summaryrefslogtreecommitdiffstats
path: root/usr.bin/ssh/kex.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* free the correct IV length, don't assume it's always the cipherdjm2015-10-131-2/+2
| | | | blocksize; ok dtucker@
* Improve printing of KEX offers and decisionsdjm2015-08-211-19/+38
| | | | | The debug output now labels the client and server offers and the negotiated options. ok markus@
* Allow ssh_config and sshd_config kex parameters options be prefixeddjm2015-07-301-1/+63
| | | | | | | by a '+' to indicate that the specified items be appended to the default rather than replacing it. approach suggested by dtucker@, feedback dlg@, ok markus@
* fix bug in previous; was printing incorrect string for faileddjm2015-07-291-3/+3
| | | | host key algorithms negotiation
* include the peer's offer when logging a failure to negotiate adjm2015-07-291-7/+24
| | | | | mutual set of algorithms (kex, pubkey, ciphers, etc.) ok markus@
* don't try to cleanup NULL KEX proposals in kex_prop_free();djm2015-04-171-1/+3
| | | | found by Jukka Taimisto and Markus Hietava
* fix ssh protocol 1, spotted by miod@djm2015-01-301-9/+20
|
* correctly match ECDSA subtype (== curve) for offered/recevieddjm2015-01-261-1/+2
| | | | | | | | host keys. Fixes connection-killing host key mismatches when a server offers multiple ECDSA keys with different curve type (an extremely unlikely configuration). ok markus, "looks mechanical" deraadt@
* Reduce use of <sys/param.h> and transition to <limits.h> throughout.deraadt2015-01-201-2/+2
| | | | ok djm markus
* adapt kex to sshbuf and struct ssh; ok djm@markus2015-01-191-237/+338
|
* move dispatch to struct ssh; ok djm@markus2015-01-191-3/+5
|
* update packet.c & isolate, introduce struct sshmarkus2015-01-191-33/+54
| | | | | | | | a) switch packet.c to buffer api and isolate per-connection info into struct ssh b) (de)serialization of the state is moved from monitor to packet.c c) the old packet.c API is implemented in opacket.[ch] d) compress.c/h is removed and integrated into packet.c with and ok djm@
* make compiling against OpenSSL optional (make OPENSSL=no);markus2014-04-291-1/+9
| | | | | reduces algorithms to curve25519, aes-ctr, chacha, ed25519; allows us to explore further options; with and ok djm
* convert memset of potentially-private data to explicit_bzero()djm2014-02-021-3/+3
|
* dh_need needs to be set to max(seclen, blocksize, ivlen, mac_len)markus2014-01-251-11/+9
| | | | ok dtucker@, noted by mancha
* Add a special case for the DH group size for 3des-cbc, which has andtucker2014-01-251-3/+6
| | | | | | | | effective strength much lower than the key size. This causes problems with some cryptlib implementations, which don't support group sizes larger than 4k but also don't use the largest group size it does support as specified in the RFC. Based on a patch from Petr Lautrbach at Redhat, reduced by me with input from Markus. ok djm@ markus@
* avoid use of OpenSSL BIGNUM type and functions for KEX withdjm2014-01-121-5/+18
| | | | | | | Curve25519 by adding a buffer_put_bignum2_from_string() that stores a string using the bignum encoding rules. Will make it easier to build a reduced-feature OpenSSH without OpenSSL in the future; ok markus@
* Introduce digest API and use it to perform all hashing operationsdjm2014-01-091-41/+52
| | | | | | rather than calling OpenSSL EVP_Digest* directly. Will make it easier to build a reduced-feature OpenSSH without OpenSSL in future; feedback, ok markus@
* Output the effective values of Ciphers, MACs and KexAlgorithms whendtucker2013-11-071-3/+3
| | | | the default has not been overridden. ok markus@
* use curve25519 for default key exchange (curve25519-sha256@libssh.org);markus2013-11-021-1/+2
| | | | initial patch from Aris Adamantiadis; ok djm@
* bye, bye xfree(); ok markus@djm2013-05-171-9/+9
|
* remove duplicated list entry pointed out by naddy@djm2013-04-191-2/+1
|
* add the ability to query supported ciphers, MACs, key type and KEXdjm2013-04-191-26/+57
| | | | | algorithms to ssh. Includes some refactoring of KEX and key type handling to be table-driven; ok markus@
* support AES-GCM as defined in RFC 5647 (but with simpler KEX handling)markus2013-01-081-5/+11
| | | | ok and feedback djm@
* add some comments about better handling first-KEX-follows notificationsdjm2012-08-171-3/+13
| | | | from the server. Nothing uses these right now. No binary change
* add a KexAlgorithms knob to the client and server configuration to allowdjm2010-09-221-1/+29
