2

I'm trying to implement SSH2 key exchange in Java, and having some difficulties. The RFC4419 states, that:

The server responds with:

 byte    SSH_MSG_KEX_DH_GEX_REPLY
 string  server public host key and certificates (K_S)
 mpint   f
 string  signature of H

My question is - how the "server public host key and certificates (K_S)" should be composed? Where can I find this information?

I have host public and private key, and can read all information needed like for example:

/*
 Read the required variables from the public key.
 */
DSAParams pubKeyDSAParams = ((DSAPublicKey) pair.getPublic()).getParams();
BigInteger p = pubKeyDSAParams.getP();
BigInteger q = pubKeyDSAParams.getQ();
BigInteger g = pubKeyDSAParams.getG();

/*
Read the private exponent from the private key.
 */
DSAPrivateKey privKey = (DSAPrivateKey) pair.getPrivate();
BigInteger x = privKey.getX();
2
  • from looking at Wireshark I believe it's a string of bytes, not necessarily a string of ASCII characters. Same goes for the 'signature of H'
    – RoraΖ
    Apr 29, 2015 at 14:08
  • Yes. The answer found myself and answered below. Now breaking the ice further with SSH2 and Java :) I'm noticed that very few authors exists who implemented SSH2 in Java.. Apr 29, 2015 at 15:32

1 Answer 1

1

Found the answer myself in RFC4253:

Signatures are encoded as follows:

  string    signature format identifier (as specified by the
            public key/certificate format)
  byte[n]   signature blob in format specific encoding.

The "ssh-dss" key format has the following specific encoding:

  string    "ssh-dss"
  mpint     p
  mpint     q
  mpint     g
  mpint     y

Here, the 'p', 'q', 'g', and 'y' parameters form the signature key blob.

Signature formats:

The following public key and/or certificate formats are currently defined:

   ssh-dss           REQUIRED     sign   Raw DSS Key
   ssh-rsa           RECOMMENDED  sign   Raw RSA Key
   pgp-sign-rsa      OPTIONAL     sign   OpenPGP certificates (RSA key)
   pgp-sign-dss      OPTIONAL     sign   OpenPGP certificates (DSS key)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .