Subversion Repositories Kolibri OS

Rev

Rev 9070 | Rev 9216 | Go to most recent revision | Show entire file | Regard whitespace | Details | Blame | Last modification | View Log | RSS feed

Rev 9070 Rev 9106
Line 1... Line 1...
1 
;    dh_gex.inc - Diffie Hellman Group exchange
 1 
;    sshlib_dh_gex.inc - Diffie Hellman Group exchange
2 
;
 2 
;
3 
;    Copyright (C) 2015-2021 Jeffrey Amelynck
 3 
;    Copyright (C) 2015-2021 Jeffrey Amelynck
4 
;
 4 
;
5 
;    This program is free software: you can redistribute it and/or modify
 5 
;    This program is free software: you can redistribute it and/or modify
6 
;    it under the terms of the GNU General Public License as published by
 6 
;    it under the terms of the GNU General Public License as published by
Line 15... Line 15...
15 
;    You should have received a copy of the GNU General Public License
 15 
;    You should have received a copy of the GNU General Public License
16 
;    along with this program.  If not, see .
 16 
;    along with this program.  If not, see .
Line 17... Line 17...
17 
 
 17 
 
Line 18... Line -...
18 
; https://www.ietf.org/rfc/rfc4419.txt
 - 
 
19 
 
 - 
 
20 
; TODO: dont convert mpints to little endian immediately.
 - 
 
21 
; Or maybe even better, not at all.
 18 
; https://www.ietf.org/rfc/rfc4419.txt
Line 22... Line 19...
22 
 
 19 
 
- 
 
 20 
proc sshlib_dh_gex con_ptr
- 
 
 21 
 
- 
 
 22 
locals
- 
 
 23 
 
- 
 
 24 
        mpint_tmp               dd ?
- 
 
 25 
 
- 
 
 26 
        mpint_p                 dd ?
- 
 
 27 
        mpint_g                 dd ?
23 
proc dh_gex
 28 
        mpint_x                 dd ?
- 
 
 29 
        mpint_e                 dd ?
- 
 
 30 
        mpint_f                 dd ?
- 
 
 31 
        mpint_K_big             dd ?
- 
 
 32 
 
- 
 
 33 
        k_h_ctx                 dd ?
- 
 
 34 
        temp_ctx                dd ?
- 
 
 35 
 
- 
 
 36 
        H                       dd ?    ; exchange hash
- 
 
 37 
 
- 
 
 38 
        rx_iv                   dd ?    ; Rx initialisation vector
- 
 
 39 
        tx_iv                   dd ?    ; Tx initialisation vector
- 
 
 40 
        rx_enc_key              dd ?    ; Rx encryption key
- 
 
 41 
        tx_enc_key              dd ?    ; Tx encryption key
- 
 
 42 
        rx_int_key              dd ?    ; Rx integrity key
- 
 
 43 
        tx_int_key              dd ?    ; Tx integrity key
- 
 
 44 
 
- 
 
 45 
        K_length                dd ?
- 
 
 46 
 
- 
 
 47 
        session_id_x            rb SHA256_HASH_SIZE+1
- 
 
 48 
 
- 
 
 49 
        str_K_S                 dd ?    ; server public host key and certificates (K_S)
24 
 
 50 
        mpint_f_big             dd ?    ; pointer to original
Line -... Line 51...
- 
 
 51 
        str_s_of_H              dd ?    ; signature of H
- 
 
 52 
 
- 
 
 53 
endl
- 
 
 54 
 
- 
 
 55 
; Allocate memory for temp variables
- 
 
 56 
 
- 
 
 57 
        mov     ecx, 7*(MAX_BITS/8+4) + 7*SHA256_HASH_SIZE + 2*sizeof.crash_ctx
- 
 
 58 
        mcall   68, 12
- 
 
 59 
        test    eax, eax
- 
 
 60 
        jz      .err_nomem
- 
 
 61 
 
- 
 
 62 
; Init pointers for temp variables
- 
 
 63 
 
- 
 
 64 
        mov     [mpint_tmp], eax
- 
 
 65 
        add     eax, (MAX_BITS/8+4)
- 
 
 66 
        mov     [mpint_p], eax
- 
 
 67 
        add     eax, (MAX_BITS/8+4)
- 
 
 68 
        mov     [mpint_g], eax
- 
 
 69 
        add     eax, (MAX_BITS/8+4)
- 
 
 70 
        mov     [mpint_x], eax
- 
 
 71 
        add     eax, (MAX_BITS/8+4)
- 
 
 72 
        mov     [mpint_e], eax
- 
 
 73 
        add     eax, (MAX_BITS/8+4)
- 
 
 74 
        mov     [mpint_f], eax
- 
 
 75 
        add     eax, (MAX_BITS/8+4)
- 
 
 76 
        mov     [mpint_K_big], eax
- 
 
 77 
        add     eax, (MAX_BITS/8+4)
- 
 
 78 
 
- 
 
 79 
        mov     [k_h_ctx], eax
- 
 
 80 
        add     eax, sizeof.crash_ctx
- 
 
 81 
        mov     [temp_ctx], eax
- 
 
 82 
        add     eax, sizeof.crash_ctx
- 
 
 83 
 
- 
 
 84 
        mov     [H], eax
- 
 
 85 
        add     eax, SHA256_HASH_SIZE
- 
 
 86 
        mov     [rx_iv], eax
- 
 
 87 
        add     eax, SHA256_HASH_SIZE
- 
 
 88 
        mov     [tx_iv], eax
- 
 
 89 
        add     eax, SHA256_HASH_SIZE
- 
 
 90 
        mov     [rx_enc_key], eax
- 
 
 91 
        add     eax, SHA256_HASH_SIZE
- 
 
 92 
        mov     [tx_enc_key], eax
- 
 
 93 
        add     eax, SHA256_HASH_SIZE
- 
 
 94 
        mov     [rx_int_key], eax
- 
 
 95 
        add     eax, SHA256_HASH_SIZE
- 
 
 96 
        mov     [tx_int_key], eax
- 
 
 97 
;        add     eax, SHA256_HASH_SIZE
- 
 
 98 
 
- 
 
 99 
; Copy the partial exchange hash to our temporary one
- 
 
 100 
 
- 
 
 101 
        mov     esi, [con_ptr]
- 
 
 102 
        lea     esi, [esi+sshlib_connection.part_ex_hash_ctx]
25 
locals
 103 
        mov     edi, [temp_ctx]
26 
        dh_f_big        dd ?
 104 
        mov     ecx, sizeof.crash_ctx/4
Line 27... Line 105...
27 
endl
 105 
        rep movsd
28 
 
 106 
 
29 
;----------------------------------------------
 107 
;----------------------------------------------
30 
; >> Send Diffie-Hellman Group Exchange Request
 108 
; >> Send Diffie-Hellman Group Exchange Request
Line 31... Line 109...
31 
 
 109 
 
32 
        DEBUGF  2, "Sending GEX\n"
 110 
        DEBUGF  2, "Sending GEX\n"
Line 33... Line 111...
33 
        stdcall ssh_send_packet, con, ssh_gex_req, ssh_gex_req.length, 0
 111 
        stdcall sshlib_send_packet, [con_ptr], ssh_msg_gex_req, ssh_msg_gex_req.length, 0
34 
        cmp     eax, -1
 112 
        cmp     eax, 0
35 
        je      .socket_err
 113 
        jl      .err
36 
 
 114 
 
- 
 
 115 
;---------------------------------------------
37 
;---------------------------------------------
 116 
; << Parse Diffie-Hellman Group Exchange Group
38 
; << Parse Diffie-Hellman Group Exchange Group
 117 
 
39 
 
 118 
        stdcall sshlib_recv_packet, [con_ptr], 0
Line 40... Line 119...
40 
        stdcall ssh_recv_packet, con, 0
 119 
        cmp     eax, 0
41 
        cmp     eax, -1
 - 
 
42 
        je      .socket_err
 120 
        jl      .err
43 
 
 121 
 
44 
        cmp     [con.rx_buffer.message_code], SSH_MSG_KEX_DH_GEX_GROUP
 122 
        mov     ebx, [con_ptr]
45 
        jne     proto_err
 123 
        cmp     [ebx + sshlib_connection.rx_buffer.message_code], SSH_MSG_KEX_DH_GEX_GROUP
Line 46... Line -...
46 
        DEBUGF  2, "Received GEX group\n"
 - 
 
47 
 
 124 
        jne     .err_proto
48 
        mov     esi, con.rx_buffer+sizeof.ssh_packet_header
 125 
        DEBUGF  2, "Received GEX group\n"
49 
        DEBUGF  1, "DH modulus (p): "
 126 
 
50 
        stdcall mpint_to_little_endian, con.dh_p, esi
 127 
        lea     esi, [ebx + sshlib_connection.rx_buffer + sizeof.ssh_packet_header]
Line 51... Line 128...
51 
        add     esi, 4
 128 
        stdcall mpint_to_little_endian, [mpint_p], esi
52 
        add     esi, eax
 129 
        add     esi, 4
Line 53... Line 130...
53 
        stdcall mpint_print, con.dh_p
 130 
        add     esi, eax
54 
 
 131 
        DEBUGM  1, "DH modulus (p): ", [mpint_p]
55 
        DEBUGF  1, "DH base (g): "
 132 
 
- 
 
 133 
        stdcall mpint_to_little_endian, [mpint_g], esi
56 
        stdcall mpint_to_little_endian, con.dh_g, esi
 134 
        add     esi, 4
57 
        add     esi, 4
 135 
        add     esi, eax
58 
        add     esi, eax
 136 
        DEBUGM  1, "DH base (g): ", [mpint_g]
59 
        stdcall mpint_print, con.dh_g
 137 
 
