Merge branch 'hans/ssh/dh_group_exc_optimize/OTP-14169' into maint-18

* hans/ssh/dh_group_exc_optimize/OTP-14169:
  ssh: optimize kex dh_gex using new crypto functionality
  crypto: Added optional length to paramlist in generate_key
  ssh,crypto: prepare for release

# Conflicts:
#	lib/ssh/src/ssh_transport.erl

7 files changed, 130 insertions, 38 deletions

diff --git a/lib/crypto/c_src/crypto.c b/lib/crypto/c_src/crypto.c
index 4966701e41..b39653bcb8 100644
--- a/lib/crypto/c_src/crypto.c
+++ b/lib/crypto/c_src/crypto.c
@@ -403,7 +403,7 @@ static ErlNifFunc nif_funcs[] = {
     {"rsa_private_crypt", 4, rsa_private_crypt},
     {"dh_generate_parameters_nif", 2, dh_generate_parameters_nif},
     {"dh_check", 1, dh_check},
-    {"dh_generate_key_nif", 3, dh_generate_key_nif},
+    {"dh_generate_key_nif", 4, dh_generate_key_nif},
     {"dh_compute_key_nif", 3, dh_compute_key_nif},
     {"srp_value_B_nif", 5, srp_value_B_nif},
     {"srp_user_secret_nif", 7, srp_user_secret_nif},
@@ -3062,12 +3062,13 @@ static ERL_NIF_TERM dh_check(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[]
 }   
 
 static ERL_NIF_TERM dh_generate_key_nif(ErlNifEnv* env, int argc, const ERL_NIF_TERM argv[])
-{/* (PrivKey, DHParams=[P,G], Mpint) */
+{/* (PrivKey|undefined, DHParams=[P,G], Mpint, Len|0) */
     DH* dh_params;
     int pub_len, prv_len;
     unsigned char *pub_ptr, *prv_ptr;
     ERL_NIF_TERM ret, ret_pub, ret_prv, head, tail;
     int mpint; /* 0 or 4 */
+    unsigned long len = 0;
 
     CHECK_OSE_CRYPTO();
 
@@ -3080,11 +3081,21 @@ static ERL_NIF_TERM dh_generate_key_nif(ErlNifEnv* env, int argc, const ERL_NIF_
 	|| !enif_get_list_cell(env, tail, &head, &tail)
 	|| !get_bn_from_bin(env, head, &dh_params->g)
 	|| !enif_is_empty_list(env, tail)
-	|| !enif_get_int(env, argv[2], &mpint) || (mpint & ~4)) {
+	|| !enif_get_int(env, argv[2], &mpint) || (mpint & ~4)
+	|| !enif_get_ulong(env, argv[3], &len)  ) {
 	DH_free(dh_params);
 	return enif_make_badarg(env);
     }
 
+    if (len) {
+        if (len < BN_num_bits(dh_params->p))
+            dh_params->length = len;
+        else {
+            DH_free(dh_params);
+            return enif_make_badarg(env);
+        }
+    }
+
     if (DH_generate_key(dh_params)) {
 	pub_len = BN_num_bytes(dh_params->pub_key);
 	prv_len = BN_num_bytes(dh_params->priv_key);    
diff --git a/lib/crypto/src/crypto.erl b/lib/crypto/src/crypto.erl
index 38e71591f3..1150fd60e0 100644
--- a/lib/crypto/src/crypto.erl
+++ b/lib/crypto/src/crypto.erl
@@ -574,9 +574,15 @@ exor(Bin1, Bin2) ->
 generate_key(Type, Params) ->
     generate_key(Type, Params, undefined).
 
-generate_key(dh, DHParameters, PrivateKey) ->
+generate_key(dh, DHParameters0, PrivateKey) ->
+    {DHParameters, Len} =
+        case DHParameters0 of
+            [P,G,L] -> {[P,G], L};
+            [P,G] -> {[P,G], 0}
+        end,
     dh_generate_key_nif(ensure_int_as_bin(PrivateKey),
-			map_ensure_int_as_bin(DHParameters), 0);
+			map_ensure_int_as_bin(DHParameters),
+                        0, Len);
 
 generate_key(srp, {host, [Verifier, Generator, Prime, Version]}, PrivArg)
   when is_binary(Verifier), is_binary(Generator), is_binary(Prime), is_atom(Version) ->
@@ -1555,11 +1561,11 @@ dh_check([_Prime,_Gen]) -> ?nif_stub.
 			     {binary(),binary()}.
 
 dh_generate_key(DHParameters) ->
-    dh_generate_key_nif(undefined, map_mpint_to_bin(DHParameters), 4).
+    dh_generate_key_nif(undefined, map_mpint_to_bin(DHParameters), 4, 0).
 dh_generate_key(PrivateKey, DHParameters) ->
-    dh_generate_key_nif(mpint_to_bin(PrivateKey), map_mpint_to_bin(DHParameters), 4).
+    dh_generate_key_nif(mpint_to_bin(PrivateKey), map_mpint_to_bin(DHParameters), 4, 0).
 
-dh_generate_key_nif(_PrivateKey, _DHParameters, _Mpint) -> ?nif_stub.
+dh_generate_key_nif(_PrivateKey, _DHParameters, _Mpint, _Length) -> ?nif_stub.
 
 %% DHParameters = [P (Prime)= mpint(), G(Generator) = mpint()]
 %% MyPrivKey, OthersPublicKey = mpint()
diff --git a/lib/crypto/vsn.mk b/lib/crypto/vsn.mk
index 6dcb28ec8a..e3fb89ced2 100644
--- a/lib/crypto/vsn.mk
+++ b/lib/crypto/vsn.mk
@@ -1 +1 @@
-CRYPTO_VSN = 3.6.3
+CRYPTO_VSN = 3.6.3.1
diff --git a/lib/ssh/src/ssh.app.src b/lib/ssh/src/ssh.app.src
index 4a76fd9cd3..cb0f087cfb 100644
--- a/lib/ssh/src/ssh.app.src
+++ b/lib/ssh/src/ssh.app.src
@@ -40,6 +40,6 @@
   {env, []},
   {mod, {ssh_app, []}},
   {runtime_dependencies, ["stdlib-2.3","public_key-0.22","kernel-3.0",
-			  "erts-6.0","crypto-3.3"]}]}.
+			  "erts-6.0","crypto-3.6.3.1"]}]}.
 
 
diff --git a/lib/ssh/src/ssh_connection_handler.erl b/lib/ssh/src/ssh_connection_handler.erl
index b73f8b23d2..8c73bb8946 100644
--- a/lib/ssh/src/ssh_connection_handler.erl
+++ b/lib/ssh/src/ssh_connection_handler.erl
@@ -429,14 +429,16 @@ key_exchange(#ssh_msg_kexdh_reply{} = Msg,
 
 key_exchange(#ssh_msg_kex_dh_gex_request{} = Msg, 
 	     #state{ssh_params = #ssh{role = server} = Ssh0} = State) ->
-    {ok, GexGroup, Ssh} = ssh_transport:handle_kex_dh_gex_request(Msg, Ssh0),
+    {ok, GexGroup, Ssh1} = ssh_transport:handle_kex_dh_gex_request(Msg, Ssh0),
     send_msg(GexGroup, State),
+    Ssh = ssh_transport:parallell_gen_key(Ssh1),
     {next_state, key_exchange_dh_gex_init, next_packet(State#state{ssh_params = Ssh})};
 
 key_exchange(#ssh_msg_kex_dh_gex_request_old{} = Msg, 
 	     #state{ssh_params = #ssh{role = server} = Ssh0} = State) ->
-    {ok, GexGroup, Ssh} = ssh_transport:handle_kex_dh_gex_request(Msg, Ssh0),
+    {ok, GexGroup, Ssh1} = ssh_transport:handle_kex_dh_gex_request(Msg, Ssh0),
     send_msg(GexGroup, State),
+    Ssh = ssh_transport:parallell_gen_key(Ssh1),
     {next_state, key_exchange_dh_gex_init, next_packet(State#state{ssh_params = Ssh})};
 
 key_exchange(#ssh_msg_kex_dh_gex_group{} = Msg, 
diff --git a/lib/ssh/src/ssh_transport.erl b/lib/ssh/src/ssh_transport.erl
index 2ea87a9002..5391df723c 100644
--- a/lib/ssh/src/ssh_transport.erl
+++ b/lib/ssh/src/ssh_transport.erl
@@ -44,6 +44,7 @@
 	 handle_kexdh_reply/2, 
 	 handle_kex_ecdh_init/2,
 	 handle_kex_ecdh_reply/2,
+         parallell_gen_key/1,
 	 extract_public_key/1,
 	 ssh_packet/2, pack/2,
 	 sign/3, verify/4]).
@@ -287,9 +288,6 @@ handle_kexinit_msg(#ssh_msg_kexinit{} = CounterPart, #ssh_msg_kexinit{} = Own,
     end.
 
