ssh: optimize kex dh_gex using new crypto functionality

Conflicts:
	lib/ssh/src/ssh_connection_handler.erl
	lib/ssh/src/ssh_transport.erl

2 files changed, 103 insertions, 28 deletions

diff --git a/lib/ssh/src/ssh_connection_handler.erl b/lib/ssh/src/ssh_connection_handler.erl
index b73f8b23d2..8c73bb8946 100644
--- a/lib/ssh/src/ssh_connection_handler.erl
+++ b/lib/ssh/src/ssh_connection_handler.erl
@@ -429,14 +429,16 @@ key_exchange(#ssh_msg_kexdh_reply{} = Msg,
 
 key_exchange(#ssh_msg_kex_dh_gex_request{} = Msg, 
 	     #state{ssh_params = #ssh{role = server} = Ssh0} = State) ->
-    {ok, GexGroup, Ssh} = ssh_transport:handle_kex_dh_gex_request(Msg, Ssh0),
+    {ok, GexGroup, Ssh1} = ssh_transport:handle_kex_dh_gex_request(Msg, Ssh0),
     send_msg(GexGroup, State),
+    Ssh = ssh_transport:parallell_gen_key(Ssh1),
     {next_state, key_exchange_dh_gex_init, next_packet(State#state{ssh_params = Ssh})};
 
 key_exchange(#ssh_msg_kex_dh_gex_request_old{} = Msg, 
 	     #state{ssh_params = #ssh{role = server} = Ssh0} = State) ->
-    {ok, GexGroup, Ssh} = ssh_transport:handle_kex_dh_gex_request(Msg, Ssh0),
+    {ok, GexGroup, Ssh1} = ssh_transport:handle_kex_dh_gex_request(Msg, Ssh0),
     send_msg(GexGroup, State),
+    Ssh = ssh_transport:parallell_gen_key(Ssh1),
     {next_state, key_exchange_dh_gex_init, next_packet(State#state{ssh_params = Ssh})};
 
 key_exchange(#ssh_msg_kex_dh_gex_group{} = Msg, 
diff --git a/lib/ssh/src/ssh_transport.erl b/lib/ssh/src/ssh_transport.erl
index 18037b8461..5391df723c 100644
--- a/lib/ssh/src/ssh_transport.erl
+++ b/lib/ssh/src/ssh_transport.erl
@@ -44,6 +44,7 @@
 	 handle_kexdh_reply/2, 
 	 handle_kex_ecdh_init/2,
 	 handle_kex_ecdh_reply/2,
+         parallell_gen_key/1,
 	 extract_public_key/1,
 	 ssh_packet/2, pack/2,
 	 sign/3, verify/4]).
@@ -287,9 +288,6 @@ handle_kexinit_msg(#ssh_msg_kexinit{} = CounterPart, #ssh_msg_kexinit{} = Own,
     end.
 
 
-%% TODO: diffie-hellman-group14-sha1 should also be supported.
-%% Maybe check more things ...
-
 verify_algorithm(#alg{kex = undefined}) -> false;
 verify_algorithm(#alg{hkey = undefined}) -> false;
 verify_algorithm(#alg{send_mac = undefined}) -> false;
@@ -307,17 +305,29 @@ verify_algorithm(#alg{kex = Kex}) -> lists:member(Kex, supported_algorithms(kex)
 key_exchange_first_msg(Kex, Ssh0) when Kex == 'diffie-hellman-group1-sha1' ;
 				       Kex == 'diffie-hellman-group14-sha1' ->
     {G, P} = dh_group(Kex),
-    {Public, Private} = generate_key(dh, [P,G]),
+    Sz = dh_bits(Ssh0#ssh.algorithms),
+    {Public, Private} = generate_key(dh, [P,G,2*Sz]),
     {SshPacket, Ssh1} = ssh_packet(#ssh_msg_kexdh_init{e = Public}, Ssh0),
     {ok, SshPacket, 
      Ssh1#ssh{keyex_key = {{Private, Public}, {G, P}}}};
 
