1 files changed, 124 insertions, 58 deletions

diff --git a/kexc25519.c b/kexc25519.c
index 0897b8c51..f13d766d7 100644
--- a/kexc25519.c
+++ b/kexc25519.c
@@ -1,6 +1,6 @@
-/* $OpenBSD: kexc25519.c,v 1.10 2016/05/02 08:49:03 djm Exp $ */
+/* $OpenBSD: kexc25519.c,v 1.17 2019/01/21 10:40:11 djm Exp $ */
 /*
- * Copyright (c) 2001, 2013 Markus Friedl.  All rights reserved.
+ * Copyright (c) 2019 Markus Friedl.  All rights reserved.
  * Copyright (c) 2010 Damien Miller.  All rights reserved.
  * Copyright (c) 2013 Aris Adamantiadis.  All rights reserved.
  *
@@ -29,20 +29,16 @@
 
 #include <sys/types.h>
 
-#include <signal.h>
+#include <stdio.h>
 #include <string.h>
+#include <signal.h>
 
-#include <openssl/bn.h>
-#include <openssl/evp.h>
-
-#include "sshbuf.h"
-#include "ssh2.h"
 #include "sshkey.h"
-#include "cipher.h"
 #include "kex.h"
-#include "log.h"
+#include "sshbuf.h"
 #include "digest.h"
 #include "ssherr.h"
+#include "ssh2.h"
 
 extern int crypto_scalarmult_curve25519(u_char a[CURVE25519_SIZE],
     const u_char b[CURVE25519_SIZE], const u_char c[CURVE25519_SIZE])
@@ -60,74 +56,144 @@ kexc25519_keygen(u_char key[CURVE25519_SIZE], u_char pub[CURVE25519_SIZE])
 }
 
 int
-kexc25519_shared_key(const u_char key[CURVE25519_SIZE],
-    const u_char pub[CURVE25519_SIZE], struct sshbuf *out)
+kexc25519_shared_key_ext(const u_char key[CURVE25519_SIZE],
+    const u_char pub[CURVE25519_SIZE], struct sshbuf *out, int raw)
 {
         u_char shared_key[CURVE25519_SIZE];
+        u_char zero[CURVE25519_SIZE];
         int r;
 
-        /* Check for all-zero public key */
-        explicit_bzero(shared_key, CURVE25519_SIZE);
-        if (timingsafe_bcmp(pub, shared_key, CURVE25519_SIZE) == 0)
+        crypto_scalarmult_curve25519(shared_key, key, pub);
+
+        /* Check for all-zero shared secret */
+        explicit_bzero(zero, CURVE25519_SIZE);
+        if (timingsafe_bcmp(zero, shared_key, CURVE25519_SIZE) == 0)
                 return SSH_ERR_KEY_INVALID_EC_VALUE;
 
-        crypto_scalarmult_curve25519(shared_key, key, pub);
 #ifdef DEBUG_KEXECDH
         dump_digest("shared secret", shared_key, CURVE25519_SIZE);
 #endif
-        sshbuf_reset(out);
-        r = sshbuf_put_bignum2_bytes(out, shared_key, CURVE25519_SIZE);
+        if (raw)
+                r = sshbuf_put(out, shared_key, CURVE25519_SIZE);
+        else
+                r = sshbuf_put_bignum2_bytes(out, shared_key, CURVE25519_SIZE);
         explicit_bzero(shared_key, CURVE25519_SIZE);
         return r;
 }
 
 int
-kex_c25519_hash(
-    int hash_alg,
-    const char *client_version_string,
-    const char *server_version_string,
-    const u_char *ckexinit, size_t ckexinitlen,
-    const u_char *skexinit, size_t skexinitlen,
-    const u_char *serverhostkeyblob, size_t sbloblen,
-    const u_char client_dh_pub[CURVE25519_SIZE],
-    const u_char server_dh_pub[CURVE25519_SIZE],
-    const u_char *shared_secret, size_t secretlen,
-    u_char *hash, size_t *hashlen)
+kexc25519_shared_key(const u_char key[CURVE25519_SIZE],
+    const u_char pub[CURVE25519_SIZE], struct sshbuf *out)
+{
+        return kexc25519_shared_key_ext(key, pub, out, 0);
+}
+
+int
+kex_c25519_keypair(struct kex *kex)
 {
-        struct sshbuf *b;
+        struct sshbuf *buf = NULL;
+        u_char *cp = NULL;
         int r;
 
