Subject: Help with DH key exchange on SSHv2.0

From: Manik Surtani <[email-masked]>
Date: Tue, 02 Jul 2002 10:36:15 +0100

Hey all.

Apologies if this is the wrong place to post this question.

I'm developing an open source Java SSH (v2) client API, and need a bit 
of help.

1) After receiving the KEXDH_RESPONSE packet, reading SSH Transport 
Layer Protocol (March 2002), Section 5.2, Output from Key Exchange:  do 
I assume that, in HASH (K || H || "A" || session_id), H is a mpint?  The 
spec states that K is a mpint but doesnt specify for H.

2) Also, how do I communicate my public key to the server?  From the 
spec, I gather that the next packet to send is a SSH_MSG_NEWKEYS with no 
data following ... am I wrong?

Help is very much appreciated...

-- 
Manik Surtani
Conchango
'Innovative Change in Business'

T 44 (0) 1784 221829
M 44 (0) 7786 702 706
E [email-masked]

http://www.conchango.com

The information contained in this message is confidential and is
intended for the addressee only. If you have received this message in
error, please notify us as soon as possible. The unauthorised use,
disclosure, copying or alteration of this message is forbidden.

_____________________________________________________________________
This message has been checked for all known viruses by the MessageLabs Virus Control Centre.

---

From: Markus Friedl <[email-masked]>
Date: Tue, 2 Jul 2002 11:44:04 +0200

> spec states that K is a mpint but doesnt specify for H.

check draft-ietf-secsh-transport-XX, and search for
   The hash H is computed as the HASH hash of the concatenation of the
   following: ...

H is a hash, it's the raw output of sha1, in the 
"diffie-hellman-group1-sha1" key exchange.

> data following ... am I wrong?

check draft-ietf-secsh-transport-XX, and search for

   First, the client sends the following:

     byte      SSH_MSG_KEXDH_INIT
     mpint     e

-m

---

From: Manik Surtani <[email-masked]>
Date: Tue, 02 Jul 2002 12:11:29 +0100

Hi, Marcus.

> "diffie-hellman-group1-sha1" key exchange.

Yes, I have already computed H - and have it as a byte[].  But does it 
need to be encoded as a mpint, or a string, or just raw bytes for the 
HASH (K || H || "A" || session_id) operation?

>    First, the client sends the following:

I have already done SSH_MSG_KEXDH_INIT and have received 
SSH_MSG_KEXDH_REPLY.  Is the next step just SSH_MSG_NEWKEYS, then?

Also,

3)  The keys generated using HASH(K || H || "A" || session_id) - which 
key do I use for the SSH-AUTH procedures?  Is it Initial IV client to 
server?

Thanks ...

Manik

T 44 (0) 1784 221829
M 44 (0) 7786 702 706

http://www.conchango.com

---

From: Markus Friedl <[email-masked]>
Date: Tue, 2 Jul 2002 13:19:37 +0200

> HASH (K || H || "A" || session_id) operation?

just raw bytes.

> SSH_MSG_KEXDH_REPLY.  Is the next step just SSH_MSG_NEWKEYS, then?

yes.

> key do I use for the SSH-AUTH procedures?  Is it Initial IV client to 

for the public key authentication you need the hash H (aka
the session id).