60 
 
 138 
;-------------------------------------------
Line 75... Line 153...
75 
 
 153 
 
76 
; If the highest bit is set, add a zero byte
 154 
; If the highest bit is set, add a zero byte
77 
        shl     eax, 1
 155 
        shl     eax, 1
78 
        jnc     @f
 156 
        jnc     @f
- 
 
 157 
        mov     byte[edi], 0
79 
        mov     byte[edi], 0
 158 
        mov     eax, [mpint_x]
80 
        inc     dword[con.dh_x]
 159 
        inc     dword[eax]
81 
  @@:
 - 
 
82 
 
 160 
  @@:
83 
        DEBUGF  1, "DH x: "
 - 
 
Line 84... Line 161...
84 
        stdcall mpint_print, con.dh_x
 161 
        DEBUGM  1, "DH private key (x): ", [mpint_x]
85 
 
 162 
 
86 
; Compute e = g^x mod p
 163 
; Compute e = g^x mod p
87 
        stdcall mpint_modexp, con.dh_e, con.dh_g, con.dh_x, con.dh_p
 - 
 
88 
        stdcall mpint_shrink, con.dh_e
 164 
        stdcall mpint_modexp, [mpint_e], [mpint_g], [mpint_x], [mpint_p]
89 
 
 - 
 
Line 90... Line 165...
90 
        DEBUGF  1, "DH e: "
 165 
        stdcall mpint_shrink, [mpint_e]
91 
        stdcall mpint_print, con.dh_e
 166 
        DEBUGM  1, "DH public key (e): ", [mpint_e]
92 
 
 167 
 
93 
; Create group exchange init packet
 - 
 
94 
        mov     edi, con.tx_buffer.message_code
 168 
; Create group exchange init packet
Line 95... Line 169...
95 
        mov     al, SSH_MSG_KEX_DH_GEX_INIT
 169 
        mov     byte[ebx + sshlib_connection.tx_buffer.message_code], SSH_MSG_KEX_DH_GEX_INIT
96 
        stosb
 170 
        lea     edi, [ebx + sshlib_connection.tx_buffer.message_code+1]
97 
        stdcall mpint_to_big_endian, edi, con.dh_e
 171 
        stdcall mpint_to_big_endian, edi, [mpint_e]
98 
 
 172 
 
- 
 
 173 
        DEBUGF  2, "Sending GEX init\n"
99 
        DEBUGF  2, "Sending GEX init\n"
 174 
        mov     ecx, dword[ebx + sshlib_connection.tx_buffer.message_code+1]         ;;;; dword[edi]
100 
        mov     ecx, dword[con.tx_buffer.message_code+1]
 175 
        bswap   ecx
101 
        bswap   ecx
 176 
        add     ecx, 5
Line 102... Line 177...
102 
        add     ecx, 5
 177 
        lea     esi, [ebx + sshlib_connection.tx_buffer.message_code]
103 
        stdcall ssh_send_packet, con, con.tx_buffer.message_code, ecx, 0
 178 
        stdcall sshlib_send_packet, [con_ptr], esi, ecx, 0
Line 104... Line 179...
104 
        cmp     eax, -1
 179 
        cmp     eax, 0
105 
        je      .socket_err
 180 
        jl      .err
106 
 
 181 
 
107 
;---------------------------------------------
 182 
;---------------------------------------------
- 
 
 183 
; << Parse Diffie-Hellman Group Exchange Reply
108 
; << Parse Diffie-Hellman Group Exchange Reply
 184 
 
109 
 
 185 
        stdcall sshlib_recv_packet, [con_ptr], 0
Line 110... Line 186...
110 
        stdcall ssh_recv_packet, con, 0
 186 
        cmp     eax, 0
Line 111... Line 187...
111 
        cmp     eax, -1
 187 
        jl      .err
112 
        je      .socket_err
 188 
 
113 
 
 189 
        mov     ebx, [con_ptr]
- 
 
 190 
        cmp     [ebx + sshlib_connection.rx_buffer.message_code], SSH_MSG_KEX_DH_GEX_REPLY
114 
        cmp     [con.rx_buffer.message_code], SSH_MSG_KEX_DH_GEX_REPLY
 191 
        jne     .err_proto
115 
        jne     .proto_err
 192 
 