 
-%% TODO: diffie-hellman-group14-sha1 should also be supported.
-%% Maybe check more things ...
-
 verify_algorithm(#alg{kex = undefined}) -> false;
 verify_algorithm(#alg{hkey = undefined}) -> false;
 verify_algorithm(#alg{send_mac = undefined}) -> false;
@@ -307,17 +305,29 @@ verify_algorithm(#alg{kex = Kex}) -> lists:member(Kex, supported_algorithms(kex)
 key_exchange_first_msg(Kex, Ssh0) when Kex == 'diffie-hellman-group1-sha1' ;
 				       Kex == 'diffie-hellman-group14-sha1' ->
     {G, P} = dh_group(Kex),
-    {Public, Private} = generate_key(dh, [P,G]),
+    Sz = dh_bits(Ssh0#ssh.algorithms),
+    {Public, Private} = generate_key(dh, [P,G,2*Sz]),
     {SshPacket, Ssh1} = ssh_packet(#ssh_msg_kexdh_init{e = Public}, Ssh0),
     {ok, SshPacket, 
      Ssh1#ssh{keyex_key = {{Private, Public}, {G, P}}}};
 
 key_exchange_first_msg(Kex, Ssh0=#ssh{opts=Opts}) when Kex == 'diffie-hellman-group-exchange-sha1' ;
 						       Kex == 'diffie-hellman-group-exchange-sha256' ->
-    {Min,NBits,Max} = 
+    {Min,NBits0,Max} = 
 	proplists:get_value(dh_gex_limits, Opts, {?DEFAULT_DH_GROUP_MIN,
 						  ?DEFAULT_DH_GROUP_NBITS,
 						  ?DEFAULT_DH_GROUP_MAX}),
+    DhBits = dh_bits(Ssh0#ssh.algorithms),
+    NBits1 = 
+        %% NIST Special Publication 800-57 Part 1 Revision 4: Recommendation for Key Management
+        if 
+            DhBits =< 112 -> 2048;
+            DhBits =< 128 -> 3072;
+            DhBits =< 192 -> 7680;
+            true -> 8192
+        end,
+    NBits = min(max(max(NBits0,NBits1),Min), Max),
+    
     {SshPacket, Ssh1} = 
 	ssh_packet(#ssh_msg_kex_dh_gex_request{min = Min, 
 					       n = NBits,
@@ -341,12 +351,13 @@ key_exchange_first_msg(Kex, Ssh0) when Kex == 'ecdh-sha2-nistp256' ;
 %%% diffie-hellman-group14-sha1
 %%% 
 handle_kexdh_init(#ssh_msg_kexdh_init{e = E}, 
-		  Ssh0 = #ssh{algorithms = #alg{kex=Kex}}) ->
+		  Ssh0 = #ssh{algorithms = #alg{kex=Kex} = Algs}) ->
     %% server
     {G, P} = dh_group(Kex),
     if
 	1=<E, E=<(P-1) ->
-	    {Public, Private} = generate_key(dh, [P,G]),
+            Sz = dh_bits(Algs),
+	    {Public, Private} = generate_key(dh, [P,G,2*Sz]),
 	    K = compute_key(dh, E, Private, [P,G]),
 	    MyPrivHostKey = get_host_key(Ssh0),
 	    MyPubHostKey = extract_public_key(MyPrivHostKey),
@@ -418,12 +429,11 @@ handle_kex_dh_gex_request(#ssh_msg_kex_dh_gex_request{min = Min0,
     {Min, Max} = adjust_gex_min_max(Min0, Max0, Opts),
     case public_key:dh_gex_group(Min, NBits, Max,
 				 proplists:get_value(dh_gex_groups,Opts)) of
-	{ok, {_Sz, {G,P}}} ->
-	    {Public, Private} = generate_key(dh, [P,G]),
+	{ok, {_, {G,P}}} ->
 	    {SshPacket, Ssh} = 
 		ssh_packet(#ssh_msg_kex_dh_gex_group{p = P, g = G}, Ssh0),
 	    {ok, SshPacket, 
-	     Ssh#ssh{keyex_key = {{Private, Public}, {G, P}},
+             Ssh#ssh{keyex_key = {x, {G, P}},
 		     keyex_info = {Min0, Max0, NBits}
 		    }};
 	{error,_} ->
@@ -452,12 +462,11 @@ handle_kex_dh_gex_request(#ssh_msg_kex_dh_gex_request_old{n = NBits},
     {Min, Max} = adjust_gex_min_max(Min0, Max0, Opts),
     case public_key:dh_gex_group(Min, NBits, Max,
 				 proplists:get_value(dh_gex_groups,Opts)) of
-	{ok, {_Sz, {G,P}}} ->
-	    {Public, Private} = generate_key(dh, [P,G]),
+	{ok, {_, {G,P}}} ->
 	    {SshPacket, Ssh} = 
 		ssh_packet(#ssh_msg_kex_dh_gex_group{p = P, g = G}, Ssh0),
 	    {ok, SshPacket, 
-	     Ssh#ssh{keyex_key = {{Private, Public}, {G, P}},
+	     Ssh#ssh{keyex_key = {x, {G, P}},
 		     keyex_info = {-1, -1, NBits} % flag for kex_h hash calc
 		    }};
 	{error,_} ->
@@ -497,7 +506,8 @@ adjust_gex_min_max(Min0, Max0, Opts) ->
 
