This is a patch to add support for diffie-hellman-group-exchange-sha512, a variant of diffie-hellman-group-exchange-sha1 that computes the exchange hash and the key derivation PRF with SHA512 instead of SHA1. This removes the (largely acedemic) 160-bit bottleneck that prevented ciphers with longer keys from being fully utilised. Note that this patch requires a modified OpenSSL to build (set evp.h's EVP_MAX_MD_SIZE to 64 and rebuild - NB this breaks bincompat). It could be cajoled into working with OpenSSL CVS HEAD with some minor changes.
Created attachment 886 [details] Patch to -current 20050421
Created attachment 906 [details] Revised diff Fix bad kex method name in proposal. Interop tested against patched putty.
Created attachment 907 [details] Patch to add dhgex-sha512 to PuTTY This is the patch for PuTTY that I wrote for testing.
Change of plan: do SHA256 instead of SHA512. Our longest-keyed cipher is 256 bits long and it not likely to get any bigger. Also, SHA512 requires 64-bit math - this doesn't affect us, but others do care. Best of all, SHA256 will fit into all OpenSSL versions' EVP_MAX_MD_SIZE without modification.
Created attachment 939 [details] New diffie-hellman-group-exchange-sha256 exchange Update to -current, go from SHA512 to SHA256
Created attachment 940 [details] Again, with md-sha256.c Doh! that was missing a critical file. Respin.
Created attachment 942 [details] Revised diff Shrink the diff a little by remembering the EVP_MD for the KEX
Created attachment 1019 [details] Patch against CVS 20051105 This patch applied against -current CVS as of 20051105. It is a fair bit small as the parts removing the hardcoded assumptions that the hash will always be SHA1 have been committed already. This will therefore not apply against 4.2 or earlier releases.
This has been committed and will be in OpenSSH 4.4
With the release of 4.4, we believe that this bug is now closed. For information about the release please see http://www.openssh.com/txt/release-4.4 .