116 
 
 193 
        DEBUGF  2, "Received GEX Reply\n"
117 
        DEBUGF  2, "Received GEX Reply\n"
 194 
 
118 
 
 195 
;--------------------------------
119 
;--------------------------------
 196 
; HASH: string K_S, the host key
Line 120... Line 197...
120 
; HASH: string K_S, the host key
 197 
        lea     esi, [ebx + sshlib_connection.rx_buffer + sizeof.ssh_packet_header]
121 
        mov     esi, con.rx_buffer+sizeof.ssh_packet_header
 198 
        mov     [str_K_S], esi
122 
        mov     edx, [esi]
 199 
        mov     edx, [esi]
123 
        bswap   edx
 200 
        bswap   edx
124 
        add     edx, 4
 201 
        add     edx, 4
Line 125... Line 202...
125 
        lea     ebx, [esi+edx]
 202 
        lea     eax, [esi+edx]
126 
        mov     [dh_f_big], ebx
 203 
        mov     [mpint_f_big], eax
127 
        invoke  sha256_update, con.temp_ctx, esi, edx
 204 
        invoke  sha256_update, [temp_ctx], esi, edx
128 
 
 205 
 
129 
;--------------------------------------------------------------------------
 206 
;--------------------------------------------------------------------------
130 
; HASH: uint32 min, minimal size in bits of an acceptable group
 207 
; HASH: uint32 min, minimal size in bits of an acceptable group
Line 131... Line 208...
131 
;       uint32 n, preferred size in bits of the group the server will send
 208 
;       uint32 n, preferred size in bits of the group the server will send
132 
;       uint32 max, maximal size in bits of an acceptable group
 209 
;       uint32 max, maximal size in bits of an acceptable group
133 
        invoke  sha256_update, con.temp_ctx, ssh_gex_req+sizeof.ssh_packet_header-ssh_packet_header.message_code, 12
 210 
        invoke  sha256_update, [temp_ctx], ssh_msg_gex_req+sizeof.ssh_packet_header-ssh_packet_header.message_code, 12
134 
 
 211 
 
135 
;----------------------------
 212 
;----------------------------
136 
; HASH: mpint p, safe prime
 213 
; HASH: mpint p, safe prime
Line 137... Line 214...
137 
        stdcall mpint_shrink, con.dh_p
 214 
        stdcall mpint_shrink, [mpint_p]
138 
        stdcall mpint_to_big_endian, con.mpint_tmp, con.dh_p
 215 
        stdcall mpint_to_big_endian, [mpint_tmp], [mpint_p]
- 
 
 216 
        add     eax, 4
139 
        lea     edx, [eax+4]
 217 
        invoke  sha256_update, [temp_ctx], [mpint_tmp], eax
140 
        invoke  sha256_update, con.temp_ctx, con.mpint_tmp, edx
 218 
 
141 
 
 219 
;----------------------------------------
142 
;----------------------------------------
 220 
; HASH: mpint g, generator for subgroup
143 
; HASH: mpint g, generator for subgroup
 221 
        stdcall mpint_shrink, [mpint_g]
Line 144... Line 222...
144 
        stdcall mpint_shrink, con.dh_g
 222 
        stdcall mpint_to_big_endian, [mpint_tmp], [mpint_g]
145 
        stdcall mpint_to_big_endian, con.mpint_tmp, con.dh_g
 223 
        add     eax, 4
146 
        lea     edx, [eax+4]
 224 
        invoke  sha256_update, [temp_ctx], [mpint_tmp], eax
147 
        invoke  sha256_update, con.temp_ctx, con.mpint_tmp, edx
 225 
 
148 
 
 226 
;---------------------------------------------------
149 
;---------------------------------------------------
 227 
; HASH: mpint e, exchange value sent by the client
150 
; HASH: mpint e, exchange value sent by the client
 228 
        mov     ebx, [con_ptr]
Line 151... Line 229...
151 
        mov     esi, con.tx_buffer+sizeof.ssh_packet_header
 229 
        lea     esi, [ebx + sshlib_connection.tx_buffer + sizeof.ssh_packet_header]
152 
        mov     edx, [esi]
 230 
        mov     edx, [esi]
153 
        bswap   edx
 231 
        bswap   edx
154 
        add     edx, 4
 232 
        add     edx, 4
155 
        invoke  sha256_update, con.temp_ctx, esi, edx
 233 
        invoke  sha256_update, [temp_ctx], esi, edx
156 
 
 - 
 
157 
;---------------------------------------------------
 - 
 
158 
; HASH: mpint f, exchange value sent by the server
 - 
 
159 
        mov     esi, [dh_f_big]
 234 
 
160 
        mov     edx, [esi]
 - 
 
Line 161... Line 235...
161 
        bswap   edx
 235 
;---------------------------------------------------
162 
        add     edx, 4
 236 
; HASH: mpint f, exchange value sent by the server
163 
        invoke  sha256_update, con.temp_ctx, esi, edx
 237 
        mov     esi, [mpint_f_big]
164 
 
 238 
        mov     edx, [esi]
165 
        stdcall mpint_to_little_endian, con.dh_f, [dh_f_big]
 - 
 