| | | | | | | selection of which key exchange methods are used by ssh(1) and sshd(8) and their order of preference. ok markus@
* ECDH/ECDSA compliance fix: these methods vary the hash function they usedjm2010-09-091-4/+4
| | | | | | | | | | | | | (SHA256/384/512) depending on the length of the curve in use. The previous code incorrectly used SHA256 in all cases. This fix will cause authentication failure when using 384 or 521-bit curve keys if one peer hasn't been upgraded and the other has. (256-bit curve keys work ok). In particular you may need to specify HostkeyAlgorithms when connecting to a server that has not been upgraded from an upgraded client. ok naddy@
* Implement Elliptic Curve Cryptography modes for key exchange (ECDH) anddjm2010-08-311-3/+7
| | | | | | | | | | | | | | | | | host/user keys (ECDSA) as specified by RFC5656. ECDH and ECDSA offer better performance than plain DH and DSA at the same equivalent symmetric key length, as well as much shorter keys. Only the mandatory sections of RFC5656 are implemented, specifically the three REQUIRED curves nistp256, nistp384 and nistp521 and only ECDH and ECDSA. Point compression (optional in RFC5656 is NOT implemented). Certificate host and user keys using the new ECDSA key types are supported. Note that this code has not been tested for interoperability and may be subject to change. feedback and ok markus@
* Add buffer_get_cstring() and related functions that verify that thedjm2010-08-311-2/+2
| | | | | | | | | | | | | string extracted from the buffer contains no embedded \0 characters* This prevents random (possibly malicious) crap from being appended to strings where it would not be noticed if the string is used with a string(3) function. Use the new API in a few sensitive places. * actually, we allow a single one at the end of the string for now because we don't know how many deployed implementations get this wrong, but don't count on this to remain indefinitely.
* Let the client detect if the server supports roaming by lookingandreas2009-10-241-1/+12
| | | | | for the resume@appgate.com kex algorithm. ok markus@
* Move the KEX_COOKIE_LEN define to kex.handreas2009-05-271-3/+1
| | | | ok markus@
* OpenSSL 0.9.8h supplies a real EVP_sha256 so we do not need ourdjm2008-09-061-4/+2
| | | | replacement anymore
* Preserve MAC ctx between packets, saving 2xhash calls per-packet.djm2007-06-051-2/+2
| | | | | | | Yields around a 12-16% end-to-end speedup for arcfour256/hmac-md5 patch from markus@ tested dtucker@ and myself, ok markus@ and me (I'm committing at his request)
* tidy: KNF, ARGSUSED and u_intdjm2007-05-301-7/+12
|
* spacesstevesk2007-01-211-2/+2
|
* almost entirely get rid of the culture of ".h files that include .h files"deraadt2006-08-031-8/+6
| | | | | ok djm, sort of ok stevesk makes the pain stop in one easy step
* move #include <stdio.h> out of includes.hstevesk2006-08-011-1/+2
|
* move #include <stdlib.h> out of includes.hstevesk2006-07-261-1/+2
|
* move #include <sys/param.h> out of includes.hstevesk2006-07-261-1/+3
|
* move #include <string.h> out of includes.hstevesk2006-07-221-1/+3
|
* Put $OpenBSD$ tags back (as comments) to replace the RCSID()s thatdjm2006-03-251-0/+1
| | | | Theo nuked - our scripts to sync -portable need them in the files
* introduce xcalloc() and xasprintf() failure-checked allocations functionsdjm2006-03-251-5/+3
| | | | | | | | | | and use them throughout openssh xcalloc is particularly important because malloc(nmemb * size) is a dangerous idiom (subject to integer overflow) and it is time for it to die feedback and ok deraadt@
* spacingderaadt2006-03-201-1/+5
|
* spacingderaadt2006-03-191-1/+1
|
* RCSID() can diederaadt2006-03-191-1/+0
|
* Implement the diffie-hellman-group-exchange-sha256 key exchange methoddjm2006-03-071-1/+6
| | | | | using the SHA256 code in libc (and wrapper to make it into an OpenSSL EVP), interop tested against CVS PuTTY
* remove hardcoded hash lengths in key exchange code, allowingdjm2005-11-041-15/+21
| | | | | implementation of KEX methods with different hashes (e.g. SHA-256); ok markus@ dtucker@ stevesk@
* add a new compression method that delays compression until the usermarkus2005-07-251-4/+6
| | | | | | | | | has been authenticated successfully and set compression to 'delayed' for sshd. this breaks older openssh clients (< 3.5) if they insist on compression, so you have to re-enable compression in sshd_config. ok djm@
* knf says that a 2nd level indent is four (not three or five) spacesdjm2005-07-171-2/+2
|
* spacingdjm2005-07-161-2/+2
|
Copyright © 1996 – 2023 Jason A. Donenfeld. All Rights Reverse Engineered.