 key_exchange_first_msg(Kex, Ssh0=#ssh{opts=Opts}) when Kex == 'diffie-hellman-group-exchange-sha1' ;
 						       Kex == 'diffie-hellman-group-exchange-sha256' ->
-    {Min,NBits,Max} = 
+    {Min,NBits0,Max} = 
 	proplists:get_value(dh_gex_limits, Opts, {?DEFAULT_DH_GROUP_MIN,
 						  ?DEFAULT_DH_GROUP_NBITS,
 						  ?DEFAULT_DH_GROUP_MAX}),
+    DhBits = dh_bits(Ssh0#ssh.algorithms),
+    NBits1 = 
+        %% NIST Special Publication 800-57 Part 1 Revision 4: Recommendation for Key Management
+        if 
+            DhBits =< 112 -> 2048;
+            DhBits =< 128 -> 3072;
+            DhBits =< 192 -> 7680;
+            true -> 8192
+        end,
+    NBits = min(max(max(NBits0,NBits1),Min), Max),
+    
     {SshPacket, Ssh1} = 
 	ssh_packet(#ssh_msg_kex_dh_gex_request{min = Min, 
 					       n = NBits,
@@ -341,12 +351,13 @@ key_exchange_first_msg(Kex, Ssh0) when Kex == 'ecdh-sha2-nistp256' ;
 %%% diffie-hellman-group14-sha1
 %%% 
 handle_kexdh_init(#ssh_msg_kexdh_init{e = E}, 
-		  Ssh0 = #ssh{algorithms = #alg{kex=Kex}}) ->
+		  Ssh0 = #ssh{algorithms = #alg{kex=Kex} = Algs}) ->
     %% server
     {G, P} = dh_group(Kex),
     if
 	1=<E, E=<(P-1) ->
-	    {Public, Private} = generate_key(dh, [P,G]),
+            Sz = dh_bits(Algs),
+	    {Public, Private} = generate_key(dh, [P,G,2*Sz]),
 	    K = compute_key(dh, E, Private, [P,G]),
 	    MyPrivHostKey = get_host_key(Ssh0),
 	    MyPubHostKey = extract_public_key(MyPrivHostKey),
@@ -418,13 +429,12 @@ handle_kex_dh_gex_request(#ssh_msg_kex_dh_gex_request{min = Min0,
     {Min, Max} = adjust_gex_min_max(Min0, Max0, Opts),
     case public_key:dh_gex_group(Min, NBits, Max,
 				 proplists:get_value(dh_gex_groups,Opts)) of
-	{ok, {_Sz, {G,P}}} ->
-	    {Public, Private} = generate_key(dh, [P,G]),
+	{ok, {_, {G,P}}} ->
 	    {SshPacket, Ssh} = 
 		ssh_packet(#ssh_msg_kex_dh_gex_group{p = P, g = G}, Ssh0),
 	    {ok, SshPacket, 
-	     Ssh#ssh{keyex_key = {{Private, Public}, {G, P}},
-		     keyex_info = {Min, Max, NBits}
+             Ssh#ssh{keyex_key = {x, {G, P}},
+		     keyex_info = {Min0, Max0, NBits}
 		    }};
 	{error,_} ->
 	    throw(#ssh_msg_disconnect{
@@ -452,12 +462,11 @@ handle_kex_dh_gex_request(#ssh_msg_kex_dh_gex_request_old{n = NBits},
     {Min, Max} = adjust_gex_min_max(Min0, Max0, Opts),
     case public_key:dh_gex_group(Min, NBits, Max,
 				 proplists:get_value(dh_gex_groups,Opts)) of
-	{ok, {_Sz, {G,P}}} ->
-	    {Public, Private} = generate_key(dh, [P,G]),
+	{ok, {_, {G,P}}} ->
 	    {SshPacket, Ssh} = 
 		ssh_packet(#ssh_msg_kex_dh_gex_group{p = P, g = G}, Ssh0),
 	    {ok, SshPacket, 
-	     Ssh#ssh{keyex_key = {{Private, Public}, {G, P}},
+	     Ssh#ssh{keyex_key = {x, {G, P}},
 		     keyex_info = {-1, -1, NBits} % flag for kex_h hash calc
 		    }};
 	{error,_} ->
@@ -497,7 +506,8 @@ adjust_gex_min_max(Min0, Max0, Opts) ->
 
 handle_kex_dh_gex_group(#ssh_msg_kex_dh_gex_group{p = P, g = G}, Ssh0) ->
     %% client
-    {Public, Private} = generate_key(dh, [P,G]),
+    Sz = dh_bits(Ssh0#ssh.algorithms),
+    {Public, Private} = generate_key(dh, [P,G,2*Sz]),
     {SshPacket, Ssh1} = 
 	ssh_packet(#ssh_msg_kex_dh_gex_init{e = Public}, Ssh0),	% Pub = G^Priv mod P (def)
 