166 
        mov     esi, [dh_f_big]
 239 
        bswap   edx
167 
        add     esi, eax
 - 
 
Line 168... Line 240...
168 
        add     esi, 4
 240 
        add     edx, 4
169 
        DEBUGF  1, "DH f: "
 241 
        invoke  sha256_update, [temp_ctx], esi, edx
170 
        stdcall mpint_print, con.dh_f
 242 
 
Line 171... Line 243...
171 
 
 243 
        stdcall mpint_to_little_endian, [mpint_f], [mpint_f_big]
172 
        stdcall mpint_to_little_endian, con.dh_signature, esi
 244 
        mov     esi, [mpint_f_big]
173 
        DEBUGF  1, "DH signature: "
 - 
 
174 
        stdcall mpint_print, con.dh_signature
 245 
        add     esi, eax
175 
 
 246 
        add     esi, 4
Line 176... Line 247...
176 
;--------------------------------------
 247 
        mov     [str_s_of_H], esi
177 
; Calculate shared secret K = f^x mod p
 248 
        DEBUGM  1, "DH exchange value (f): ", [mpint_f]
178 
        stdcall mpint_modexp, con.rx_buffer, con.dh_f, con.dh_x, con.dh_p
 249 
 
179 
        stdcall mpint_shrink, con.rx_buffer
 250 
;--------------------------------------
- 
 
 251 
; Calculate shared secret K = f^x mod p
180 
 
 252 
        stdcall mpint_modexp, [mpint_tmp], [mpint_f], [mpint_x], [mpint_p]
181 
        DEBUGF  1, "DH K: "
 253 
        stdcall mpint_shrink, [mpint_tmp]
182 
        stdcall mpint_print, con.rx_buffer
 254 
        DEBUGM  1, "DH shared secret (K): ", [mpint_tmp]
Line 183... Line 255...
183 
 
 255 
 
184 
; We always need it in big endian order, so store it as such.
 256 
; We always need it in big endian order, so store it as such.
- 
 
 257 
        stdcall mpint_to_big_endian, [mpint_K_big], [mpint_tmp]
- 
 
 258 
        mov     [K_length], eax
- 
 
 259 
 
Line -... Line 260...
- 
 
 260 
;-----------------------------------
- 
 
 261 
; HASH: mpint K, the shared secret
- 
 
 262 
        add     eax, 4
- 
 
 263 
        invoke  sha256_update, [temp_ctx], [mpint_K_big], eax
185 
        stdcall mpint_to_big_endian, con.dh_K, con.rx_buffer
 264 
 
- 
 
 265 
;-------------------------------
- 
 
 266 
; Finalize the exchange hash (H)
- 
 
 267 
        invoke  sha256_final, [temp_ctx]
- 
 
 268 
        mov     esi, [temp_ctx]
186 
        mov     [con.dh_K_length], eax
 269 
        add     esi, crash_ctx.hash
- 
 
 270 
        mov     edi, [H]
- 
 
 271 
        mov     ecx, SHA256_HASH_SIZE/4
- 
 
 272 
        rep movsd
- 
 
 273 
 
- 
 
 274 
        DEBUGF  1, "Exchange hash H: "
- 
 
 275 
        stdcall dump_hex, [H], SHA256_HASH_SIZE/4
- 
 
 276 
 
187 
 
 277 
;--------------------------
188 
;-----------------------------------
 278 
; Set or get the session id
189 
; HASH: mpint K, the shared secret
 279 
 
Line -... Line 280...
- 
 
 280 
        mov     eax, [con_ptr]
190 
        mov     edx, [con.dh_K_length]
 281 
        cmp     [eax + sshlib_connection.status], SSHLIB_CON_STAT_KEX_DONE
191 
        add     edx, 4
 282 
        jae     @f
Line 192... Line 283...
192 
        invoke  sha256_update, con.temp_ctx, con.dh_K, edx
 283 
 
Line 193... Line 284...
193 
 
 284 
; If first KEX, verify host public key
Line 194... Line 285...
194 
;-------------------------------
 285 
        stdcall sshlib_host_verify, [con_ptr], [str_K_S], [str_s_of_H], [H], SHA256_HASH_SIZE
195 
; Finalize the exchange hash (H)
 286 
        test    eax, eax
196 
        invoke  sha256_final, con.temp_ctx
 287 
        jnz     .err
197 
        mov     esi, con.temp_ctx.hash
 288 
 
Line 198... Line 289...
198 
        mov     edi, con.dh_H
 289 
        mov     eax, [con_ptr]
199 
        mov     ecx, SHA256_HASH_SIZE/4
 290 
        mov     esi, [H]
Line 200... Line 291...
200 
        rep movsd
 291 
        lea     edi, [eax + sshlib_connection.session_id]
201 
 
