nhyatt/putty-source
1
0
Fork 0
mirror of https://git.tartarus.org/simon/putty.git synced 2025-01-09 17:38:00 +00:00
Code Issues Projects Releases Wiki Activity

Add RFC8268 / RFC3126 Diffie-Hellman group{15,16,17,18}.

Browse Source 
These are a new set of larger integer Diffie-Hellman fixed groups,
using SHA-512 as the hash.
This commit is contained in:
Simon Tatham 2022-08-29 07:44:39 +01:00
parent b88057d09d
commit 031d86ed5b
7 changed files with 230 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
config.c
View File

@ -564,8 +564,12 @@ static void kexlist_handler(dlgcontrol *ctrl, dlgparam *dlg,
int i;
static const struct { const char *s; int k; } kexes[] = {
{ "Diffie-Hellman group 1", KEX_DHGROUP1 },
{ "Diffie-Hellman group 14", KEX_DHGROUP14 },
{ "Diffie-Hellman group 1 (1024-bit)", KEX_DHGROUP1 },
{ "Diffie-Hellman group 14 (2048-bit)", KEX_DHGROUP14 },
{ "Diffie-Hellman group 15 (3072-bit)", KEX_DHGROUP15 },
{ "Diffie-Hellman group 16 (4096-bit)", KEX_DHGROUP16 },
{ "Diffie-Hellman group 17 (6144-bit)", KEX_DHGROUP17 },
{ "Diffie-Hellman group 18 (8192-bit)", KEX_DHGROUP18 },
{ "Diffie-Hellman group exchange", KEX_DHGEX },
{ "RSA-based key exchange", KEX_RSA },
{ "ECDH key exchange", KEX_ECDH },