 handle_kex_dh_gex_group(#ssh_msg_kex_dh_gex_group{p = P, g = G}, Ssh0) ->
     %% client
-    {Public, Private} = generate_key(dh, [P,G]),
+    Sz = dh_bits(Ssh0#ssh.algorithms),
+    {Public, Private} = generate_key(dh, [P,G,2*Sz]),
     {SshPacket, Ssh1} = 
 	ssh_packet(#ssh_msg_kex_dh_gex_init{e = Public}, Ssh0),	% Pub = G^Priv mod P (def)
 
@@ -1108,6 +1118,51 @@ verify(PlainText, Hash, Sig, Key) ->
 %%  
 %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
 
+%%% Unit: bytes
+
+-record(cipher_data, {
+          key_bytes,
+          iv_bytes,
+          block_bytes
+         }).
+
+%%% Start of a more parameterized crypto handling.
+cipher('AEAD_AES_128_GCM') ->
+    #cipher_data{key_bytes = 16,
+                 iv_bytes = 12,
+                 block_bytes = 16};
+
+cipher('AEAD_AES_256_GCM') ->
+    #cipher_data{key_bytes = 32,
+                 iv_bytes = 12,
+                 block_bytes = 16};
+
+cipher('3des-cbc') ->
+    #cipher_data{key_bytes = 24,
+                 iv_bytes = 8,
+                 block_bytes = 8};
+    
+cipher('aes128-cbc') ->
+    #cipher_data{key_bytes = 16,
+                 iv_bytes = 16,
+                 block_bytes = 16};
+
+cipher('aes128-ctr') ->
+    #cipher_data{key_bytes = 16,
+                 iv_bytes = 16,
+                 block_bytes = 16};
+
+cipher('aes192-ctr') ->
+    #cipher_data{key_bytes = 24,
+                 iv_bytes = 16,
+                 block_bytes = 16};
+
+cipher('aes256-ctr') ->
+    #cipher_data{key_bytes = 32,
+                 iv_bytes = 16,
+                 block_bytes = 16}.
+
+
 encrypt_init(#ssh{encrypt = none} = Ssh) ->
     {ok, Ssh};
 encrypt_init(#ssh{encrypt = 'AEAD_AES_128_GCM', role = client} = Ssh) ->
@@ -1488,11 +1543,11 @@ send_mac_init(SSH) ->
 	common ->
 	    case SSH#ssh.role of
 		client ->
-		    KeySize = mac_key_size(SSH#ssh.send_mac),
+		    KeySize = 8*mac_key_bytes(SSH#ssh.send_mac),
 		    Key = hash(SSH, "E", KeySize),
 		    {ok, SSH#ssh { send_mac_key = Key }};
 		server ->
-		    KeySize = mac_key_size(SSH#ssh.send_mac),
+		    KeySize = 8*mac_key_bytes(SSH#ssh.send_mac),
 		    Key = hash(SSH, "F", KeySize),
 		    {ok, SSH#ssh { send_mac_key = Key }}
 	    end;
@@ -1511,10 +1566,10 @@ recv_mac_init(SSH) ->
 	common ->
 	    case SSH#ssh.role of
 		client ->
-		    Key = hash(SSH, "F", mac_key_size(SSH#ssh.recv_mac)),
+		    Key = hash(SSH, "F", 8*mac_key_bytes(SSH#ssh.recv_mac)),
 		    {ok, SSH#ssh { recv_mac_key = Key }};
 		server ->
-		    Key = hash(SSH, "E", mac_key_size(SSH#ssh.recv_mac)),
+		    Key = hash(SSH, "E", 8*mac_key_bytes(SSH#ssh.recv_mac)),
 		    {ok, SSH#ssh { recv_mac_key = Key }}
 	    end;
 	aead ->
@@ -1638,13 +1693,15 @@ sha(?'secp384r1') -> sha(secp384r1);
 sha(?'secp521r1') -> sha(secp521r1).
 
