Diffie-Hellman key exchange now uses a dynamically allocated context.

git-svn-id: svn://svn.tartarus.org/sgt/putty@2135 cda61777-01e9-0310-a592-d414129be87e

diff --git a/ssh.c b/ssh.c
index 677ff87..c936060 100644 (file)
--- a/ssh.c
+++ b/ssh.c
@@ -569,6 +569,7 @@ struct ssh_tag {
     const struct ssh_kex *kex;
     const struct ssh_signkey *hostkey;
     unsigned char v2_session_id[20];
+    void *kex_ctx;
 
     char *savedhost;
     int savedport;
@@ -3953,12 +3954,12 @@ static int do_ssh2_transport(Ssh ssh, unsigned char *in, int inlen, int ispkt)
        }
        s->p = ssh2_pkt_getmp(ssh);
        s->g = ssh2_pkt_getmp(ssh);
-       dh_setup_group(s->p, s->g);
+       ssh->kex_ctx = dh_setup_group(s->p, s->g);
        s->kex_init_value = SSH2_MSG_KEX_DH_GEX_INIT;
        s->kex_reply_value = SSH2_MSG_KEX_DH_GEX_REPLY;
     } else {
        ssh->pkt_ctx |= SSH2_PKTCTX_DHGROUP1;
-       dh_setup_group1();
+       ssh->kex_ctx = dh_setup_group1();
        s->kex_init_value = SSH2_MSG_KEXDH_INIT;
        s->kex_reply_value = SSH2_MSG_KEXDH_REPLY;
     }
@@ -3967,7 +3968,7 @@ static int do_ssh2_transport(Ssh ssh, unsigned char *in, int inlen, int ispkt)
     /*
      * Now generate and send e for Diffie-Hellman.
      */
-    s->e = dh_create_e(s->nbits * 2);
+    s->e = dh_create_e(ssh->kex_ctx, s->nbits * 2);
     ssh2_pkt_init(ssh, s->kex_init_value);
     ssh2_pkt_addmp(ssh, s->e);
     ssh2_pkt_send(ssh);
@@ -3981,7 +3982,7 @@ static int do_ssh2_transport(Ssh ssh, unsigned char *in, int inlen, int ispkt)
     s->f = ssh2_pkt_getmp(ssh);
     ssh2_pkt_getstring(ssh, &s->sigdata, &s->siglen);
 
-    s->K = dh_find_K(s->f);
+    s->K = dh_find_K(ssh->kex_ctx, s->f);
 
     sha_string(&ssh->exhash, s->hostkeydata, s->hostkeylen);
     if (ssh->kex == &ssh_diffiehellman_gex) {
@@ -3994,7 +3995,7 @@ static int do_ssh2_transport(Ssh ssh, unsigned char *in, int inlen, int ispkt)
     sha_mpint(&ssh->exhash, s->K);
     SHA_Final(&ssh->exhash, s->exchange_hash);
 
-    dh_cleanup();
+    dh_cleanup(ssh->kex_ctx);
 
 #if 0
     debug(("Exchange hash is:\n"));

diff --git a/ssh.h b/ssh.h
index bf57b8f..9f9f1e6 100644 (file)
--- a/ssh.h
+++ b/ssh.h
@@ -261,8 +261,8 @@ Bignum modpow(Bignum base, Bignum exp, Bignum mod);
 Bignum modmul(Bignum a, Bignum b, Bignum mod);
 void decbn(Bignum n);
 extern Bignum Zero, One;
-Bignum bignum_from_bytes(unsigned char *data, int nbytes);
-int ssh1_read_bignum(unsigned char *data, Bignum * result);
+Bignum bignum_from_bytes(const unsigned char *data, int nbytes);
+int ssh1_read_bignum(const unsigned char *data, Bignum * result);
 int bignum_bitcount(Bignum bn);
 int ssh1_bignum_length(Bignum bn);
 int ssh2_bignum_length(Bignum bn);
@@ -283,11 +283,11 @@ Bignum bignum_rshift(Bignum number, int shift);
 int bignum_cmp(Bignum a, Bignum b);
 char *bignum_decimal(Bignum x);
 
