[#10203] Use kex registry to get digest algorithm for non-group kex algorighms. #1603
Conversation
| @@ -1454,7 +1454,7 @@ def _ssh_KEXDH_INIT(self, packet): | |||
| self.g, self.p = _kex.getDHGeneratorAndPrime(self.kexAlg) | |||
| self._startEphemeralDH() | |||
| sharedSecret = self._finishEphemeralDH(clientDHpublicKey) | |||
| h = sha1() | |||
| h = _kex.getHashProcessor(self.kexAlg)() | |||
There was a problem hiding this comment.
It looks like this will allow any of these algorithms (from _kex.py):
- curve25519-sha256
- curve25519-sha256@libssh.org
- diffie-hellman-group-exchange-sha256
- diffie-hellman-group-exchange-sha1
- diffie-hellman-group14-sha1
- ecdh-sha2-nistp256
- ecdh-sha2-nistp384
- ecdh-sha2-nistp521
Looking at the implementations, these are all sha1, sha256, sha384 or sha512. Perhaps the change fragment should mention the newly supported algorithms?
There was a problem hiding this comment.
Many thanks for the prompt review :) Much appreciated.
This is called only for "non-group key exchange" aka kex._IFixedGroupKexAlgorithm
The only fixed group that is still supported "upstream" by Twisted is "diffie-hellman-group14-sha1"
diffie-hellman-group1-sha1 was removed in #747 ... but it is not hard to monkey patch Twisted and add back support for it. I am doing it for my production code.
The main change in this PR is to make it easy to monkey patch support for
diffie-hellman-group14-sha256
diffie-hellman-group16-sha512
diffie-hellman-group18-sha512
I have created ticket https://twistedmatrix.com/trac/ticket/10202 for that... but I don't know if other devs are interested into adding legacy KEX algorithms to Twisted.
Scope and purpose
This refactors the SSH transport server and client side to not use hardcoded SHA1
No tests were added as this is just an internal refactoring.
This make it easier to implement diffie-hellman-group14-sha256 in the future in https://twistedmatrix.com/trac/ticket/10202
Contributor Checklist:
tox -e lintto format my patch to meet the Twisted Coding Standard#character).reviewto the keywords field in Trac, and putting a link to this PR in the comment; it shows up in https://twisted.reviews/ now.The first line is automatically generated by GitHub based on PR ID and branch name.
The other lines generated by GitHub should be replaced.