ae2743319e3d277c9

12 files changed, 155 insertions, 386 deletions

diff --git a/Makefile.in b/Makefile.in
index 89f930367..3a179a66f 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -98,6 +98,8 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
         ssh-ed25519.o digest-openssl.o digest-libc.o hmac.o \
         sc25519.o ge25519.o fe25519.o ed25519.o verify.o hash.o \
         kex.o kexdh.o kexgex.o kexecdh.o kexc25519.o \
+        kexgexc.o kexecdhc.o \
+        kexgexs.o kexecdhs.o \
         sntrup4591761.o kexsntrup4591761x25519.o kexkemc.o kexkems.o \
         platform-pledge.o platform-tracing.o platform-misc.o
 
diff --git a/kex.h b/kex.h
index 2eec2e04f..de5e473e1 100644
--- a/kex.h
+++ b/kex.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: kex.h,v 1.100 2019/01/21 10:24:09 djm Exp $ */
+/* $OpenBSD: kex.h,v 1.101 2019/01/21 10:28:01 djm Exp $ */
 
 /*
  * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.
@@ -211,6 +211,11 @@ int	 kexc25519_server(struct ssh *);
 int      kex_kem_client(struct ssh *);
 int      kex_kem_server(struct ssh *);
 
+int      kex_dh_keypair(struct kex *);
+int      kex_dh_enc(struct kex *, const u_char *, size_t, struct sshbuf **,
+    struct sshbuf **);
+int      kex_dh_dec(struct kex *, const u_char *, size_t, struct sshbuf **);
+
 int      kex_c25519_keypair(struct kex *);
 int      kex_c25519_enc(struct kex *, const u_char *, size_t, struct sshbuf **,
     struct sshbuf **);
@@ -224,9 +229,6 @@ int	 kex_kem_sntrup4591761x25519_dec(struct kex *, const u_char *, size_t,
 
 int      kex_dh_keygen(struct kex *);
 int      kex_dh_compute_key(struct kex *, BIGNUM *, struct sshbuf *);
-int      kex_dh_hash(int, const struct sshbuf *, const struct sshbuf *,
-    const u_char *, size_t, const u_char *, size_t, const u_char *, size_t,
-    const BIGNUM *, const BIGNUM *, const u_char *, size_t, u_char *, size_t *);
 
 int      kexgex_hash(int, const struct sshbuf *, const struct sshbuf *,
     const u_char *, size_t, const u_char *, size_t, const u_char *, size_t,
diff --git a/kexdh.c b/kexdh.c
index 5324857b2..4b811b617 100644
--- a/kexdh.c
+++ b/kexdh.c
@@ -1,6 +1,6 @@
-/* $OpenBSD: kexdh.c,v 1.29 2019/01/21 10:03:37 djm Exp $ */
+/* $OpenBSD: kexdh.c,v 1.30 2019/01/21 10:28:01 djm Exp $ */
 /*
- * Copyright (c) 2001 Markus Friedl.  All rights reserved.
+ * Copyright (c) 2019 Markus Friedl.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -30,17 +30,11 @@
 #include <sys/types.h>
 
 #include <signal.h>
+#include <stdio.h>
+#include <string.h>
 
-#include <openssl/evp.h>
-
-#include "openbsd-compat/openssl-compat.h"
-
-#include "ssh2.h"
 #include "sshkey.h"
-#include "cipher.h"
 #include "kex.h"
-#include "dh.h"
-#include "ssherr.h"
 #include "sshbuf.h"
 #include "digest.h"
 #include "dh.h"
@@ -113,53 +107,95 @@ kex_dh_compute_key(struct kex *kex, BIGNUM *dh_pub, struct sshbuf *out)
 }
 
 int
-kex_dh_hash(
-    int hash_alg,
-    const struct sshbuf *client_version,
-    const struct sshbuf *server_version,
-    const u_char *ckexinit, size_t ckexinitlen,
-    const u_char *skexinit, size_t skexinitlen,
-    const u_char *serverhostkeyblob, size_t sbloblen,
-    const BIGNUM *client_dh_pub,
-    const BIGNUM *server_dh_pub,
-    const u_char *shared_secret, size_t secretlen,
-    u_char *hash, size_t *hashlen)
+kex_dh_keypair(struct kex *kex)
 {
-        struct sshbuf *b;
+        const BIGNUM *pub_key;
+        struct sshbuf *buf = NULL;
         int r;
 
-        if (*hashlen < ssh_digest_bytes(hash_alg))
-                return SSH_ERR_INVALID_ARGUMENT;
-        if ((b = sshbuf_new()) == NULL)
-                return SSH_ERR_ALLOC_FAIL;
-        if ((r = sshbuf_put_stringb(b, client_version)) < 0 ||
-            (r = sshbuf_put_stringb(b, server_version)) < 0 ||
-            /* kexinit messages: fake header: len+SSH2_MSG_KEXINIT */
-            (r = sshbuf_put_u32(b, ckexinitlen+1)) != 0 ||
-            (r = sshbuf_put_u8(b, SSH2_MSG_KEXINIT)) != 0 ||
-            (r = sshbuf_put(b, ckexinit, ckexinitlen)) != 0 ||
-            (r = sshbuf_put_u32(b, skexinitlen+1)) != 0 ||
-            (r = sshbuf_put_u8(b, SSH2_MSG_KEXINIT)) != 0 ||
-            (r = sshbuf_put(b, skexinit, skexinitlen)) != 0 ||
-            (r = sshbuf_put_string(b, serverhostkeyblob, sbloblen)) != 0 ||
-            (r = sshbuf_put_bignum2(b, client_dh_pub)) != 0 ||
-            (r = sshbuf_put_bignum2(b, server_dh_pub)) != 0 ||
-            (r = sshbuf_put(b, shared_secret, secretlen)) != 0) {
-                sshbuf_free(b);
+        if ((r = kex_dh_keygen(kex)) != 0)
                 return r;
-        }
-#ifdef DEBUG_KEX
-        sshbuf_dump(b, stderr);
+        DH_get0_key(kex->dh, &pub_key, NULL);
+        if ((buf = sshbuf_new()) == NULL)
+                return SSH_ERR_ALLOC_FAIL;
+        if ((r = sshbuf_put_bignum2(buf, pub_key)) != 0 ||
+            (r = sshbuf_get_u32(buf, NULL)) != 0)
+                goto out;
+#ifdef DEBUG_KEXDH
+        DHparams_print_fp(stderr, kex->dh);
+        fprintf(stderr, "pub= ");
+        BN_print_fp(stderr, pub_key);
+        fprintf(stderr, "\n");
 #endif
-        if (ssh_digest_buffer(hash_alg, b, hash, *hashlen) != 0) {
-                sshbuf_free(b);
-                return SSH_ERR_LIBCRYPTO_ERROR;
+        kex->kem_client_pub = buf;
+        buf = NULL;
+ out:
+        sshbuf_free(buf);
+        return r;
+}
+
+int
+kex_dh_enc(struct kex *kex, const u_char *pkblob, size_t pklen,
+    struct sshbuf **server_blobp, struct sshbuf **shared_secretp)
+{
+        const BIGNUM *pub_key;
+        struct sshbuf *server_blob = NULL;
+        int r;
+
+        *server_blobp = NULL;
+        *shared_secretp = NULL;
+
+        if ((r = kex_dh_keygen(kex)) != 0)
