Add support for ECDH key exchange about libssh2 HOT 14 CLOSED

I have ECDH using OpenSSL support done on a private fork; I just need some time to merge it back into master and create a pull request.

from libssh2.

Slightly off-thread: Will Cosgrove worked on diffie-hellman-group-exchange-sha256 support back in January:
http://www.libssh2.org/mail/libssh2-devel-archive-2015-01/0004.shtml

from libssh2.

This is getting somewhat urgent. libssh2 only supports the following key exchange protocols: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1

But OpenSSH now disables diffie-hellman-group1-sha1 by default, and SHA1 in general is considered broken so the rest of libssh2's key exchange protocols are bound to follow suite. Indeed some SSH hardening guides recommend only supporting [email protected] and diffie-hellman-group-exchange-sha256, neither of which libssh2 supports.

from libssh2.

We accept pull requests as well as good old patches mailed to the mailing list.

from libssh2.

@fgouget libssh2 does support diffie-hellman-group-exchange-sha256 in the most recent version (1.7.0). The website hasn't been updated yet with this info.

@Badger Could you update the website to include this info?

from libssh2.

done!

from libssh2.

I am also looking for ECDH support in libssh2. Hope you find the time to merge back your changes :-)

from libssh2.

Any news on this, @willco007? :)

from libssh2.

@ehamberg Thanks for the reminder. I finally shipped the project I've been working on and will have some time in the coming weeks to get my changes into a pull request.

I've been continuing to work on my private fork. I've recently added OpenSSH key file format support. At this point I have diverged quite a bit from the official release (ECDHA, ED25519, ETM support, OpenSSH keys). The problems are:

1. my changes are numerous; someone needs to review them for the project in a timely manor
2. the crypto-related changes only work using OpenSSL
3. getting someone who uses the other crypto backends to make sure they don't blow up and/or getting them ported to those backends. Any takers out there? :)

from libssh2.

I've implemented ECDH nistp384 on my local sandbox. I have tested this against openssh 7.3p1. Mine too works only with openssl. I can review the ECDH code. I've never used gcrypt etc , so I won't be of much help

from libssh2.

@prem-nm great! I'm merging my changes now and will let you know when I submit the pull request.

from libssh2.

@prem-nm have you had a chance to look over/try my pull request?

from libssh2.

@willco007 , I had a look and I have commented. Good job !

from libssh2.

ECDSA support has been merged in, closing.

from libssh2.