168
crypto/diffie-hellman.c
View File

@ -35,6 +35,42 @@ spigot -B16 '2^2048 - 2^1984 - 1 + 2^64 * ( floor(2^1918 pi) + 124476 )'
ctx->g = mp_from_integer(2);
}
static void dh_group15_construct(dh_ctx *ctx)
{
/* Command to recompute, from the expression in RFC 3526 section 4:
spigot -B16 '2^3072 - 2^3008 - 1 + 2^64 * ( floor(2^2942 pi) + 1690314 )'
*/
ctx->p = MP_LITERAL(0xFFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F356208552BB9ED529077096966D670C354E4ABC9804F1746C08CA18217C32905E462E36CE3BE39E772C180E86039B2783A2EC07A28FB5C55DF06F4C52C9DE2BCBF6955817183995497CEA956AE515D2261898FA051015728E5A8AAAC42DAD33170D04507A33A85521ABDF1CBA64ECFB850458DBEF0A8AEA71575D060C7DB3970F85A6E1E4C7ABF5AE8CDB0933D71E8C94E04A25619DCEE3D2261AD2EE6BF12FFA06D98A0864D87602733EC86A64521F2B18177B200CBBE117577A615D6C770988C0BAD946E208E24FA074E5AB3143DB5BFCE0FD108E4B82D120A93AD2CAFFFFFFFFFFFFFFFF);
ctx->g = mp_from_integer(2);
}
static void dh_group16_construct(dh_ctx *ctx)
{
/* Command to recompute, from the expression in RFC 3526 section 5:
spigot -B16 '2^4096 - 2^4032 - 1 + 2^64 * ( floor(2^3966 pi) + 240904 )'
*/
ctx->p = MP_LITERAL(0xFFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F356208552BB9ED529077096966D670C354E4ABC9804F1746C08CA18217C32905E462E36CE3BE39E772C180E86039B2783A2EC07A28FB5C55DF06F4C52C9DE2BCBF6955817183995497CEA956AE515D2261898FA051015728E5A8AAAC42DAD33170D04507A33A85521ABDF1CBA64ECFB850458DBEF0A8AEA71575D060C7DB3970F85A6E1E4C7ABF5AE8CDB0933D71E8C94E04A25619DCEE3D2261AD2EE6BF12FFA06D98A0864D87602733EC86A64521F2B18177B200CBBE117577A615D6C770988C0BAD946E208E24FA074E5AB3143DB5BFCE0FD108E4B82D120A92108011A723C12A787E6D788719A10BDBA5B2699C327186AF4E23C1A946834B6150BDA2583E9CA2AD44CE8DBBBC2DB04DE8EF92E8EFC141FBECAA6287C59474E6BC05D99B2964FA090C3A2233BA186515BE7ED1F612970CEE2D7AFB81BDD762170481CD0069127D5B05AA993B4EA988D8FDDC186FFB7DC90A6C08F4DF435C934063199FFFFFFFFFFFFFFFF);
ctx->g = mp_from_integer(2);
}
static void dh_group17_construct(dh_ctx *ctx)
{
/* Command to recompute, from the expression in RFC 3526 section 6:
spigot -B16 '2^6144 - 2^6080 - 1 + 2^64 * ( floor(2^6014 pi) + 929484 )'
*/
ctx->p = MP_LITERAL(0xFFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F356208552BB9ED529077096966D670C354E4ABC9804F1746C08CA18217C32905E462E36CE3BE39E772C180E86039B2783A2EC07A28FB5C55DF06F4C52C9DE2BCBF6955817183995497CEA956AE515D2261898FA051015728E5A8AAAC42DAD33170D04507A33A85521ABDF1CBA64ECFB850458DBEF0A8AEA71575D060C7DB3970F85A6E1E4C7ABF5AE8CDB0933D71E8C94E04A25619DCEE3D2261AD2EE6BF12FFA06D98A0864D87602733EC86A64521F2B18177B200CBBE117577A615D6C770988C0BAD946E208E24FA074E5AB3143DB5BFCE0FD108E4B82D120A92108011A723C12A787E6D788719A10BDBA5B2699C327186AF4E23C1A946834B6150BDA2583E9CA2AD44CE8DBBBC2DB04DE8EF92E8EFC141FBECAA6287C59474E6BC05D99B2964FA090C3A2233BA186515BE7ED1F612970CEE2D7AFB81BDD762170481CD0069127D5B05AA993B4EA988D8FDDC186FFB7DC90A6C08F4DF435C93402849236C3FAB4D27C7026C1D4DCB2602646DEC9751E763DBA37BDF8FF9406AD9E530EE5DB382F413001AEB06A53ED9027D831179727B0865A8918DA3EDBEBCF9B14ED44CE6CBACED4BB1BDB7F1447E6CC254B332051512BD7AF426FB8F401378CD2BF5983CA01C64B92ECF032EA15D1721D03F482D7CE6E74FEF6D55E702F46980C82B5A84031900B1C9E59E7C97FBEC7E8F323A97A7E36CC88BE0F1D45B7FF585AC54BD407B22B4154AACC8F6D7EBF48E1D814CC5ED20F8037E0A79715EEF29BE32806A1D58BB7C5DA76F550AA3D8A1FBFF0EB19CCB1A313D55CDA56C9EC2EF29632387FE8D76E3C0468043E8F663F4860EE12BF2D5B0B7474D6E694F91E6DCC4024FFFFFFFFFFFFFFFF);
ctx->g = mp_from_integer(2);
}
static void dh_group18_construct(dh_ctx *ctx)
{
/* Command to recompute, from the expression in RFC 3526 section 7:
spigot -B16 '2^8192 - 2^8128 - 1 + 2^64 * ( floor(2^8062 pi) + 4743158 )'
*/
ctx->p = MP_LITERAL(0xFFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F356208552BB9ED529077096966D670C354E4ABC9804F1746C08CA18217C32905E462E36CE3BE39E772C180E86039B2783A2EC07A28FB5C55DF06F4C52C9DE2BCBF6955817183995497CEA956AE515D2261898FA051015728E5A8AAAC42DAD33170D04507A33A85521ABDF1CBA64ECFB850458DBEF0A8AEA71575D060C7DB3970F85A6E1E4C7ABF5AE8CDB0933D71E8C94E04A25619DCEE3D2261AD2EE6BF12FFA06D98A0864D87602733EC86A64521F2B18177B200CBBE117577A615D6C770988C0BAD946E208E24FA074E5AB3143DB5BFCE0FD108E4B82D120A92108011A723C12A787E6D788719A10BDBA5B2699C327186AF4E23C1A946834B6150BDA2583E9CA2AD44CE8DBBBC2DB04DE8EF92E8EFC141FBECAA6287C59474E6BC05D99B2964FA090C3A2233BA186515BE7ED1F612970CEE2D7AFB81BDD762170481CD0069127D5B05AA993B4EA988D8FDDC186FFB7DC90A6C08F4DF435C93402849236C3FAB4D27C7026C1D4DCB2602646DEC9751E763DBA37BDF8FF9406AD9E530EE5DB382F413001AEB06A53ED9027D831179727B0865A8918DA3EDBEBCF9B14ED44CE6CBACED4BB1BDB7F1447E6CC254B332051512BD7AF426FB8F401378CD2BF5983CA01C64B92ECF032EA15D1721D03F482D7CE6E74FEF6D55E702F46980C82B5A84031900B1C9E59E7C97FBEC7E8F323A97A7E36CC88BE0F1D45B7FF585AC54BD407B22B4154AACC8F6D7EBF48E1D814CC5ED20F8037E0A79715EEF29BE32806A1D58BB7C5DA76F550AA3D8A1FBFF0EB19CCB1A313D55CDA56C9EC2EF29632387FE8D76E3C0468043E8F663F4860EE12BF2D5B0B7474D6E694F91E6DBE115974A3926F12FEE5E438777CB6A932DF8CD8BEC4D073B931BA3BC832B68D9DD300741FA7BF8AFC47ED2576F6936BA424663AAB639C5AE4F5683423B4742BF1C978238F16CBE39D652DE3FDB8BEFC848AD922222E04A4037C0713EB57A81A23F0C73473FC646CEA306B4BCBC8862F8385DDFA9D4B7FA2C087E879683303ED5BDD3A062B3CF5B3A278A66D2A13F83F44F82DDF310EE074AB6A364597E899A0255DC164F31CC50846851DF9AB48195DED7EA1B1D510BD7EE74D73FAF36BC31ECFA268359046F4EB879F924009438B481C6CD7889A002ED5EE382BC9190DA6FC026E479558E4475677E9AA9E3050E2765694DFC81F56E880B96E7160C980DD98EDD3DFFFFFFFFFFFFFFFFF);
ctx->g = mp_from_integer(2);
}
static const struct dh_extra extra_group1 = {
false, dh_group1_construct,
};
@ -53,6 +89,86 @@ static const ssh_kex *const group1_list[] = {
const ssh_kexes ssh_diffiehellman_group1 = { lenof(group1_list), group1_list };
static const struct dh_extra extra_group18 = {
false, dh_group18_construct,
};
const ssh_kex ssh_diffiehellman_group18_sha512 = {
.name = "diffie-hellman-group18-sha512",
.groupname = "group18",
.main_type = KEXTYPE_DH,
.hash = &ssh_sha512,
.extra = &extra_group18,
};
static const ssh_kex *const group18_list[] = {
&ssh_diffiehellman_group18_sha512,
};
const ssh_kexes ssh_diffiehellman_group18 = {
lenof(group18_list), group18_list
};
static const struct dh_extra extra_group17 = {
false, dh_group17_construct,
};
const ssh_kex ssh_diffiehellman_group17_sha512 = {
.name = "diffie-hellman-group17-sha512",
.groupname = "group17",
.main_type = KEXTYPE_DH,
.hash = &ssh_sha512,
.extra = &extra_group17,
};
static const ssh_kex *const group17_list[] = {
&ssh_diffiehellman_group17_sha512,
};
const ssh_kexes ssh_diffiehellman_group17 = {
lenof(group17_list), group17_list
};
static const struct dh_extra extra_group16 = {
false, dh_group16_construct,
};
const ssh_kex ssh_diffiehellman_group16_sha512 = {
.name = "diffie-hellman-group16-sha512",
.groupname = "group16",
.main_type = KEXTYPE_DH,
.hash = &ssh_sha512,
.extra = &extra_group16,
};
static const ssh_kex *const group16_list[] = {
&ssh_diffiehellman_group16_sha512,
};
const ssh_kexes ssh_diffiehellman_group16 = {
lenof(group16_list), group16_list
};
static const struct dh_extra extra_group15 = {
false, dh_group15_construct,
};
const ssh_kex ssh_diffiehellman_group15_sha512 = {
.name = "diffie-hellman-group15-sha512",
.groupname = "group15",
.main_type = KEXTYPE_DH,
.hash = &ssh_sha512,
.extra = &extra_group15,
};
static const ssh_kex *const group15_list[] = {
&ssh_diffiehellman_group15_sha512,
};
const ssh_kexes ssh_diffiehellman_group15 = {
lenof(group15_list), group15_list
};
static const struct dh_extra extra_group14 = {
false, dh_group14_construct,
};
@ -129,6 +245,58 @@ static const ssh_kex ssh_gssk5_diffiehellman_gex_sha1 = {
.extra = &extra_gex,
};
static const ssh_kex ssh_gssk5_diffiehellman_group18_sha512 = {
.name = "gss-group18-sha512-" GSS_KRB5_OID_HASH,
.groupname = "group18",
.main_type = KEXTYPE_GSS,
.hash = &ssh_sha512,
.extra = &extra_group18,
};
static const ssh_kex ssh_gssk5_diffiehellman_group17_sha512 = {
.name = "gss-group17-sha512-" GSS_KRB5_OID_HASH,
.groupname = "group17",
.main_type = KEXTYPE_GSS,
.hash = &ssh_sha512,
.extra = &extra_group17,
};
static const ssh_kex ssh_gssk5_diffiehellman_group16_sha512 = {
.name = "gss-group16-sha512-" GSS_KRB5_OID_HASH,
.groupname = "group16",
.main_type = KEXTYPE_GSS,
.hash = &ssh_sha512,
.extra = &extra_group16,
};
static const ssh_kex ssh_gssk5_diffiehellman_group15_sha512 = {
.name = "gss-group15-sha512-" GSS_KRB5_OID_HASH,
.groupname = "group15",
.main_type = KEXTYPE_GSS,
.hash = &ssh_sha512,
.extra = &extra_group15,
};
static const ssh_kex ssh_gssk5_diffiehellman_group14_sha256 = {
.name = "gss-group14-sha256-" GSS_KRB5_OID_HASH,
.groupname = "group14",
.main_type = KEXTYPE_GSS,
.hash = &ssh_sha256,
.extra = &extra_group14,
};
static const ssh_kex *const gssk5_sha2_kex_list[] = {
&ssh_gssk5_diffiehellman_group18_sha512,
&ssh_gssk5_diffiehellman_group17_sha512,
&ssh_gssk5_diffiehellman_group16_sha512,
&ssh_gssk5_diffiehellman_group15_sha512,
&ssh_gssk5_diffiehellman_group14_sha256,
};
const ssh_kexes ssh_gssk5_sha2_kex = {
lenof(gssk5_sha2_kex_list), gssk5_sha2_kex_list
};
static const ssh_kex ssh_gssk5_diffiehellman_group14_sha1 = {
.name = "gss-group14-sha1-" GSS_KRB5_OID_HASH,
.groupname = "group14",

4
putty.h
View File

@ -422,6 +422,10 @@ enum {
KEX_WARN,
KEX_DHGROUP1,
KEX_DHGROUP14,
KEX_DHGROUP15,
KEX_DHGROUP16,
KEX_DHGROUP17,
KEX_DHGROUP18,
KEX_DHGEX,
KEX_RSA,
KEX_ECDH,

8
settings.c
View File

@ -33,6 +33,10 @@ static const struct keyvalwhere kexnames[] = {
{ "ecdh", KEX_ECDH, -1, +1 },
/* This name is misleading: it covers both SHA-256 and SHA-1 variants */
{ "dh-gex-sha1", KEX_DHGEX, -1, -1 },
{ "dh-group18-sha512", KEX_DHGROUP18, -1, -1 },
{ "dh-group17-sha512", KEX_DHGROUP17, -1, -1 },
{ "dh-group16-sha512", KEX_DHGROUP16, -1, -1 },
{ "dh-group15-sha512", KEX_DHGROUP15, -1, -1 },
{ "dh-group14-sha1", KEX_DHGROUP14, -1, -1 },
{ "dh-group1-sha1", KEX_DHGROUP1, KEX_WARN, +1 },
{ "rsa", KEX_RSA, KEX_WARN, -1 },
@ -971,9 +975,9 @@ void load_open_settings(settings_r *sesskey, Conf *conf)
* a server which offered it then choked, but we never got
* a server version string or any other reports. */
const char *default_kexes,
*normal_default = "ecdh,dh-gex-sha1,dh-group14-sha1,rsa,"
*normal_default = "ecdh,dh-gex-sha1,dh-group18-sha512,dh-group17-sha512,dh-group16-sha512,dh-group15-sha512,dh-group14-sha1,rsa,"
"WARN,dh-group1-sha1",
*bugdhgex2_default = "ecdh,dh-group14-sha1,rsa,"
*bugdhgex2_default = "ecdh,dh-group18-sha512,dh-group17-sha512,dh-group16-sha512,dh-group15-sha512,dh-group14-sha1,rsa,"
"WARN,dh-group1-sha1,dh-gex-sha1";
char *raw;
i = 2 - gppi_raw(sesskey, "BugDHGEx2", 0);