+                goto out;
+        DH_get0_key(kex->dh, &pub_key, NULL);
+        if ((server_blob = sshbuf_new()) == NULL) {
+                r = SSH_ERR_ALLOC_FAIL;
+                goto out;
         }
-        sshbuf_free(b);
-        *hashlen = ssh_digest_bytes(hash_alg);
-#ifdef DEBUG_KEX
-        dump_digest("hash", hash, *hashlen);
-#endif
-        return 0;
+        if ((r = sshbuf_put_bignum2(server_blob, pub_key)) != 0 ||
+            (r = sshbuf_get_u32(server_blob, NULL)) != 0)
+                goto out;
+        if ((r = kex_dh_dec(kex, pkblob, pklen, shared_secretp)) != 0)
+                goto out;
+        *server_blobp = server_blob;
+        server_blob = NULL;
+ out:
+        DH_free(kex->dh);
+        kex->dh = NULL;
+        sshbuf_free(server_blob);
+        return r;
+}
+
+int
+kex_dh_dec(struct kex *kex, const u_char *pkblob, size_t pklen,
+    struct sshbuf **shared_secretp)
+{
+        struct sshbuf *buf = NULL;
+        BIGNUM *dh_pub = NULL;
+        int r;
+
+        *shared_secretp = NULL;
+
+        if ((buf = sshbuf_new()) == NULL) {
+                r = SSH_ERR_ALLOC_FAIL;
+                goto out;
+        }
+        if ((r = sshbuf_put_u32(buf, pklen)) != 0 ||
+            (r = sshbuf_put(buf, pkblob, pklen)) != 0) {
+                goto out;
+        }
+        if ((r = sshbuf_get_bignum2(buf, &dh_pub)) != 0) {
+                goto out;
+        }
+        sshbuf_reset(buf);
+        if ((r = kex_dh_compute_key(kex, dh_pub, buf)) != 0)
+                goto out;
+        *shared_secretp = buf;
+        buf = NULL;
+ out:
+        DH_free(kex->dh);
+        kex->dh = NULL;
+        sshbuf_free(buf);
+        return r;
 }
 #endif /* WITH_OPENSSL */
diff --git a/kexdhc.c b/kexdhc.c
deleted file mode 100644
index a2af8cb08..000000000
--- a/kexdhc.c
+++ /dev/null
@@ -1,151 +0,0 @@
-/* $OpenBSD: kexdhc.c,v 1.29 2019/01/21 10:07:22 djm Exp $ */
-/*
- * Copyright (c) 2001 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-
-#ifdef WITH_OPENSSL
-
-#include <sys/types.h>
-
-#include <openssl/dh.h>
-
-#include <stdarg.h>
-#include <stdio.h>
-#include <string.h>
-#include <signal.h>
-
-#include "openbsd-compat/openssl-compat.h"
-
-#include "sshkey.h"
-#include "cipher.h"
-#include "digest.h"
-#include "dh.h"
-#include "kex.h"
-#include "log.h"
-#include "packet.h"
-#include "ssh2.h"
-#include "dispatch.h"
-#include "compat.h"
-#include "ssherr.h"
-#include "sshbuf.h"
-
-static int input_kex_dh(int, u_int32_t, struct ssh *);
-
-int
-kexdh_client(struct ssh *ssh)
-{
-        struct kex *kex = ssh->kex;
-        int r;
-        const BIGNUM *pub_key;
-
-        /* generate and send 'e', client DH public key */
-        if ((r = kex_dh_keygen(kex)) != 0)
-                goto out;
-        debug("sending SSH2_MSG_KEXDH_INIT");
-        DH_get0_key(kex->dh, &pub_key, NULL);
-        if ((r = sshpkt_start(ssh, SSH2_MSG_KEXDH_INIT)) != 0 ||
-            (r = sshpkt_put_bignum2(ssh, pub_key)) != 0 ||
-            (r = sshpkt_send(ssh)) != 0)
-                goto out;
-#ifdef DEBUG_KEXDH
-        DHparams_print_fp(stderr, kex->dh);
-        fprintf(stderr, "pub= ");
-        BN_print_fp(stderr, pub_key);
-        fprintf(stderr, "\n");
-#endif
-        debug("expecting SSH2_MSG_KEXDH_REPLY");
-        ssh_dispatch_set(ssh, SSH2_MSG_KEXDH_REPLY, &input_kex_dh);
-        r = 0;
- out:
-        return r;
-}
-
-static int
-input_kex_dh(int type, u_int32_t seq, struct ssh *ssh)
-{
-        struct kex *kex = ssh->kex;
-        BIGNUM *dh_server_pub = NULL;
-        const BIGNUM *pub_key;
-        struct sshkey *server_host_key = NULL;
-        struct sshbuf *shared_secret = NULL;
-        u_char *server_host_key_blob = NULL, *signature = NULL;
-        u_char hash[SSH_DIGEST_MAX_LENGTH];
-        size_t slen, sbloblen, hashlen;
-        int r;
-
-        /* key, cert */
-        if ((r = sshpkt_get_string(ssh, &server_host_key_blob,
-            &sbloblen)) != 0 ||
-            (r = sshkey_from_blob(server_host_key_blob, sbloblen,
-            &server_host_key)) != 0)
-                goto out;
-        if ((r = kex_verify_host_key(ssh, server_host_key)) != 0)
-                goto out;
-        /* DH parameter f, server public DH key, signed H */
-        if ((r = sshpkt_get_bignum2(ssh, &dh_server_pub)) != 0 ||
-            (r = sshpkt_get_string(ssh, &signature, &slen)) != 0 ||
-            (r = sshpkt_get_end(ssh)) != 0)
-                goto out;
-        if ((shared_secret = sshbuf_new()) == NULL) {
-                r = SSH_ERR_ALLOC_FAIL;
-                goto out;
-        }
-        if ((r = kex_dh_compute_key(kex, dh_server_pub, shared_secret)) != 0)
-                goto out;
-
-        /* calc and verify H */
-        DH_get0_key(kex->dh, &pub_key, NULL);
-        hashlen = sizeof(hash);
-        if ((r = kex_dh_hash(
-            kex->hash_alg,
-            kex->client_version,
-            kex->server_version,
-            sshbuf_ptr(kex->my), sshbuf_len(kex->my),
-            sshbuf_ptr(kex->peer), sshbuf_len(kex->peer),
-            server_host_key_blob, sbloblen,
-            pub_key,
-            dh_server_pub,
-            sshbuf_ptr(shared_secret), sshbuf_len(shared_secret),
-            hash, &hashlen)) != 0)
-                goto out;
-
-        if ((r = sshkey_verify(server_host_key, signature, slen, hash, hashlen,
-            kex->hostkey_alg, ssh->compat)) != 0)
-                goto out;
-
-        if ((r = kex_derive_keys(ssh, hash, hashlen, shared_secret)) == 0)
-                r = kex_send_newkeys(ssh);
- out:
-        explicit_bzero(hash, sizeof(hash));
-        DH_free(kex->dh);
-        kex->dh = NULL;
-        BN_clear_free(dh_server_pub);
-        sshbuf_free(shared_secret);
-        sshkey_free(server_host_key);
-        free(server_host_key_blob);
-        free(signature);
-        return r;
-}
-#endif /* WITH_OPENSSL */
diff --git a/kexdhs.c b/kexdhs.c
deleted file mode 100644
index e33901bbf..000000000
--- a/kexdhs.c
+++ /dev/null
@@ -1,142 +0,0 @@
-/* $OpenBSD: kexdhs.c,v 1.35 2019/01/21 10:05:09 djm Exp $ */
-/*
- * Copyright (c) 2001 Markus Friedl.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "includes.h"
-
-#ifdef WITH_OPENSSL
-
-#include <sys/types.h>
-
-#include <stdarg.h>
-#include <string.h>
-#include <signal.h>
-
-#include <openssl/dh.h>
-
-#include "openbsd-compat/openssl-compat.h"
-
-#include "sshkey.h"
-#include "cipher.h"
-#include "digest.h"
-#include "dh.h"
-#include "kex.h"
-#include "log.h"
-#include "packet.h"
-#include "ssh2.h"
-
-#include "dispatch.h"
-#include "compat.h"
-#include "ssherr.h"
-#include "sshbuf.h"
-
-static int input_kex_dh_init(int, u_int32_t, struct ssh *);
-
-int
-kexdh_server(struct ssh *ssh)
-{