@@ -1108,6 +1118,51 @@ verify(PlainText, Hash, Sig, Key) ->
 %%  
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 
+%%% Unit: bytes
+
+-record(cipher_data, {
+          key_bytes,
+          iv_bytes,
+          block_bytes
+         }).
+
+%%% Start of a more parameterized crypto handling.
+cipher('AEAD_AES_128_GCM') ->
+    #cipher_data{key_bytes = 16,
+                 iv_bytes = 12,
+                 block_bytes = 16};
+
+cipher('AEAD_AES_256_GCM') ->
+    #cipher_data{key_bytes = 32,
+                 iv_bytes = 12,
+                 block_bytes = 16};
+
+cipher('3des-cbc') ->
+    #cipher_data{key_bytes = 24,
+                 iv_bytes = 8,
+                 block_bytes = 8};
+    
+cipher('aes128-cbc') ->
+    #cipher_data{key_bytes = 16,
+                 iv_bytes = 16,
+                 block_bytes = 16};
+
+cipher('aes128-ctr') ->
+    #cipher_data{key_bytes = 16,
+                 iv_bytes = 16,
+                 block_bytes = 16};
+
+cipher('aes192-ctr') ->
+    #cipher_data{key_bytes = 24,
+                 iv_bytes = 16,
+                 block_bytes = 16};
+
+cipher('aes256-ctr') ->
+    #cipher_data{key_bytes = 32,
+                 iv_bytes = 16,
+                 block_bytes = 16}.
+
+
 encrypt_init(#ssh{encrypt = none} = Ssh) ->
     {ok, Ssh};
 encrypt_init(#ssh{encrypt = 'AEAD_AES_128_GCM', role = client} = Ssh) ->
@@ -1488,11 +1543,11 @@ send_mac_init(SSH) ->
 	common ->
 	    case SSH#ssh.role of
 		client ->
-		    KeySize = mac_key_size(SSH#ssh.send_mac),
+		    KeySize = 8*mac_key_bytes(SSH#ssh.send_mac),
 		    Key = hash(SSH, "E", KeySize),
 		    {ok, SSH#ssh { send_mac_key = Key }};
 		server ->
-		    KeySize = mac_key_size(SSH#ssh.send_mac),
+		    KeySize = 8*mac_key_bytes(SSH#ssh.send_mac),
 		    Key = hash(SSH, "F", KeySize),
 		    {ok, SSH#ssh { send_mac_key = Key }}
 	    end;
@@ -1511,10 +1566,10 @@ recv_mac_init(SSH) ->
 	common ->
 	    case SSH#ssh.role of
 		client ->
-		    Key = hash(SSH, "F", mac_key_size(SSH#ssh.recv_mac)),
+		    Key = hash(SSH, "F", 8*mac_key_bytes(SSH#ssh.recv_mac)),
 		    {ok, SSH#ssh { recv_mac_key = Key }};
 		server ->
-		    Key = hash(SSH, "E", mac_key_size(SSH#ssh.recv_mac)),
+		    Key = hash(SSH, "E", 8*mac_key_bytes(SSH#ssh.recv_mac)),
 		    {ok, SSH#ssh { recv_mac_key = Key }}
 	    end;
 	aead ->
@@ -1638,13 +1693,15 @@ sha(?'secp384r1') -> sha(secp384r1);
 sha(?'secp521r1') -> sha(secp521r1).
 
 
-mac_key_size('hmac-sha1')    -> 20*8;
-mac_key_size('hmac-sha1-96') -> 20*8;
-mac_key_size('hmac-md5')     -> 16*8;
-mac_key_size('hmac-md5-96')  -> 16*8;
-mac_key_size('hmac-sha2-256')-> 32*8;
-mac_key_size('hmac-sha2-512')-> 512;
-mac_key_size(none) -> 0.
+mac_key_bytes('hmac-sha1')    -> 20;
+mac_key_bytes('hmac-sha1-96') -> 20;
+mac_key_bytes('hmac-md5')     -> 16;
+mac_key_bytes('hmac-md5-96')  -> 16;
+mac_key_bytes('hmac-sha2-256')-> 32;
+mac_key_bytes('hmac-sha2-512')-> 64;
+mac_key_bytes('AEAD_AES_128_GCM') -> 0;
+mac_key_bytes('AEAD_AES_256_GCM') -> 0;
+mac_key_bytes(none) -> 0.
 
 mac_digest_size('hmac-sha1')    -> 20;
 mac_digest_size('hmac-sha1-96') -> 12;
@@ -1669,6 +1726,13 @@ dh_group('diffie-hellman-group1-sha1') ->  ?dh_group1;
 dh_group('diffie-hellman-group14-sha1') -> ?dh_group14.
 
 %%%----------------------------------------------------------------
+parallell_gen_key(Ssh = #ssh{keyex_key = {x, {G, P}},
+                             algorithms = Algs}) ->
+    Sz = dh_bits(Algs),
+    {Public, Private} = generate_key(dh, [P,G,2*Sz]),
+    Ssh#ssh{keyex_key = {{Private, Public}, {G, P}}}.
+
+
 generate_key(Algorithm, Args) ->
     {Public,Private} = crypto:generate_key(Algorithm, Args),
     {crypto:bytes_to_integer(Public), crypto:bytes_to_integer(Private)}.
@@ -1679,6 +1743,15 @@ compute_key(Algorithm, OthersPublic, MyPrivate, Args) ->
     crypto:bytes_to_integer(Shared).
 
 
+dh_bits(#alg{encrypt = Encrypt,
+             send_mac = SendMac}) ->
+    C = cipher(Encrypt),
+    8 * lists:max([C#cipher_data.key_bytes,
+                   C#cipher_data.block_bytes,
+                   C#cipher_data.iv_bytes,
+                   mac_key_bytes(SendMac)
+                  ]).
+
 ecdh_curve('ecdh-sha2-nistp256') -> secp256r1;
 ecdh_curve('ecdh-sha2-nistp384') -> secp384r1;
 ecdh_curve('ecdh-sha2-nistp521') -> secp521r1.