Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

OpenSSH 6.2 offers the following key exchange algorithms by default

ecdh-sha2-nistp256
ecdh-sha2-nistp384
ecdh-sha2-nistp521
diffie-hellman-group-exchange-sha256
diffie-hellman-group-exchange-sha1
diffie-hellman-group14-sha1
diffie-hellman-group1-sha1

The group size of the first three is obvious. The same holds for the last two. But it's unclear which group the two algorithms

diffie-hellman-group-exchange-sha256
diffie-hellman-group-exchange-sha1

operate on. It's hard to accept that such an important point of security is undocumented. The RFC 4419 says nothing about it and so does the manpage of openSSH. Can someone put some light on this please?

share|improve this question

migrated from unix.stackexchange.com Jul 26 '13 at 14:22

This question came from our site for users of Linux, FreeBSD and other Un*x-like operating systems..

    
I'd guess that this depends on the implementations. I'm not familiar with SSH, but with many protocols one of the two end points chooses a group. –  CodesInChaos Jul 26 '13 at 14:27

2 Answers 2

up vote 3 down vote accepted

A DH group is defined by a prime modulus and a generator. The prime modulus is a bit expensive to generate, so OpenSSH will not do that on a general basis. Instead, sshd will, upon receiving a connection, use one of the groups in the /etc/ssh/moduli files. That file contains pre-generated moduli of various sizes. You can use the one provided with OpenSSH, or generate your own with ssh-keygen; see the man page (there is no security issue in using the same group as other people, but nevertheless, for some psychological reason, some sysadmins experience a feeling of higher security when they generate their own moduli).

The actual selection process is, in OpenSSH source code, in the choose_dh() function in the dh.c file. Roughly speaking, if the client wants at least min bits, at most max bits, and preferably n bits, then the server will choose among the moduli in the min..max range; it will try to get the smallest modulus which exceeds n, and, if there is none, the biggest modulus it has (still in the min..max range, of course). If the server finds several modulus of the same "optimal" length, then it selects one randomly. If the server knows of no modulus in the min..max range, then connection fails.

The default /etc/ssh/moduli, at least on my server, appears to have moduli of size 1023 to 8191 bits.

share|improve this answer

From the RFC4419:

The client requests a modulus from the server indicating the
preferred size. In the following description (C is the client, S is
the server, the modulus p is a large safe prime, and g is a generator for a subgroup of GF(p), min is the minimal size of p in bits that is acceptable to the client, n is the size of the modulus p in bits that the client would like to receive from the server, max is the maximal
size of p in bits that the client can accept, V_S is S's version
string, V_C is C's version string, K_S is S's public host key, I_C is C's KEXINIT message, and I_S is S's KEXINIT message that has been
exchanged before this part begins):

  1. C sends "min || n || max" to S, indicating the minimal acceptable group size, the preferred size of the group, and the maximal group size in bits the client will accept.

  2. S finds a group that best matches the client's request, and sends "p || g" to C.

  3. C generates a random number x, where 1 < x < (p-1)/2. It computes e = g^x mod p, and sends "e" to S.

So the client asks for the key to be between a minimum and a maximum and the server decides which of his groups matches.

share|improve this answer
    
Ok. But this does not answer the question about which min and max openssh uses. –  fr00tyl00p Jul 26 '13 at 15:28
    
Thomas has answered that with 1023 to 8191 bits and on FreeBSD the same is standard. –  Raphael Ahrens Jul 26 '13 at 17:56

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.