Merged SSH1 robustness changes from 0.55 release branch on to trunk.

[u/mdw/putty] / sshdh.c

diff --git a/sshdh.c b/sshdh.c
index f1d709f..af7eaf8 100644 (file)
--- a/sshdh.c
+++ b/sshdh.c
@@ -11,7 +11,7 @@ const struct ssh_kex ssh_diffiehellman_gex = {
 /*
  * The prime p used in the key exchange. 
  */
-static unsigned char P[] = {
+static const unsigned char P[] = {
     0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xC9, 0x0F, 0xDA, 0xA2,
     0x21, 0x68, 0xC2, 0x34, 0xC4, 0xC6, 0x62, 0x8B, 0x80, 0xDC, 0x1C, 0xD1,
     0x29, 0x02, 0x4E, 0x08, 0x8A, 0x67, 0xCC, 0x74, 0x02, 0x0B, 0xBE, 0xA6,
@@ -28,86 +28,135 @@ static unsigned char P[] = {
 /*
  * The generator g = 2.
  */
-static unsigned char G[] = { 2 };
+static const unsigned char G[] = { 2 };
 
 /*
  * Variables.
  */
-static Bignum x, e, p, q, qmask, g;
-static int need_to_free_pg;
+struct dh_ctx {
+    Bignum x, e, p, q, qmask, g;
+};
 
 /*
  * Common DH initialisation.
  */
-static void dh_init(void) {
-    q = bignum_rshift(p, 1);
-    qmask = bignum_bitmask(q);
+static void dh_init(struct dh_ctx *ctx)
+{
+    ctx->q = bignum_rshift(ctx->p, 1);
+    ctx->qmask = bignum_bitmask(ctx->q);
+    ctx->x = ctx->e = NULL;
 }
 
 /*
  * Initialise DH for the standard group1.
  */
-void dh_setup_group1(void) {
-    p = bignum_from_bytes(P, sizeof(P));
-    g = bignum_from_bytes(G, sizeof(G));
-    dh_init();
+void *dh_setup_group1(void)
+{
+    struct dh_ctx *ctx = snew(struct dh_ctx);
+    ctx->p = bignum_from_bytes(P, sizeof(P));
+    ctx->g = bignum_from_bytes(G, sizeof(G));
+    dh_init(ctx);
+    return ctx;
 }
 
 /*
  * Initialise DH for an alternative group.
  */
-void dh_setup_group(Bignum pval, Bignum gval) {
-    p = copybn(pval);
-    g = copybn(gval);
-    dh_init();
+void *dh_setup_group(Bignum pval, Bignum gval)
+{
+    struct dh_ctx *ctx = snew(struct dh_ctx);
+    ctx->p = copybn(pval);
+    ctx->g = copybn(gval);
+    dh_init(ctx);
+    return ctx;
 }
 
 /*
- * Clean up.
+ * Clean up and free a context.
  */
-void dh_cleanup(void) {
-    freebn(p);
-    freebn(g);
-    freebn(q);
-    freebn(qmask);
+void dh_cleanup(void *handle)
+{
+    struct dh_ctx *ctx = (struct dh_ctx *)handle;
+    freebn(ctx->x);
+    freebn(ctx->e);
+    freebn(ctx->p);
+    freebn(ctx->g);
+    freebn(ctx->q);
+    freebn(ctx->qmask);
+    sfree(ctx);
 }
 
 /*
  * DH stage 1: invent a number x between 1 and q, and compute e =
  * g^x mod p. Return e.
+ * 
+ * If `nbits' is greater than zero, it is used as an upper limit
+ * for the number of bits in x. This is safe provided that (a) you
+ * use twice as many bits in x as the number of bits you expect to
+ * use in your session key, and (b) the DH group is a safe prime
+ * (which SSH demands that it must be).
+ * 
+ * P. C. van Oorschot, M. J. Wiener
+ * "On Diffie-Hellman Key Agreement with Short Exponents".
+ * Advances in Cryptology: Proceedings of Eurocrypt '96
+ * Springer-Verlag, May 1996.
  */
-Bignum dh_create_e(void) {
+Bignum dh_create_e(void *handle, int nbits)
+{
+    struct dh_ctx *ctx = (struct dh_ctx *)handle;
     int i;
 
     int nbytes;
     unsigned char *buf;
 
-    nbytes = ssh1_bignum_length(qmask);
-    buf = smalloc(nbytes);
+    nbytes = ssh1_bignum_length(ctx->qmask);
+    buf = snewn(nbytes, unsigned char);
 
     do {
        /*
         * Create a potential x, by ANDing a string of random bytes
         * with qmask.
         */
-        if (x) freebn(x);
-        ssh1_write_bignum(buf, qmask);
-       for (i = 2; i < nbytes; i++)
-            buf[i] &= random_byte();
-        ssh1_read_bignum(buf, &x);
-    } while (bignum_cmp(x, One) <= 0 || bignum_cmp(x, q) >= 0);
+       if (ctx->x)
+           freebn(ctx->x);
+       if (nbits == 0 || nbits > bignum_bitcount(ctx->qmask)) {
+           ssh1_write_bignum(buf, ctx->qmask);
+           for (i = 2; i < nbytes; i++)
+               buf[i] &= random_byte();
+           ssh1_read_bignum(buf, nbytes, &ctx->x);   /* can't fail */
+       } else {
+           int b, nb;
+           ctx->x = bn_power_2(nbits);
+           b = nb = 0;
+           for (i = 0; i < nbits; i++) {
+               if (nb == 0) {
+                   nb = 8;
+                   b = random_byte();
+               }
+               bignum_set_bit(ctx->x, i, b & 1);
+               b >>= 1;
+               nb--;
+           }
+       }
+    } while (bignum_cmp(ctx->x, One) <= 0 || bignum_cmp(ctx->x, ctx->q) >= 0);
+
+    sfree(buf);
 
     /*
      * Done. Now compute e = g^x mod p.
      */
-    e = modpow(g, x, p);
+    ctx->e = modpow(ctx->g, ctx->x, ctx->p);
 
-    return e;
+    return ctx->e;
 }
 
 /*
  * DH stage 2: given a number f, compute K = f^x mod p.
  */
-Bignum dh_find_K(Bignum f) {
-    return modpow(f, x, p);
+Bignum dh_find_K(void *handle, Bignum f)
+{
+    struct dh_ctx *ctx = (struct dh_ctx *)handle;
+    Bignum ret;
+    ret = modpow(f, ctx->x, ctx->p);
+    return ret;
 }