#!/usr/bin/python # variant on group1 (see kex_group1.py) where the prime "p" and generator "g" # are provided by the server. a bit more work is required on our side (and a # LOT more on the server side). from message import Message from util import inflate_long, deflate_long, generate_prime, bit_length from paramiko import SSHException from transport import MSG_NEWKEYS from Crypto.Hash import SHA from Crypto.Util import number from logging import DEBUG MSG_KEXDH_GEX_GROUP, MSG_KEXDH_GEX_INIT, MSG_KEXDH_GEX_REPLY, MSG_KEXDH_GEX_REQUEST = range(31, 35) class KexGex(object): name = 'diffie-hellman-group-exchange-sha1' min_bits = 1024 max_bits = 8192 preferred_bits = 2048 def __init__(self, transport): self.transport = transport def start_kex(self): if self.transport.server_mode: self.transport.expected_packet = MSG_KEXDH_GEX_REQUEST return # request a bit range: we accept (min_bits) to (max_bits), but prefer # (preferred_bits). according to the spec, we shouldn't pull the # minimum up above 1024. m = Message() m.add_byte(chr(MSG_KEXDH_GEX_REQUEST)) m.add_int(self.min_bits) m.add_int(self.preferred_bits) m.add_int(self.max_bits) self.transport.send_message(m) self.transport.expected_packet = MSG_KEXDH_GEX_GROUP def parse_next(self, ptype, m): if ptype == MSG_KEXDH_GEX_REQUEST: return self.parse_kexdh_gex_request(m) elif ptype == MSG_KEXDH_GEX_GROUP: return self.parse_kexdh_gex_group(m) elif ptype == MSG_KEXDH_GEX_INIT: return self.parse_kexdh_gex_init(m) elif ptype == MSG_KEXDH_GEX_REPLY: return self.parse_kexdh_gex_reply(m) raise SSHException('KexGex asked to handle packet type %d' % ptype) def generate_x(self): # generate an "x" (1 < x < (p-1)/2). q = (self.p - 1) // 2 qnorm = deflate_long(q, 0) qhbyte = ord(qnorm[0]) bytes = len(qnorm) qmask = 0xff while not (qhbyte & 0x80): qhbyte <<= 1 qmask >>= 1 while 1: self.transport.randpool.stir() x_bytes = self.transport.randpool.get_bytes(bytes) x_bytes = chr(ord(x_bytes[0]) & qmask) + x_bytes[1:] x = inflate_long(x_bytes, 1) if (x > 1) and (x < q): break self.x = x def parse_kexdh_gex_request(self, m): min = m.get_int() preferred = m.get_int() max = m.get_int() # smoosh the user's preferred size into our own limits if preferred > self.max_bits: preferred = self.max_bits if preferred < self.min_bits: preferred = self.min_bits # now save a copy self.min_bits = min self.preferred_bits = preferred self.max_bits = max # generate prime while 1: # does not work FIXME # the problem is that it's too fscking SLOW self.transport.log(DEBUG, 'stir...') self.transport.randpool.stir() self.transport.log(DEBUG, 'get-prime %d...' % preferred) self.p = generate_prime(preferred, self.transport.randpool) self.transport.log(DEBUG, 'got ' + repr(self.p)) if number.isPrime((self.p - 1) // 2): break self.g = 2 m = Message() m.add_byte(chr(MSG_KEXDH_GEX_GROUP)) m.add_mpint(self.p) m.add_mpint(self.g) self.transport.send_message(m) self.transport.expected_packet = MSG_KEXDH_GEX_INIT def parse_kexdh_gex_group(self, m): self.p = m.get_mpint() self.g = m.get_mpint() # reject if p's bit length < 1024 or > 8192 bitlen = bit_length(self.p) if (bitlen < 1024) or (bitlen > 8192): raise SSHException('Server-generated gex p (don\'t ask) is out of range (%d bits)' % bitlen) self.transport.log(DEBUG, 'Got server p (%d bits)' % bitlen) self.generate_x() # now compute e = g^x mod p self.e = pow(self.g, self.x, self.p) m = Message() m.add_byte(chr(MSG_KEXDH_GEX_INIT)) m.add_mpint(self.e) self.transport.send_message(m) self.transport.expected_packet = MSG_KEXDH_GEX_REPLY def parse_kexdh_gex_init(self, m): self.e = m.get_mpint() if (self.e < 1) or (self.e > self.p - 1): raise SSHException('Client kex "e" is out of range') self.generate_x() K = pow(self.e, self.x, P) key = str(self.transport.get_server_key()) # okay, build up the hash H of (V_C || V_S || I_C || I_S || K_S || min || n || max || p || g || e || f || K) hm = Message().add(self.transport.remote_version).add(self.transport.local_version) hm.add(self.transport.remote_kex_init).add(self.transport.local_kex_init).add(key) hm.add_int(self.min_bits) hm.add_int(self.preferred_bits) hm.add_int(self.max_bits) hm.add_mpint(self.p) hm.add_mpint(self.g) hm.add(self.e).add(self.f).add(K) H = SHA.new(str(hm)).digest() self.transport.set_K_H(K, H) # sign it sig = self.transport.get_server_key().sign_ssh_data(self.transport.randpool, H) # send reply m = Message() m.add_byte(chr(MSG_KEXDH_GEX_REPLY)) m.add_string(key) m.add_mpint(self.f) m.add_string(sig) self.transport.send_message(m) self.transport.activate_outbound() self.transport.expected_packet = MSG_NEWKEYS def parse_kexdh_gex_reply(self, m): host_key = m.get_string() self.f = m.get_mpint() sig = m.get_string() if (self.f < 1) or (self.f > self.p - 1): raise SSHException('Server kex "f" is out of range') K = pow(self.f, self.x, self.p) # okay, build up the hash H of (V_C || V_S || I_C || I_S || K_S || min || n || max || p || g || e || f || K) hm = Message().add(self.transport.local_version).add(self.transport.remote_version) hm.add(self.transport.local_kex_init).add(self.transport.remote_kex_init).add(host_key) hm.add_int(self.min_bits) hm.add_int(self.preferred_bits) hm.add_int(self.max_bits) hm.add_mpint(self.p) hm.add_mpint(self.g) hm.add(self.e).add(self.f).add(K) self.transport.set_K_H(K, SHA.new(str(hm)).digest()) self.transport.verify_key(host_key, sig) self.transport.activate_outbound() self.transport.expected_packet = MSG_NEWKEYS