 292 
        mov     ecx, SHA256_HASH_SIZE/4
202 
        DEBUGF  1, "Exchange hash H: "
 293 
        rep movsd
203 
        stdcall dump_hex, con.dh_H, 8
 294 
  @@:
204 
 
 295 
 
- 
 
 296 
        lea     esi, [eax + sshlib_connection.session_id]
205 
; TODO: skip this block when re-keying
 297 
        lea     edi, [session_id_x+1]
206 
        mov     esi, con.dh_H
 298 
        mov     ecx, SHA256_HASH_SIZE/4
207 
        mov     edi, con.session_id
 299 
        rep movsd
208 
        mov     ecx, SHA256_HASH_SIZE/4
 300 
 
209 
        rep movsd
 301 
 
210 
 
 302 
;---------------
Line 211... Line 303...
211 
;---------------
 303 
; Calculate keys
212 
; Calculate keys
 304 
 
Line 213... Line 305...
213 
 
 305 
; First, calculate partial hash of K and H so we can re-use it for every key.
214 
; First, calculate partial hash of K and H so we can re-use it for every key.
 306 
 
Line 215... Line 307...
215 
 
 307 
        invoke  sha256_init, [k_h_ctx]
216 
        invoke  sha256_init, con.k_h_ctx
 308 
 
217 
 
 309 
        mov     ecx, [K_length]
218 
        mov     edx, [con.dh_K_length]
 310 
        add     ecx, 4
219 
        add     edx, 4
 311 
        invoke  sha256_update, [k_h_ctx], [mpint_K_big], ecx
- 
 
 312 
        invoke  sha256_update, [k_h_ctx], [H], SHA256_HASH_SIZE
220 
        invoke  sha256_update, con.k_h_ctx, con.dh_K, edx
 313 
 
221 
        invoke  sha256_update, con.k_h_ctx, con.dh_H, 32
 314 
;---------------------------------------------------------------
222 
 
 315 
; Initial IV client to server: HASH(K || H || "A" || session_id)
223 
;---------------------------------------------------------------
 316 
 
224 
; Initial IV client to server: HASH(K || H || "A" || session_id)
 317 
        mov     esi, [k_h_ctx]
225 
 
 318 
        mov     edi, [temp_ctx]
Line 226... Line 319...
226 
        mov     esi, con.k_h_ctx
 319 
        mov     ecx, sizeof.crash_ctx/4
227 
        mov     edi, con.temp_ctx
 320 
        rep movsd
Line 228... Line 321...
228 
        mov     ecx, sizeof.crash_ctx/4
 321 
        lea     edx, [session_id_x]
229 
        rep movsd
 322 
        mov     byte[edx], 'A'
Line 230... Line 323...
230 
        mov     [con.session_id_prefix], 'A'
 323 
        invoke  sha256_update, [temp_ctx], edx, SHA256_HASH_SIZE+1
231 
        invoke  sha256_update, con.temp_ctx, con.session_id_prefix, 32+1
 324 
        invoke  sha256_final, [temp_ctx]
232 
        invoke  sha256_final, con.temp_ctx.hash
 325 
        mov     edi, [tx_iv]
233 
        mov     edi, con.tx_iv
 326 
        mov     esi, [temp_ctx]
234 
        mov     esi, con.temp_ctx
 327 
        mov     ecx, SHA256_HASH_SIZE/4
- 
 
 328 
        rep movsd
235 
        mov     ecx, SHA256_HASH_SIZE/4
 329 
 
236 
        rep movsd
 330 
        DEBUGF  1, "Remote IV: "
237 
 
 331 
        stdcall dump_hex, [tx_iv], SHA256_HASH_SIZE/4
238 
        DEBUGF  1, "Remote IV: "
 332 
 
239 
        stdcall dump_hex, con.tx_iv, 8
 333 
;---------------------------------------------------------------
240 
 
 334 
; Initial IV server to client: HASH(K || H || "B" || session_id)
Line 241... Line 335...
241 
;---------------------------------------------------------------
 335 
 
242 
; Initial IV server to client: HASH(K || H || "B" || session_id)
 336 
        mov     esi, [k_h_ctx]
Line 243... Line 337...
243 
 
 337 
        mov     edi, [temp_ctx]
244 
        mov     esi, con.k_h_ctx
 338 
        mov     ecx, sizeof.crash_ctx/4
Line 245... Line 339...
245 
        mov     edi, con.temp_ctx
 339 
        rep movsd
246 
        mov     ecx, sizeof.crash_ctx/4
 340 
        lea     edx, [session_id_x]
247 
        rep movsd
 341 
        mov     byte[edx], 'B'
248 
        inc     [con.session_id_prefix]
 342 
        invoke  sha256_update, [temp_ctx], edx, SHA256_HASH_SIZE+1
249 
        invoke  sha256_update, con.temp_ctx, con.session_id_prefix, 32+1
 343 
        invoke  sha256_final, [temp_ctx]
- 
 
