1 files changed, 67 insertions, 31 deletions

diff --git a/kex.h b/kex.h
index 4e5ead839..39f67bbc1 100644
--- a/kex.h
+++ b/kex.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: kex.h,v 1.91 2018/07/11 18:53:29 markus Exp $ */
+/* $OpenBSD: kex.h,v 1.107 2019/01/23 00:30:41 djm Exp $ */
 
 /*
  * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.
@@ -27,6 +27,7 @@
 #define KEX_H
 
 #include "mac.h"
+#include "crypto_api.h"
 
 #ifdef WITH_LEAKMALLOC
 #include "leakmalloc.h"
@@ -62,6 +63,7 @@
 #define KEX_ECDH_SHA2_NISTP521          "ecdh-sha2-nistp521"
 #define KEX_CURVE25519_SHA256           "curve25519-sha256"
 #define KEX_CURVE25519_SHA256_OLD       "curve25519-sha256@libssh.org"
+#define KEX_SNTRUP4591761X25519_SHA512  "sntrup4591761x25519-sha512@tinyssh.org"
 
 #define COMP_NONE       0
 /* pre-auth compression (COMP_ZLIB) is only supported in the client */
@@ -100,13 +102,21 @@ enum kex_exchange {
         KEX_DH_GEX_SHA256,
         KEX_ECDH_SHA2,
         KEX_C25519_SHA256,
+        KEX_KEM_SNTRUP4591761X25519_SHA512,
+#ifdef GSSAPI
         KEX_GSS_GRP1_SHA1,
         KEX_GSS_GRP14_SHA1,
+        KEX_GSS_GRP14_SHA256,
+        KEX_GSS_GRP16_SHA512,
         KEX_GSS_GEX_SHA1,
+        KEX_GSS_NISTP256_SHA256,
+        KEX_GSS_C25519_SHA256,
+#endif
         KEX_MAX
 };
 
 #define KEX_INIT_SENT   0x0001
+#define KEX_INITIAL     0x0002
 
 struct sshenc {
         char    *name;
@@ -147,6 +157,8 @@ struct kex {
         int     ext_info_c;
         struct sshbuf *my;
         struct sshbuf *peer;
+        struct sshbuf *client_version;
+        struct sshbuf *server_version;
         sig_atomic_t done;
         u_int   flags;
         int     hash_alg;
@@ -157,31 +169,36 @@ struct kex {
         char    *gss_host;
         char    *gss_client;
 #endif
-        char    *client_version_string;
-        char    *server_version_string;
         char    *failed_choice;
         int     (*verify_host_key)(struct sshkey *, struct ssh *);
         struct sshkey *(*load_host_public_key)(int, int, struct ssh *);
         struct sshkey *(*load_host_private_key)(int, int, struct ssh *);
         int     (*host_key_index)(struct sshkey *, int, struct ssh *);
-        int     (*sign)(struct sshkey *, struct sshkey *, u_char **, size_t *,
-            const u_char *, size_t, const char *, u_int);
+        int     (*sign)(struct ssh *, struct sshkey *, struct sshkey *,
+            u_char **, size_t *, const u_char *, size_t, const char *);
         int     (*kex[KEX_MAX])(struct ssh *);
         /* kex specific state */
         DH      *dh;                    /* DH */
         u_int   min, max, nbits;        /* GEX */
         EC_KEY  *ec_client_key;         /* ECDH */
         const EC_GROUP *ec_group;       /* ECDH */
-        u_char c25519_client_key[CURVE25519_SIZE]; /* 25519 */
+        u_char c25519_client_key[CURVE25519_SIZE]; /* 25519 + KEM */
         u_char c25519_client_pubkey[CURVE25519_SIZE]; /* 25519 */
+        u_char sntrup4591761_client_key[crypto_kem_sntrup4591761_SECRETKEYBYTES]; /* KEM */
+        struct sshbuf *client_pub;
 };
 
 int      kex_names_valid(const char *);
 char    *kex_alg_list(char);
+char    *kex_gss_alg_list(char);
 char    *kex_names_cat(const char *, const char *);
 int      kex_assemble_names(char **, const char *, const char *);
+int      kex_gss_names_valid(const char *);
+
+int      kex_exchange_identification(struct ssh *, int, int, const char *);
 
-int      kex_new(struct ssh *, char *[PROPOSAL_MAX], struct kex **);
+struct kex *kex_new(void);
+int      kex_ready(struct ssh *, char *[PROPOSAL_MAX]);
 int      kex_setup(struct ssh *, char *[PROPOSAL_MAX]);
 void     kex_free_newkeys(struct newkeys *);
 void     kex_free(struct kex *);
@@ -189,48 +206,63 @@ void	 kex_free(struct kex *);
 int      kex_buf2prop(struct sshbuf *, int *, char ***);
 int      kex_prop2buf(struct sshbuf *, char *proposal[PROPOSAL_MAX]);
 void     kex_prop_free(char **);
+int      kex_load_hostkey(struct ssh *, struct sshkey **, struct sshkey **);
+int      kex_verify_host_key(struct ssh *, struct sshkey *);
 
 int      kex_send_kexinit(struct ssh *);
 int      kex_input_kexinit(int, u_int32_t, struct ssh *);
 int      kex_input_ext_info(int, u_int32_t, struct ssh *);
 int      kex_derive_keys(struct ssh *, u_char *, u_int, const struct sshbuf *);
-int      kex_derive_keys_bn(struct ssh *, u_char *, u_int, const BIGNUM *);
 int      kex_send_newkeys(struct ssh *);
 int      kex_start_rekex(struct ssh *);
 
