0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xC9, 0x0F, 0xDA, 0xA2,
0x21, 0x68, 0xC2, 0x34, 0xC4, 0xC6, 0x62, 0x8B, 0x80, 0xDC, 0x1C, 0xD1,
0x29, 0x02, 0x4E, 0x08, 0x8A, 0x67, 0xCC, 0x74, 0x02, 0x0B, 0xBE, 0xA6,
0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xC9, 0x0F, 0xDA, 0xA2,
0x21, 0x68, 0xC2, 0x34, 0xC4, 0xC6, 0x62, 0x8B, 0x80, 0xDC, 0x1C, 0xD1,
0x29, 0x02, 0x4E, 0x08, 0x8A, 0x67, 0xCC, 0x74, 0x02, 0x0B, 0xBE, 0xA6,
-static Bignum x, e, p, q, qmask, g;
-static int need_to_free_pg;
+struct dh_ctx {
+ Bignum x, e, p, q, qmask, g;
+};
-static void dh_init(void) {
- q = bignum_rshift(p, 1);
- qmask = bignum_bitmask(q);
+static void dh_init(struct dh_ctx *ctx)
+{
+ ctx->q = bignum_rshift(ctx->p, 1);
+ ctx->qmask = bignum_bitmask(ctx->q);
+ ctx->x = ctx->e = NULL;
-void dh_setup_group1(void) {
- p = bignum_from_bytes(P, sizeof(P));
- g = bignum_from_bytes(G, sizeof(G));
- dh_init();
+void *dh_setup_group1(void)
+{
+ struct dh_ctx *ctx = smalloc(sizeof(struct dh_ctx));
+ ctx->p = bignum_from_bytes(P, sizeof(P));
+ ctx->g = bignum_from_bytes(G, sizeof(G));
+ dh_init(ctx);
+ return ctx;
+ *
+ * If `nbits' is greater than zero, it is used as an upper limit
+ * for the number of bits in x. This is safe provided that (a) you
+ * use twice as many bits in x as the number of bits you expect to
+ * use in your session key, and (b) the DH group is a safe prime
+ * (which SSH demands that it must be).
+ *
+ * P. C. van Oorschot, M. J. Wiener
+ * "On Diffie-Hellman Key Agreement with Short Exponents".
+ * Advances in Cryptology: Proceedings of Eurocrypt '96
+ * Springer-Verlag, May 1996.
- if (x) freebn(x);
- ssh1_write_bignum(buf, qmask);
- for (i = 2; i < nbytes; i++)
- buf[i] &= random_byte();
- ssh1_read_bignum(buf, &x);
- } while (bignum_cmp(x, One) <= 0 || bignum_cmp(x, q) >= 0);
+ if (ctx->x)
+ freebn(ctx->x);
+ if (nbits == 0 || nbits > bignum_bitcount(ctx->qmask)) {
+ ssh1_write_bignum(buf, ctx->qmask);
+ for (i = 2; i < nbytes; i++)
+ buf[i] &= random_byte();
+ ssh1_read_bignum(buf, &ctx->x);
+ } else {
+ int b, nb;
+ ctx->x = bn_power_2(nbits);
+ b = nb = 0;
+ for (i = 0; i < nbits; i++) {
+ if (nb == 0) {
+ nb = 8;
+ b = random_byte();
+ }
+ bignum_set_bit(ctx->x, i, b & 1);
+ b >>= 1;
+ nb--;
+ }
+ }
+ } while (bignum_cmp(ctx->x, One) <= 0 || bignum_cmp(ctx->x, ctx->q) >= 0);
-Bignum dh_find_K(Bignum f) {
- return modpow(f, x, p);
+Bignum dh_find_K(void *handle, Bignum f)
+{
+ struct dh_ctx *ctx = (struct dh_ctx *)handle;
+ Bignum ret;
+ ret = modpow(f, ctx->x, ctx->p);
+ return ret;