 344 
        mov     edi, [rx_iv]
250 
        invoke  sha256_final, con.temp_ctx
 345 
        mov     esi, [temp_ctx]
251 
        mov     edi, con.rx_iv
 346 
        mov     ecx, SHA256_HASH_SIZE/4
252 
        mov     esi, con.temp_ctx
 347 
        rep movsd
253 
        mov     ecx, SHA256_HASH_SIZE/4
 348 
 
254 
        rep movsd
 349 
        DEBUGF  1, "Local IV: "
255 
 
 350 
        stdcall dump_hex, [rx_iv], SHA256_HASH_SIZE/4
Line 256... Line 351...
256 
        DEBUGF  1, "Local IV: "
 351 
 
257 
        stdcall dump_hex, con.rx_iv, 8
 352 
;-------------------------------------------------------------------
Line 258... Line 353...
258 
 
 353 
; Encryption key client to server: HASH(K || H || "C" || session_id)
259 
;-------------------------------------------------------------------
 354 
 
Line 260... Line 355...
260 
; Encryption key client to server: HASH(K || H || "C" || session_id)
 355 
        mov     esi, [k_h_ctx]
261 
 
 356 
        mov     edi, [temp_ctx]
262 
        mov     esi, con.k_h_ctx
 357 
        mov     ecx, sizeof.crash_ctx/4
263 
        mov     edi, con.temp_ctx
 358 
        rep movsd
264 
        mov     ecx, sizeof.crash_ctx/4
 359 
        lea     edx, [session_id_x]
- 
 
 360 
        mov     byte[edx], 'C'
265 
        rep movsd
 361 
        invoke  sha256_update, [temp_ctx], edx, SHA256_HASH_SIZE+1
266 
        inc     [con.session_id_prefix]
 362 
        invoke  sha256_final, [temp_ctx]
267 
        invoke  sha256_update, con.temp_ctx, con.session_id_prefix, 32+1
 363 
        mov     edi, [tx_enc_key]
268 
        invoke  sha256_final, con.temp_ctx
 364 
        mov     esi, [temp_ctx]
269 
        mov     edi, con.tx_enc_key
 365 
        mov     ecx, SHA256_HASH_SIZE/4
270 
        mov     esi, con.temp_ctx
 366 
        rep movsd
Line 271... Line 367...
271 
        mov     ecx, SHA256_HASH_SIZE/4
 367 
 
272 
        rep movsd
 368 
        DEBUGF  1, "Remote key: "
Line 273... Line 369...
273 
 
 369 
        stdcall dump_hex, [tx_enc_key], SHA256_HASH_SIZE/4
274 
        DEBUGF  1, "Remote key: "
 370 
 
Line 275... Line 371...
275 
        stdcall dump_hex, con.tx_enc_key, 8
 371 
;-------------------------------------------------------------------
276 
 
 372 
; Encryption key server to client: HASH(K || H || "D" || session_id)
277 
;-------------------------------------------------------------------
 373 
 
278 
; Encryption key server to client: HASH(K || H || "D" || session_id)
 374 
        mov     esi, [k_h_ctx]
279 
 
 375 
        mov     edi, [temp_ctx]
- 
 
 376 
        mov     ecx, sizeof.crash_ctx/4
280 
        mov     esi, con.k_h_ctx
 377 
        rep movsd
281 
        mov     edi, con.temp_ctx
 378 
        lea     edx, [session_id_x]
282 
        mov     ecx, sizeof.crash_ctx/4
 379 
        mov     byte[edx], 'D'
283 
        rep movsd
 380 
        invoke  sha256_update, [temp_ctx], edx, SHA256_HASH_SIZE+1
284 
        inc     [con.session_id_prefix]
 381 
        invoke  sha256_final, [temp_ctx]
285 
        invoke  sha256_update, con.temp_ctx, con.session_id_prefix, 32+1
 382 
        mov     edi, [rx_enc_key]
Line 286... Line 383...
286 
        invoke  sha256_final, con.temp_ctx
 383 
        mov     esi, [temp_ctx]
287 
        mov     edi, con.rx_enc_key
 384 
        mov     ecx, SHA256_HASH_SIZE/4
Line 288... Line 385...
288 
        mov     esi, con.temp_ctx
 385 
        rep movsd
289 
        mov     ecx, SHA256_HASH_SIZE/4
 386 
 
Line 290... Line 387...
290 
        rep movsd
 387 
        DEBUGF  1, "Local key: "
291 
 
 388 
        stdcall dump_hex, [rx_enc_key], SHA256_HASH_SIZE/4
292 
        DEBUGF  1, "Local key: "
 389 
 
293 
        stdcall dump_hex, con.rx_enc_key, 8
 390 
;------------------------------------------------------------------
- 
 