-int      kexdh_client(struct ssh *);
-int      kexdh_server(struct ssh *);
 int      kexgex_client(struct ssh *);
 int      kexgex_server(struct ssh *);
-int      kexecdh_client(struct ssh *);
-int      kexecdh_server(struct ssh *);
-int      kexc25519_client(struct ssh *);
-int      kexc25519_server(struct ssh *);
-
-#ifdef GSSAPI
+int      kex_gen_client(struct ssh *);
+int      kex_gen_server(struct ssh *);
+#if defined(GSSAPI) && defined(WITH_OPENSSL)
+int      kexgssgex_client(struct ssh *);
+int      kexgssgex_server(struct ssh *);
 int      kexgss_client(struct ssh *);
 int      kexgss_server(struct ssh *);
 #endif
 
-int      kex_dh_hash(int, const char *, const char *,
-    const u_char *, size_t, const u_char *, size_t, const u_char *, size_t,
-    const BIGNUM *, const BIGNUM *, const BIGNUM *, u_char *, size_t *);
+int      kex_dh_keypair(struct kex *);
+int      kex_dh_enc(struct kex *, const struct sshbuf *, struct sshbuf **,
+    struct sshbuf **);
+int      kex_dh_dec(struct kex *, const struct sshbuf *, struct sshbuf **);
+
+int      kex_ecdh_keypair(struct kex *);
+int      kex_ecdh_enc(struct kex *, const struct sshbuf *, struct sshbuf **,
+    struct sshbuf **);
+int      kex_ecdh_dec(struct kex *, const struct sshbuf *, struct sshbuf **);
 
-int      kexgex_hash(int, const char *, const char *,
-    const u_char *, size_t, const u_char *, size_t, const u_char *, size_t,
+int      kex_c25519_keypair(struct kex *);
+int      kex_c25519_enc(struct kex *, const struct sshbuf *, struct sshbuf **,
+    struct sshbuf **);
+int      kex_c25519_dec(struct kex *, const struct sshbuf *, struct sshbuf **);
+
+int      kex_kem_sntrup4591761x25519_keypair(struct kex *);
+int      kex_kem_sntrup4591761x25519_enc(struct kex *, const struct sshbuf *,
+    struct sshbuf **, struct sshbuf **);
+int      kex_kem_sntrup4591761x25519_dec(struct kex *, const struct sshbuf *,
+    struct sshbuf **);
+
+int      kex_dh_keygen(struct kex *);
+int      kex_dh_compute_key(struct kex *, BIGNUM *, struct sshbuf *);
+
+int      kexgex_hash(int, const struct sshbuf *, const struct sshbuf *,
+    const struct sshbuf *, const struct sshbuf *, const struct sshbuf *,
     int, int, int,
     const BIGNUM *, const BIGNUM *, const BIGNUM *,
-    const BIGNUM *, const BIGNUM *,
+    const BIGNUM *, const u_char *, size_t,
     u_char *, size_t *);
 
-int kex_ecdh_hash(int, const EC_GROUP *, const char *, const char *,
-    const u_char *, size_t, const u_char *, size_t, const u_char *, size_t,
-    const EC_POINT *, const EC_POINT *, const BIGNUM *, u_char *, size_t *);
-
-int      kex_c25519_hash(int, const char *, const char *,
-    const u_char *, size_t, const u_char *, size_t,
-    const u_char *, size_t, const u_char *, const u_char *,
-    const u_char *, size_t, u_char *, size_t *);
+int      kex_gen_hash(int hash_alg, const struct sshbuf *client_version,
+    const struct sshbuf *server_version, const struct sshbuf *client_kexinit,
+    const struct sshbuf *server_kexinit, const struct sshbuf *server_host_key_blob,
+    const struct sshbuf *client_pub, const struct sshbuf *server_pub,
+    const struct sshbuf *shared_secret, u_char *hash, size_t *hashlen);
 
 void    kexc25519_keygen(u_char key[CURVE25519_SIZE], u_char pub[CURVE25519_SIZE])
         __attribute__((__bounded__(__minbytes__, 1, CURVE25519_SIZE)))
@@ -239,9 +271,13 @@ int	kexc25519_shared_key(const u_char key[CURVE25519_SIZE],
     const u_char pub[CURVE25519_SIZE], struct sshbuf *out)
         __attribute__((__bounded__(__minbytes__, 1, CURVE25519_SIZE)))
         __attribute__((__bounded__(__minbytes__, 2, CURVE25519_SIZE)));
+int     kexc25519_shared_key_ext(const u_char key[CURVE25519_SIZE],
+    const u_char pub[CURVE25519_SIZE], struct sshbuf *out, int)
+        __attribute__((__bounded__(__minbytes__, 1, CURVE25519_SIZE)))
+        __attribute__((__bounded__(__minbytes__, 2, CURVE25519_SIZE)));
 
 #if defined(DEBUG_KEX) || defined(DEBUG_KEXDH) || defined(DEBUG_KEXECDH)
-void    dump_digest(char *, u_char *, int);
+void    dump_digest(const char *, const u_char *, int);
 #endif
 
 #if !defined(WITH_OPENSSL) || !defined(OPENSSL_HAS_ECC)