-void dh_setup_group1(void);
-void dh_setup_group(Bignum pval, Bignum gval);
-void dh_cleanup(void);
-Bignum dh_create_e(int nbits);
-Bignum dh_find_K(Bignum f);
+void *dh_setup_group1(void);
+void *dh_setup_group(Bignum pval, Bignum gval);
+void dh_cleanup(void *);
+Bignum dh_create_e(void *, int nbits);
+Bignum dh_find_K(void *, Bignum f);
 
 int loadrsakey(char *filename, struct RSAKey *key, char *passphrase);
 int rsakey_encrypted(char *filename, char **comment);

diff --git a/sshbn.c b/sshbn.c
index 40f9560..8246e25 100644 (file)
--- a/sshbn.c
+++ b/sshbn.c
@@ -482,7 +482,7 @@ void decbn(Bignum bn)
     bn[i]--;
 }
 
-Bignum bignum_from_bytes(unsigned char *data, int nbytes)
+Bignum bignum_from_bytes(const unsigned char *data, int nbytes)
 {
     Bignum result;
     int w, i;
@@ -509,9 +509,9 @@ Bignum bignum_from_bytes(unsigned char *data, int nbytes)
  * Read an ssh1-format bignum from a data buffer. Return the number
  * of bytes consumed.
  */
-int ssh1_read_bignum(unsigned char *data, Bignum * result)
+int ssh1_read_bignum(const unsigned char *data, Bignum * result)
 {
-    unsigned char *p = data;
+    const unsigned char *p = data;
     int i;
     int w, b;
 

diff --git a/sshdh.c b/sshdh.c
index 7a1772b..2e16bbe 100644 (file)
--- a/sshdh.c
+++ b/sshdh.c
@@ -11,7 +11,7 @@ const struct ssh_kex ssh_diffiehellman_gex = {
 /*
  * The prime p used in the key exchange. 
  */
-static unsigned char P[] = {
+static const unsigned char P[] = {
     0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xC9, 0x0F, 0xDA, 0xA2,
     0x21, 0x68, 0xC2, 0x34, 0xC4, 0xC6, 0x62, 0x8B, 0x80, 0xDC, 0x1C, 0xD1,
     0x29, 0x02, 0x4E, 0x08, 0x8A, 0x67, 0xCC, 0x74, 0x02, 0x0B, 0xBE, 0xA6,
@@ -28,51 +28,62 @@ static unsigned char P[] = {
 /*
  * The generator g = 2.
  */
-static unsigned char G[] = { 2 };
+static const unsigned char G[] = { 2 };
 
 /*
  * Variables.
  */
-static Bignum x, e, p, q, qmask, g;
+struct dh_ctx {
+    Bignum x, e, p, q, qmask, g;
+};
 
 /*
  * Common DH initialisation.
  */
-static void dh_init(void)
+static void dh_init(struct dh_ctx *ctx)
 {
-    q = bignum_rshift(p, 1);
-    qmask = bignum_bitmask(q);
+    ctx->q = bignum_rshift(ctx->p, 1);
+    ctx->qmask = bignum_bitmask(ctx->q);
+    ctx->x = ctx->e = NULL;
 }
 
 /*
  * Initialise DH for the standard group1.
  */
-void dh_setup_group1(void)
+void *dh_setup_group1(void)
 {
-    p = bignum_from_bytes(P, sizeof(P));
-    g = bignum_from_bytes(G, sizeof(G));
-    dh_init();
+    struct dh_ctx *ctx = smalloc(sizeof(struct dh_ctx));
+    ctx->p = bignum_from_bytes(P, sizeof(P));
+    ctx->g = bignum_from_bytes(G, sizeof(G));
+    dh_init(ctx);
+    return ctx;
 }
 