 391 
; Integrity key client to server: HASH(K || H || "E" || session_id)
294 
 
 392 
 
295 
;------------------------------------------------------------------
 393 
        mov     esi, [k_h_ctx]
Line 296... Line 394...
296 
; Integrity key client to server: HASH(K || H || "E" || session_id)
 394 
        mov     edi, [temp_ctx]
Line 297... Line 395...
297 
 
 395 
        mov     ecx, sizeof.crash_ctx/4
298 
        mov     esi, con.k_h_ctx
 396 
        rep movsd
Line 299... Line 397...
299 
        mov     edi, con.temp_ctx
 397 
        lea     edx, [session_id_x]
- 
 
 398 
        mov     byte[edx], 'E'
- 
 
 399 
        invoke  sha256_update, [temp_ctx], edx, SHA256_HASH_SIZE+1
Line -... Line 400...
- 
 
 400 
        invoke  sha256_final, [temp_ctx]
- 
 
 401 
        mov     edi, [tx_int_key]
- 
 
 402 
        mov     esi, [temp_ctx]
- 
 
 403 
        mov     ecx, SHA256_HASH_SIZE/4
- 
 
 404 
        rep movsd
- 
 
 405 
 
- 
 
 406 
        DEBUGF  1, "Remote Integrity key: "
- 
 
 407 
        stdcall dump_hex, [tx_int_key], SHA256_HASH_SIZE/4
- 
 
 408 
 
- 
 
 409 
;------------------------------------------------------------------
- 
 
 410 
; Integrity key server to client: HASH(K || H || "F" || session_id)
- 
 
 411 
 
- 
 
 412 
        mov     esi, [k_h_ctx]
- 
 
 413 
        mov     edi, [temp_ctx]
- 
 
 414 
        mov     ecx, sizeof.crash_ctx/4
- 
 
 415 
        rep movsd
- 
 
 416 
        lea     edx, [session_id_x]
- 
 
 417 
        mov     byte[edx], 'F'
- 
 
 418 
        invoke  sha256_update, [temp_ctx], edx, SHA256_HASH_SIZE+1
- 
 
 419 
        invoke  sha256_final, [temp_ctx]
- 
 
 420 
        mov     edi, [rx_int_key]
- 
 
 421 
        mov     esi, [temp_ctx]
- 
 
 422 
        mov     ecx, SHA256_HASH_SIZE/4
- 
 
 423 
        rep movsd
- 
 
 424 
 
- 
 
 425 
        DEBUGF  1, "Local Integrity key: "
- 
 
 426 
        stdcall dump_hex, [rx_int_key] , SHA256_HASH_SIZE/4
- 
 
 427 
 
- 
 
 428 
;-------------------------------------
- 
 
 429 
; << Parse Diffie-Hellman New Keys MSG
- 
 
 430 
 
- 
 
 431 
        stdcall sshlib_recv_packet, [con_ptr], 0
- 
 
 432 
        cmp     eax, 0
- 
 
 433 
        jl      .err
- 
 
 434 
 
- 
 
 435 
        mov     ebx, [con_ptr]
300 
        mov     ecx, sizeof.crash_ctx/4
 436 
        cmp     [ebx + sshlib_connection.rx_buffer.message_code], SSH_MSG_NEWKEYS
- 
 
 437 
        jne     .err_proto
- 
 
 438 
 
- 
 
 439 
        DEBUGF  2, "Received New Keys\n"
- 
 
 440 
 
- 
 
 441 
;-------------------------------
- 
 
 442 
; >> Reply with New Keys message
- 
 
 443 
 
- 
 
 444 
        stdcall sshlib_send_packet, [con_ptr], ssh_msg_new_keys, ssh_msg_new_keys.length, 0
- 
 
 445 
        cmp     eax, 0
- 
 
 446 
        jl      .err
301 
        rep movsd
 447 
 
Line 302... Line 448...
302 
        inc     [con.session_id_prefix]
 448 
;----------------------------------------------
303 
        invoke  sha256_update, con.temp_ctx, con.session_id_prefix, 32+1
 449 
; Set keys and initialize transport subroutines
304 
        invoke  sha256_final, con.temp_ctx
 450 
 
305 
        mov     edi, con.tx_int_key
 451 
        DEBUGF  2, "SSH: Setting encryption keys\n"
Line 306... Line 452...
306 
        mov     esi, con.temp_ctx
 452 
 
307 
        mov     ecx, SHA256_HASH_SIZE/4
 453 
        mov     ebx, [con_ptr]
308 
        rep movsd
 454 
        stdcall aes256_ctr_init, [rx_iv]
309 
 
 455 
        test    eax, eax
Line 310... Line 456...
310 
        DEBUGF  1, "Remote Integrity key: "
 456 
        jz      .err_nomem