I'm trying to implement SSH2 key exchange in Java, and having some difficulties. The RFC4419 states, that:

The server responds with:

 string  server public host key and certificates (K_S)
 mpint   f
 string  signature of H

My question is - how the "server public host key and certificates (K_S)" should be composed? Where can I find this information?

I have host public and private key, and can read all information needed like for example:

 Read the required variables from the public key.
DSAParams pubKeyDSAParams = ((DSAPublicKey) pair.getPublic()).getParams();
BigInteger p = pubKeyDSAParams.getP();
BigInteger q = pubKeyDSAParams.getQ();
BigInteger g = pubKeyDSAParams.getG();

Read the private exponent from the private key.
DSAPrivateKey privKey = (DSAPrivateKey) pair.getPrivate();
BigInteger x = privKey.getX();
  • from looking at Wireshark I believe it's a string of bytes, not necessarily a string of ASCII characters. Same goes for the 'signature of H' – RoraΖ Apr 29 '15 at 14:08
  • Yes. The answer found myself and answered below. Now breaking the ice further with SSH2 and Java :) I'm noticed that very few authors exists who implemented SSH2 in Java.. – Ernestas Gruodis Apr 29 '15 at 15:32

Found the answer myself in RFC4253:

Signatures are encoded as follows:

  string    signature format identifier (as specified by the
            public key/certificate format)
  byte[n]   signature blob in format specific encoding.

The "ssh-dss" key format has the following specific encoding:

  string    "ssh-dss"
  mpint     p
  mpint     q
  mpint     g
  mpint     y

Here, the 'p', 'q', 'g', and 'y' parameters form the signature key blob.

Signature formats:

The following public key and/or certificate formats are currently defined:

   ssh-dss           REQUIRED     sign   Raw DSS Key
   ssh-rsa           RECOMMENDED  sign   Raw RSA Key
   pgp-sign-rsa      OPTIONAL     sign   OpenPGP certificates (RSA key)
   pgp-sign-dss      OPTIONAL     sign   OpenPGP certificates (DSS key)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.