-        if (*hashlen < ssh_digest_bytes(hash_alg))
-                return SSH_ERR_INVALID_ARGUMENT;
-        if ((b = sshbuf_new()) == NULL)
+        if ((buf = sshbuf_new()) == NULL)
                 return SSH_ERR_ALLOC_FAIL;
-        if ((r = sshbuf_put_cstring(b, client_version_string)) < 0 ||
-            (r = sshbuf_put_cstring(b, server_version_string)) < 0 ||
-            /* kexinit messages: fake header: len+SSH2_MSG_KEXINIT */
-            (r = sshbuf_put_u32(b, ckexinitlen+1)) < 0 ||
-            (r = sshbuf_put_u8(b, SSH2_MSG_KEXINIT)) < 0 ||
-            (r = sshbuf_put(b, ckexinit, ckexinitlen)) < 0 ||
-            (r = sshbuf_put_u32(b, skexinitlen+1)) < 0 ||
-            (r = sshbuf_put_u8(b, SSH2_MSG_KEXINIT)) < 0 ||
-            (r = sshbuf_put(b, skexinit, skexinitlen)) < 0 ||
-            (r = sshbuf_put_string(b, serverhostkeyblob, sbloblen)) < 0 ||
-            (r = sshbuf_put_string(b, client_dh_pub, CURVE25519_SIZE)) < 0 ||
-            (r = sshbuf_put_string(b, server_dh_pub, CURVE25519_SIZE)) < 0 ||
-            (r = sshbuf_put(b, shared_secret, secretlen)) < 0) {
-                sshbuf_free(b);
-                return r;
+        if ((r = sshbuf_reserve(buf, CURVE25519_SIZE, &cp)) != 0)
+                goto out;
+        kexc25519_keygen(kex->c25519_client_key, cp);
+#ifdef DEBUG_KEXECDH
+        dump_digest("client public key c25519:", cp, CURVE25519_SIZE);
+#endif
+        kex->client_pub = buf;
+        buf = NULL;
+ out:
+        sshbuf_free(buf);
+        return r;
+}
+
+int
+kex_c25519_enc(struct kex *kex, const struct sshbuf *client_blob,
+   struct sshbuf **server_blobp, struct sshbuf **shared_secretp)
+{
+        struct sshbuf *server_blob = NULL;
+        struct sshbuf *buf = NULL;
+        const u_char *client_pub;
+        u_char *server_pub;
+        u_char server_key[CURVE25519_SIZE];
+        int r;
+
+        *server_blobp = NULL;
+        *shared_secretp = NULL;
+
+        if (sshbuf_len(client_blob) != CURVE25519_SIZE) {
+                r = SSH_ERR_SIGNATURE_INVALID;
+                goto out;
         }
-#ifdef DEBUG_KEX
-        sshbuf_dump(b, stderr);
+        client_pub = sshbuf_ptr(client_blob);
+#ifdef DEBUG_KEXECDH
+        dump_digest("client public key 25519:", client_pub, CURVE25519_SIZE);
 #endif
-        if (ssh_digest_buffer(hash_alg, b, hash, *hashlen) != 0) {
-                sshbuf_free(b);
-                return SSH_ERR_LIBCRYPTO_ERROR;
+        /* allocate space for encrypted KEM key and ECDH pub key */
+        if ((server_blob = sshbuf_new()) == NULL) {
+                r = SSH_ERR_ALLOC_FAIL;
+                goto out;
         }
-        sshbuf_free(b);
-        *hashlen = ssh_digest_bytes(hash_alg);
-#ifdef DEBUG_KEX
-        dump_digest("hash", hash, *hashlen);
+        if ((r = sshbuf_reserve(server_blob, CURVE25519_SIZE, &server_pub)) != 0)
+                goto out;
+        kexc25519_keygen(server_key, server_pub);
+        /* allocate shared secret */
+        if ((buf = sshbuf_new()) == NULL) {
+                r = SSH_ERR_ALLOC_FAIL;
+                goto out;
+        }
+        if ((r = kexc25519_shared_key_ext(server_key, client_pub, buf, 0)) < 0)
+                goto out;
+#ifdef DEBUG_KEXECDH
+        dump_digest("server public key 25519:", server_pub, CURVE25519_SIZE);
+        dump_digest("encoded shared secret:", sshbuf_ptr(buf), sshbuf_len(buf));
 #endif
-        return 0;
+        *server_blobp = server_blob;
+        *shared_secretp = buf;
+        server_blob = NULL;
+        buf = NULL;
+ out:
+        explicit_bzero(server_key, sizeof(server_key));
+        sshbuf_free(server_blob);
+        sshbuf_free(buf);
+        return r;
+}
+
+int
+kex_c25519_dec(struct kex *kex, const struct sshbuf *server_blob,
+    struct sshbuf **shared_secretp)
+{
+        struct sshbuf *buf = NULL;
+        const u_char *server_pub;
+        int r;
+
+        *shared_secretp = NULL;
+
+        if (sshbuf_len(server_blob) != CURVE25519_SIZE) {
+                r = SSH_ERR_SIGNATURE_INVALID;
+                goto out;
+        }
+        server_pub = sshbuf_ptr(server_blob);
+#ifdef DEBUG_KEXECDH
+        dump_digest("server public key c25519:", server_pub, CURVE25519_SIZE);
+#endif
+        /* shared secret */
+        if ((buf = sshbuf_new()) == NULL) {
+                r = SSH_ERR_ALLOC_FAIL;
+                goto out;
+        }
+        if ((r = kexc25519_shared_key_ext(kex->c25519_client_key, server_pub,
+            buf, 0)) < 0)
+                goto out;
+#ifdef DEBUG_KEXECDH
+        dump_digest("encoded shared secret:", sshbuf_ptr(buf), sshbuf_len(buf));
+#endif
+        *shared_secretp = buf;
+        buf = NULL;
+ out:
+        sshbuf_free(buf);
+        return r;
 }