19
ssh.h
View File

@ -820,14 +820,20 @@ void hash_simple(const ssh_hashalg *alg, ptrlen data, void *output);
struct ssh_kex {
const char *name, *groupname;
enum { KEXTYPE_DH, KEXTYPE_RSA, KEXTYPE_ECDH, KEXTYPE_GSS } main_type;
enum { KEXTYPE_DH, KEXTYPE_RSA, KEXTYPE_ECDH,
KEXTYPE_GSS, KEXTYPE_GSS_ECDH } main_type;
const ssh_hashalg *hash;
union { /* publicly visible data for each type */
const ecdh_keyalg *ecdh_vt; /* for KEXTYPE_ECDH */
const ecdh_keyalg *ecdh_vt; /* for KEXTYPE_ECDH, KEXTYPE_GSS_ECDH */
};
const void *extra; /* private to the kex methods */
};
static inline bool kex_is_gss(const struct ssh_kex *kex)
{
return kex->main_type == KEXTYPE_GSS || kex->main_type == KEXTYPE_GSS_ECDH;
}
struct ssh_kexes {
int nkexes;
const ssh_kex *const *list;
@ -1139,11 +1145,20 @@ extern const ssh_hashalg ssh_shake256_114bytes;
extern const ssh_hashalg ssh_blake2b;
extern const ssh_kexes ssh_diffiehellman_group1;
extern const ssh_kexes ssh_diffiehellman_group14;
extern const ssh_kexes ssh_diffiehellman_group15;
extern const ssh_kexes ssh_diffiehellman_group16;
extern const ssh_kexes ssh_diffiehellman_group17;
extern const ssh_kexes ssh_diffiehellman_group18;
extern const ssh_kexes ssh_diffiehellman_gex;
extern const ssh_kex ssh_diffiehellman_group1_sha1;
extern const ssh_kex ssh_diffiehellman_group14_sha256;
extern const ssh_kex ssh_diffiehellman_group14_sha1;
extern const ssh_kex ssh_diffiehellman_group15_sha512;
extern const ssh_kex ssh_diffiehellman_group16_sha512;
extern const ssh_kex ssh_diffiehellman_group17_sha512;
extern const ssh_kex ssh_diffiehellman_group18_sha512;
extern const ssh_kexes ssh_gssk5_sha1_kex;
extern const ssh_kexes ssh_gssk5_sha2_kex;
extern const ssh_kexes ssh_rsa_kex;
extern const ssh_kex ssh_ec_kex_curve25519;
extern const ssh_kex ssh_ec_kex_curve448;

22
ssh/transport2.c
View File

@ -508,7 +508,7 @@ static void ssh2_write_kexinit_lists(
bool warn;
int n_preferred_kex;
const ssh_kexes *preferred_kex[KEX_MAX + 1]; /* +1 for GSSAPI */
const ssh_kexes *preferred_kex[KEX_MAX + 2]; /* +2 for GSSAPI */
int n_preferred_hk;
int preferred_hk[HK_MAX];
int n_preferred_ciphers;
@ -523,14 +523,32 @@ static void ssh2_write_kexinit_lists(
* Set up the preferred key exchange. (NULL => warn below here)
*/
n_preferred_kex = 0;
if (can_gssapi_keyex)
if (can_gssapi_keyex) {
preferred_kex[n_preferred_kex++] = &ssh_gssk5_sha2_kex;
preferred_kex[n_preferred_kex++] = &ssh_gssk5_sha1_kex;
}
for (i = 0; i < KEX_MAX; i++) {
switch (conf_get_int_int(conf, CONF_ssh_kexlist, i)) {
case KEX_DHGEX:
preferred_kex[n_preferred_kex++] =
&ssh_diffiehellman_gex;
break;
case KEX_DHGROUP18:
preferred_kex[n_preferred_kex++] =
&ssh_diffiehellman_group18;
break;
case KEX_DHGROUP17:
preferred_kex[n_preferred_kex++] =
&ssh_diffiehellman_group17;
break;
case KEX_DHGROUP16:
preferred_kex[n_preferred_kex++] =
&ssh_diffiehellman_group16;
break;
case KEX_DHGROUP15:
preferred_kex[n_preferred_kex++] =
&ssh_diffiehellman_group15;
break;
case KEX_DHGROUP14:
preferred_kex[n_preferred_kex++] =
&ssh_diffiehellman_group14;

4
test/testcrypt-enum.h
View File

@ -120,6 +120,10 @@ END_ENUM_TYPE(cipheralg)
BEGIN_ENUM_TYPE(dh_group)
ENUM_VALUE("group1", &ssh_diffiehellman_group1_sha1)
ENUM_VALUE("group14", &ssh_diffiehellman_group14_sha256)
ENUM_VALUE("group15", &ssh_diffiehellman_group15_sha512)
ENUM_VALUE("group16", &ssh_diffiehellman_group16_sha512)
ENUM_VALUE("group17", &ssh_diffiehellman_group17_sha512)
ENUM_VALUE("group18", &ssh_diffiehellman_group18_sha512)
END_ENUM_TYPE(dh_group)
BEGIN_ENUM_TYPE(ecdh_alg)