 /*
  * Initialise DH for an alternative group.
  */
-void dh_setup_group(Bignum pval, Bignum gval)
+void *dh_setup_group(Bignum pval, Bignum gval)
 {
-    p = copybn(pval);
-    g = copybn(gval);
-    dh_init();
+    struct dh_ctx *ctx = smalloc(sizeof(struct dh_ctx));
+    ctx->p = copybn(pval);
+    ctx->g = copybn(gval);
+    dh_init(ctx);
+    return ctx;
 }
 
 /*
- * Clean up.
+ * Clean up and free a context.
  */
-void dh_cleanup(void)
+void dh_cleanup(void *handle)
 {
-    freebn(p);
-    freebn(g);
-    freebn(q);
-    freebn(qmask);
+    struct dh_ctx *ctx = (struct dh_ctx *)handle;
+    freebn(ctx->x);
+    freebn(ctx->e);
+    freebn(ctx->p);
+    freebn(ctx->g);
+    freebn(ctx->q);
+    freebn(ctx->qmask);
+    sfree(ctx);
 }
 
 /*
@@ -90,14 +101,15 @@ void dh_cleanup(void)
  * Advances in Cryptology: Proceedings of Eurocrypt '96
  * Springer-Verlag, May 1996.
  */
-Bignum dh_create_e(int nbits)
+Bignum dh_create_e(void *handle, int nbits)
 {
+    struct dh_ctx *ctx = (struct dh_ctx *)handle;
     int i;
 
     int nbytes;
     unsigned char *buf;
 
-    nbytes = ssh1_bignum_length(qmask);
+    nbytes = ssh1_bignum_length(ctx->qmask);
     buf = smalloc(nbytes);
 
     do {
@@ -105,43 +117,44 @@ Bignum dh_create_e(int nbits)
         * Create a potential x, by ANDing a string of random bytes
         * with qmask.
         */
-       if (x)
-           freebn(x);
-       if (nbits == 0 || nbits > bignum_bitcount(qmask)) {
-           ssh1_write_bignum(buf, qmask);
+       if (ctx->x)
+           freebn(ctx->x);
+       if (nbits == 0 || nbits > bignum_bitcount(ctx->qmask)) {
+           ssh1_write_bignum(buf, ctx->qmask);
            for (i = 2; i < nbytes; i++)
                buf[i] &= random_byte();
-           ssh1_read_bignum(buf, &x);
+           ssh1_read_bignum(buf, &ctx->x);
        } else {
            int b, nb;
-           x = bn_power_2(nbits);
+           ctx->x = bn_power_2(nbits);
            b = nb = 0;
            for (i = 0; i < nbits; i++) {
                if (nb == 0) {
                    nb = 8;
                    b = random_byte();
                }
-               bignum_set_bit(x, i, b & 1);
+               bignum_set_bit(ctx->x, i, b & 1);
                b >>= 1;
                nb--;
            }
        }
-    } while (bignum_cmp(x, One) <= 0 || bignum_cmp(x, q) >= 0);
+    } while (bignum_cmp(ctx->x, One) <= 0 || bignum_cmp(ctx->x, ctx->q) >= 0);
 
     /*
      * Done. Now compute e = g^x mod p.
      */
-    e = modpow(g, x, p);
+    ctx->e = modpow(ctx->g, ctx->x, ctx->p);
 
-    return e;
+    return ctx->e;
 }
 
 /*
  * DH stage 2: given a number f, compute K = f^x mod p.
  */
-Bignum dh_find_K(Bignum f)
+Bignum dh_find_K(void *handle, Bignum f)
 {
+    struct dh_ctx *ctx = (struct dh_ctx *)handle;
     Bignum ret;
-    ret = modpow(f, x, p);
+    ret = modpow(f, ctx->x, ctx->p);
     return ret;
 }