 
-mac_key_size('hmac-sha1')    -> 20*8;
-mac_key_size('hmac-sha1-96') -> 20*8;
-mac_key_size('hmac-md5')     -> 16*8;
-mac_key_size('hmac-md5-96')  -> 16*8;
-mac_key_size('hmac-sha2-256')-> 32*8;
-mac_key_size('hmac-sha2-512')-> 512;
-mac_key_size(none) -> 0.
+mac_key_bytes('hmac-sha1')    -> 20;
+mac_key_bytes('hmac-sha1-96') -> 20;
+mac_key_bytes('hmac-md5')     -> 16;
+mac_key_bytes('hmac-md5-96')  -> 16;
+mac_key_bytes('hmac-sha2-256')-> 32;
+mac_key_bytes('hmac-sha2-512')-> 64;
+mac_key_bytes('AEAD_AES_128_GCM') -> 0;
+mac_key_bytes('AEAD_AES_256_GCM') -> 0;
+mac_key_bytes(none) -> 0.
 
 mac_digest_size('hmac-sha1')    -> 20;
 mac_digest_size('hmac-sha1-96') -> 12;
@@ -1669,6 +1726,13 @@ dh_group('diffie-hellman-group1-sha1') ->  ?dh_group1;
 dh_group('diffie-hellman-group14-sha1') -> ?dh_group14.
 
 %%%----------------------------------------------------------------
+parallell_gen_key(Ssh = #ssh{keyex_key = {x, {G, P}},
+                             algorithms = Algs}) ->
+    Sz = dh_bits(Algs),
+    {Public, Private} = generate_key(dh, [P,G,2*Sz]),
+    Ssh#ssh{keyex_key = {{Private, Public}, {G, P}}}.
+
+
 generate_key(Algorithm, Args) ->
     {Public,Private} = crypto:generate_key(Algorithm, Args),
     {crypto:bytes_to_integer(Public), crypto:bytes_to_integer(Private)}.
@@ -1679,6 +1743,15 @@ compute_key(Algorithm, OthersPublic, MyPrivate, Args) ->
     crypto:bytes_to_integer(Shared).
 
 
+dh_bits(#alg{encrypt = Encrypt,
+             send_mac = SendMac}) ->
+    C = cipher(Encrypt),
+    8 * lists:max([C#cipher_data.key_bytes,
+                   C#cipher_data.block_bytes,
+                   C#cipher_data.iv_bytes,
+                   mac_key_bytes(SendMac)
+                  ]).
+
 ecdh_curve('ecdh-sha2-nistp256') -> secp256r1;
 ecdh_curve('ecdh-sha2-nistp384') -> secp384r1;
 ecdh_curve('ecdh-sha2-nistp521') -> secp521r1.
diff --git a/lib/ssh/vsn.mk b/lib/ssh/vsn.mk
index c62faf8357..bfe2fcbc0b 100644
--- a/lib/ssh/vsn.mk
+++ b/lib/ssh/vsn.mk
@@ -1,5 +1,5 @@
 #-*-makefile-*-   ; force emacs to enter makefile-mode
 
-SSH_VSN = 4.2.2.2
+SSH_VSN = 4.2.2.3
 
 APP_VSN    = "ssh-$(SSH_VSN)"