- djm@cvs.openbsd.org 2008/11/04 08:22:13

     [auth.h auth2.c monitor.c monitor.h monitor_wrap.c monitor_wrap.h]
     [readconf.c readconf.h servconf.c servconf.h ssh2.h ssh_config.5]
     [sshconnect2.c sshd_config.5 jpake.c jpake.h schnorr.c auth2-jpake.c]
     [Makefile.in]
     Add support for an experimental zero-knowledge password authentication
     method using the J-PAKE protocol described in F. Hao, P. Ryan,
     "Password Authenticated Key Exchange by Juggling", 16th Workshop on
     Security Protocols, Cambridge, April 2008.

     This method allows password-based authentication without exposing
     the password to the server. Instead, the client and server exchange
     cryptographic proofs to demonstrate of knowledge of the password while
     revealing nothing useful to an attacker or compromised endpoint.

     This is experimental, work-in-progress code and is presently
     compiled-time disabled (turn on -DJPAKE in Makefile.inc).

     "just commit it.  It isn't too intrusive." deraadt@

1 files changed, 8 insertions, 1 deletions

diff --git a/ssh2.h b/ssh2.h
index cf56bc4ee..1c33dc268 100644
--- a/ssh2.h
+++ b/ssh2.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh2.h,v 1.10 2006/03/25 22:22:43 djm Exp $ */
+/* $OpenBSD: ssh2.h,v 1.11 2008/11/04 08:22:13 djm Exp $ */
 
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
@@ -111,6 +111,12 @@
 #define SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ              60
 #define SSH2_MSG_USERAUTH_INFO_REQUEST                  60
 #define SSH2_MSG_USERAUTH_INFO_RESPONSE                 61
+#define SSH2_MSG_USERAUTH_JPAKE_CLIENT_STEP1            60
+#define SSH2_MSG_USERAUTH_JPAKE_SERVER_STEP1            61
+#define SSH2_MSG_USERAUTH_JPAKE_CLIENT_STEP2            62
+#define SSH2_MSG_USERAUTH_JPAKE_SERVER_STEP2            63
+#define SSH2_MSG_USERAUTH_JPAKE_CLIENT_CONFIRM          64
+#define SSH2_MSG_USERAUTH_JPAKE_SERVER_CONFIRM          65
 
 /* connection protocol: generic */
 
@@ -159,3 +165,4 @@
 #define SSH2_OPEN_RESOURCE_SHORTAGE                     4
 
 #define SSH2_EXTENDED_DATA_STDERR                       1
+