-        struct kex *kex = ssh->kex;
-        int r;
-
-        /* generate server DH public key */
-        if ((r = kex_dh_keygen(kex)) != 0)
-                return r;
-        debug("expecting SSH2_MSG_KEXDH_INIT");
-        ssh_dispatch_set(ssh, SSH2_MSG_KEXDH_INIT, &input_kex_dh_init);
-        return 0;
-}
-
-int
-input_kex_dh_init(int type, u_int32_t seq, struct ssh *ssh)
-{
-        struct kex *kex = ssh->kex;
-        BIGNUM *dh_client_pub = NULL;
-        const BIGNUM *pub_key;
-        struct sshkey *server_host_public, *server_host_private;
-        struct sshbuf *shared_secret = NULL;
-        u_char *signature = NULL, *server_host_key_blob = NULL;
-        u_char hash[SSH_DIGEST_MAX_LENGTH];
-        size_t sbloblen, slen;
-        size_t hashlen;
-        int r;
-
-        if ((r = kex_load_hostkey(ssh, &server_host_private,
-            &server_host_public)) != 0)
-                goto out;
-
-        /* key, cert */
-        if ((r = sshpkt_get_bignum2(ssh, &dh_client_pub)) != 0 ||
-            (r = sshpkt_get_end(ssh)) != 0)
-                goto out;
-        if ((shared_secret = sshbuf_new()) == NULL) {
-                r = SSH_ERR_ALLOC_FAIL;
-                goto out;
-        }
-        if ((r = kex_dh_compute_key(kex, dh_client_pub, shared_secret)) != 0)
-                goto out;
-        if ((r = sshkey_to_blob(server_host_public, &server_host_key_blob,
-            &sbloblen)) != 0)
-                goto out;
-        /* calc H */
-        DH_get0_key(kex->dh, &pub_key, NULL);
-        hashlen = sizeof(hash);
-        if ((r = kex_dh_hash(
-            kex->hash_alg,
-            kex->client_version,
-            kex->server_version,
-            sshbuf_ptr(kex->peer), sshbuf_len(kex->peer),
-            sshbuf_ptr(kex->my), sshbuf_len(kex->my),
-            server_host_key_blob, sbloblen,
-            dh_client_pub,
-            pub_key,
-            sshbuf_ptr(shared_secret), sshbuf_len(shared_secret),
-            hash, &hashlen)) != 0)
-                goto out;
-
-        /* sign H */
-        if ((r = kex->sign(ssh, server_host_private, server_host_public,
-            &signature, &slen, hash, hashlen, kex->hostkey_alg)) < 0)
-                goto out;
-
-        /* send server hostkey, DH pubkey 'f' and signed H */
-        if ((r = sshpkt_start(ssh, SSH2_MSG_KEXDH_REPLY)) != 0 ||
-            (r = sshpkt_put_string(ssh, server_host_key_blob, sbloblen)) != 0 ||
-            (r = sshpkt_put_bignum2(ssh, pub_key)) != 0 ||      /* f */
-            (r = sshpkt_put_string(ssh, signature, slen)) != 0 ||
-            (r = sshpkt_send(ssh)) != 0)
-                goto out;
-
-        if ((r = kex_derive_keys(ssh, hash, hashlen, shared_secret)) == 0)
-                r = kex_send_newkeys(ssh);
- out:
-        explicit_bzero(hash, sizeof(hash));
-        DH_free(kex->dh);
-        kex->dh = NULL;
-        BN_clear_free(dh_client_pub);
-        sshbuf_free(shared_secret);
-        free(server_host_key_blob);
-        free(signature);
-        return r;
-}
-#endif /* WITH_OPENSSL */
diff --git a/kexkemc.c b/kexkemc.c
index 13f36a116..384a4db59 100644
--- a/kexkemc.c
+++ b/kexkemc.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: kexkemc.c,v 1.2 2019/01/21 10:24:09 djm Exp $ */
+/* $OpenBSD: kexkemc.c,v 1.3 2019/01/21 10:28:02 djm Exp $ */
 /*
  * Copyright (c) 2019 Markus Friedl.  All rights reserved.
  *
@@ -48,6 +48,13 @@ kex_kem_client(struct ssh *ssh)
         int r;
 
         switch (kex->kex_type) {
+        case KEX_DH_GRP1_SHA1:
+        case KEX_DH_GRP14_SHA1:
+        case KEX_DH_GRP14_SHA256:
+        case KEX_DH_GRP16_SHA512:
+        case KEX_DH_GRP18_SHA512:
+                r = kex_dh_keypair(kex);
+                break;
         case KEX_C25519_SHA256:
                 r = kex_c25519_keypair(kex);
                 break;
@@ -99,6 +106,13 @@ input_kex_kem_reply(int type, u_int32_t seq, struct ssh *ssh)
 
         /* compute shared secret */
         switch (kex->kex_type) {
+        case KEX_DH_GRP1_SHA1:
+        case KEX_DH_GRP14_SHA1:
+        case KEX_DH_GRP14_SHA256:
+        case KEX_DH_GRP16_SHA512:
+        case KEX_DH_GRP18_SHA512:
+                r = kex_dh_dec(kex, server_pubkey, pklen, &shared_secret);
+                break;
         case KEX_C25519_SHA256:
                 r = kex_c25519_dec(kex, server_pubkey, pklen, &shared_secret);
                 break;
diff --git a/kexkems.c b/kexkems.c
index 89237902b..f35906d53 100644
--- a/kexkems.c
+++ b/kexkems.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: kexkems.c,v 1.2 2019/01/21 10:24:09 djm Exp $ */
+/* $OpenBSD: kexkems.c,v 1.3 2019/01/21 10:28:02 djm Exp $ */
 /*
  * Copyright (c) 2019 Markus Friedl.  All rights reserved.
  *
@@ -69,6 +69,14 @@ input_kex_kem_init(int type, u_int32_t seq, struct ssh *ssh)
 
         /* compute shared secret */
         switch (kex->kex_type) {
+        case KEX_DH_GRP1_SHA1:
+        case KEX_DH_GRP14_SHA1:
+        case KEX_DH_GRP14_SHA256:
+        case KEX_DH_GRP16_SHA512:
+        case KEX_DH_GRP18_SHA512:
+                r = kex_dh_enc(kex, client_pubkey, pklen, &server_pubkey,
+                    &shared_secret);
+                break;
         case KEX_C25519_SHA256:
                 r = kex_c25519_enc(kex, client_pubkey, pklen, &server_pubkey,
                     &shared_secret);
diff --git a/monitor.c b/monitor.c
index 9f86d5b75..01204c2cd 100644
--- a/monitor.c
+++ b/monitor.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: monitor.c,v 1.194 2019/01/21 10:24:09 djm Exp $ */
+/* $OpenBSD: monitor.c,v 1.195 2019/01/21 10:28:02 djm Exp $ */
 /*
  * Copyright 2002 Niels Provos <provos@citi.umich.edu>
  * Copyright 2002 Markus Friedl <markus@openbsd.org>
@@ -1677,11 +1677,11 @@ monitor_apply_keystate(struct ssh *ssh, struct monitor *pmonitor)
         if ((kex = ssh->kex) != NULL) {
                 /* XXX set callbacks */
 #ifdef WITH_OPENSSL
-                kex->kex[KEX_DH_GRP1_SHA1] = kexdh_server;
-                kex->kex[KEX_DH_GRP14_SHA1] = kexdh_server;
-                kex->kex[KEX_DH_GRP14_SHA256] = kexdh_server;
-                kex->kex[KEX_DH_GRP16_SHA512] = kexdh_server;
-                kex->kex[KEX_DH_GRP18_SHA512] = kexdh_server;
+                kex->kex[KEX_DH_GRP1_SHA1] = kex_kem_server;
+                kex->kex[KEX_DH_GRP14_SHA1] = kex_kem_server;
+                kex->kex[KEX_DH_GRP14_SHA256] = kex_kem_server;
+                kex->kex[KEX_DH_GRP16_SHA512] = kex_kem_server;
+                kex->kex[KEX_DH_GRP18_SHA512] = kex_kem_server;
                 kex->kex[KEX_DH_GEX_SHA1] = kexgex_server;
                 kex->kex[KEX_DH_GEX_SHA256] = kexgex_server;
 # ifdef OPENSSL_HAS_ECC
diff --git a/ssh-keyscan.c b/ssh-keyscan.c
index 9eebc1445..3d2760056 100644
--- a/ssh-keyscan.c
+++ b/ssh-keyscan.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-keyscan.c,v 1.122 2019/01/21 10:24:09 djm Exp $ */
+/* $OpenBSD: ssh-keyscan.c,v 1.123 2019/01/21 10:28:02 djm Exp $ */
 /*
  * Copyright 1995, 1996 by David Mazieres <dm@lcs.mit.edu>.
  *
@@ -260,11 +260,11 @@ keygrab_ssh2(con *c)
                 exit(1);
         }
 #ifdef WITH_OPENSSL
-        c->c_ssh->kex->kex[KEX_DH_GRP1_SHA1] = kexdh_client;
-        c->c_ssh->kex->kex[KEX_DH_GRP14_SHA1] = kexdh_client;
-        c->c_ssh->kex->kex[KEX_DH_GRP14_SHA256] = kexdh_client;
-        c->c_ssh->kex->kex[KEX_DH_GRP16_SHA512] = kexdh_client;
-        c->c_ssh->kex->kex[KEX_DH_GRP18_SHA512] = kexdh_client;
+        c->c_ssh->kex->kex[KEX_DH_GRP1_SHA1] = kex_kem_client;
+        c->c_ssh->kex->kex[KEX_DH_GRP14_SHA1] = kex_kem_client;
+        c->c_ssh->kex->kex[KEX_DH_GRP14_SHA256] = kex_kem_client;
+        c->c_ssh->kex->kex[KEX_DH_GRP16_SHA512] = kex_kem_client;
+        c->c_ssh->kex->kex[KEX_DH_GRP18_SHA512] = kex_kem_client;
         c->c_ssh->kex->kex[KEX_DH_GEX_SHA1] = kexgex_client;
         c->c_ssh->kex->kex[KEX_DH_GEX_SHA256] = kexgex_client;
 # ifdef OPENSSL_HAS_ECC
diff --git a/ssh_api.c b/ssh_api.c
index fe9fbf5a7..ac614e599 100644
--- a/ssh_api.c
+++ b/ssh_api.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh_api.c,v 1.12 2019/01/21 10:24:09 djm Exp $ */
+/* $OpenBSD: ssh_api.c,v 1.13 2019/01/21 10:28:02 djm Exp $ */
 /*
  * Copyright (c) 2012 Markus Friedl.  All rights reserved.
  *
@@ -99,11 +99,11 @@ ssh_init(struct ssh **sshp, int is_server, struct kex_params *kex_params)
         ssh->kex->server = is_server;
         if (is_server) {
 #ifdef WITH_OPENSSL
-                ssh->kex->kex[KEX_DH_GRP1_SHA1] = kexdh_server;
-                ssh->kex->kex[KEX_DH_GRP14_SHA1] = kexdh_server;
-                ssh->kex->kex[KEX_DH_GRP14_SHA256] = kexdh_server;
-                ssh->kex->kex[KEX_DH_GRP16_SHA512] = kexdh_server;
-                ssh->kex->kex[KEX_DH_GRP18_SHA512] = kexdh_server;
+                ssh->kex->kex[KEX_DH_GRP1_SHA1] = kex_kem_server;
+                ssh->kex->kex[KEX_DH_GRP14_SHA1] = kex_kem_server;
+                ssh->kex->kex[KEX_DH_GRP14_SHA256] = kex_kem_server;
+                ssh->kex->kex[KEX_DH_GRP16_SHA512] = kex_kem_server;
+                ssh->kex->kex[KEX_DH_GRP18_SHA512] = kex_kem_server;
                 ssh->kex->kex[KEX_DH_GEX_SHA1] = kexgex_server;
                 ssh->kex->kex[KEX_DH_GEX_SHA256] = kexgex_server;
 # ifdef OPENSSL_HAS_ECC
@@ -117,11 +117,11 @@ ssh_init(struct ssh **sshp, int is_server, struct kex_params *kex_params)
                 ssh->kex->sign=&_ssh_host_key_sign;
         } else {
 #ifdef WITH_OPENSSL
-                ssh->kex->kex[KEX_DH_GRP1_SHA1] = kexdh_client;
-                ssh->kex->kex[KEX_DH_GRP14_SHA1] = kexdh_client;
-                ssh->kex->kex[KEX_DH_GRP14_SHA256] = kexdh_client;
-                ssh->kex->kex[KEX_DH_GRP16_SHA512] = kexdh_client;
-                ssh->kex->kex[KEX_DH_GRP18_SHA512] = kexdh_client;
+                ssh->kex->kex[KEX_DH_GRP1_SHA1] = kex_kem_client;
+                ssh->kex->kex[KEX_DH_GRP14_SHA1] = kex_kem_client;
+                ssh->kex->kex[KEX_DH_GRP14_SHA256] = kex_kem_client;
+                ssh->kex->kex[KEX_DH_GRP16_SHA512] = kex_kem_client;
+                ssh->kex->kex[KEX_DH_GRP18_SHA512] = kex_kem_client;
                 ssh->kex->kex[KEX_DH_GEX_SHA1] = kexgex_client;
                 ssh->kex->kex[KEX_DH_GEX_SHA256] = kexgex_client;
 # ifdef OPENSSL_HAS_ECC
diff --git a/sshconnect2.c b/sshconnect2.c
index be19722bb..ebeff29bd 100644
--- a/sshconnect2.c
+++ b/sshconnect2.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshconnect2.c,v 1.298 2019/01/21 10:24:09 djm Exp $ */
+/* $OpenBSD: sshconnect2.c,v 1.299 2019/01/21 10:28:02 djm Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  * Copyright (c) 2008 Damien Miller.  All rights reserved.
@@ -201,11 +201,11 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr *hostaddr, u_short port)
         if ((r = kex_setup(ssh, myproposal)) != 0)
                 fatal("kex_setup: %s", ssh_err(r));
 #ifdef WITH_OPENSSL
-        ssh->kex->kex[KEX_DH_GRP1_SHA1] = kexdh_client;
-        ssh->kex->kex[KEX_DH_GRP14_SHA1] = kexdh_client;
-        ssh->kex->kex[KEX_DH_GRP14_SHA256] = kexdh_client;
-        ssh->kex->kex[KEX_DH_GRP16_SHA512] = kexdh_client;
-        ssh->kex->kex[KEX_DH_GRP18_SHA512] = kexdh_client;
+        ssh->kex->kex[KEX_DH_GRP1_SHA1] = kex_kem_client;
+        ssh->kex->kex[KEX_DH_GRP14_SHA1] = kex_kem_client;
+        ssh->kex->kex[KEX_DH_GRP14_SHA256] = kex_kem_client;
+        ssh->kex->kex[KEX_DH_GRP16_SHA512] = kex_kem_client;
+        ssh->kex->kex[KEX_DH_GRP18_SHA512] = kex_kem_client;
         ssh->kex->kex[KEX_DH_GEX_SHA1] = kexgex_client;
         ssh->kex->kex[KEX_DH_GEX_SHA256] = kexgex_client;
 # ifdef OPENSSL_HAS_ECC
diff --git a/sshd.c b/sshd.c
index 665b22b1e..eb92785bf 100644
--- a/sshd.c
+++ b/sshd.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshd.c,v 1.529 2019/01/21 10:24:09 djm Exp $ */
+/* $OpenBSD: sshd.c,v 1.530 2019/01/21 10:28:02 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -2207,11 +2207,11 @@ do_ssh2_kex(struct ssh *ssh)
                 fatal("kex_setup: %s", ssh_err(r));
         kex = ssh->kex;
 #ifdef WITH_OPENSSL
-        kex->kex[KEX_DH_GRP1_SHA1] = kexdh_server;
-        kex->kex[KEX_DH_GRP14_SHA1] = kexdh_server;
-        kex->kex[KEX_DH_GRP14_SHA256] = kexdh_server;
-        kex->kex[KEX_DH_GRP16_SHA512] = kexdh_server;
-        kex->kex[KEX_DH_GRP18_SHA512] = kexdh_server;
+        kex->kex[KEX_DH_GRP1_SHA1] = kex_kem_server;
+        kex->kex[KEX_DH_GRP14_SHA1] = kex_kem_server;
+        kex->kex[KEX_DH_GRP14_SHA256] = kex_kem_server;
+        kex->kex[KEX_DH_GRP16_SHA512] = kex_kem_server;
+        kex->kex[KEX_DH_GRP18_SHA512] = kex_kem_server;
         kex->kex[KEX_DH_GEX_SHA1] = kexgex_server;
         kex->kex[KEX_DH_GEX_SHA256] = kexgex_server;
 # ifdef OPENSSL_HAS_ECC