Made one small change to the logic. Instead of subtracting -1 at step 6 for
RSA and step 4 for DSS, I first converted the values to bits. Then
subtracted the number of leading 0s in the first byte. I needed to do this
because for bit strengths in RSA with values like 1205, 1206, etc, the
above logic returned1208 always. This is because the first byte was always
non-zero and therefore the length was calculated as 1208. I noticed in all
the cases that if I subtract the number of leading zeroes, I would get the
exact length. Can someone please verify the logic? I have been verifying
this against ssh-keygen -l.
The way I am creating the keys on my server is ssh-keygen -b <str> -t rsa.
My passphrase is always empty.
Is there a case I am missing?
On Tue, Jul 9, 2013 at 6:17 AM, Kalpesh Parekh <kalpesh.ork2_at_gmail.com>wrote:
> This is the logic I have used and tested against a limited set of servers:
> 1) RSA key -
> i) Read the length of identifier
> ii) Skip that many bytes
> iii) Read the length of the exponent
> iv) Skip that many bytes
> v) Read the length of modulus.
> vi) If the first byte of modulus is 0x00 subtract -1 from the length
> of modulus. This is based on the RFC definition of mpint and some examples
> as follows. Example 2 and 3 are noteworthy. The length is 08 and the MSB is
> 0. So no padding with 0x00 was done. But for example 3, the padding was
> done and the length was set to 2.
>
> Examples:
>
> value (hex) representation (hex)
> ----------- --------------------
> 0 00 00 00 00
> 9a378f9b2e332a7 00 00 00 08 09 a3 78 f9 b2 e3 32 a7
> 80 00 00 00 02 00 80
> -1234 00 00 00 02 ed cc
> -deadbeef 00 00 00 05 ff 21 52 41 11
>
> 2) DSA key -
> i) Read the length of identifier
> ii) Skip that many bytes
> iii) Read the length of the modulus
> iv) If the first byte of modulus is 0x00 subtract -1 from the length
> of modulus.
>
> The logic is based off on RFC 4253-page #15 where the DSS key format and
> RSS key formats have been defined. The interpretation of the fields
> p,q,g,y, e and n can be found in RFC 3447, sec 3.1 and FIPS publication
> 186. The commonality is modulus represents (n for RSA and p for DSS) the
> length of the host key in bytes.
>
> Can some one from crypto group confirm if the interpretation is correct?
>
> Alex, I hope I am correct in saying that p,q,g & y form the
> dss_signature_blob and e,n form the rss_signature blob.
>
>
>
>
> On Mon, Jul 8, 2013 at 8:49 AM, Kalpesh Parekh <kalpesh.ork2_at_gmail.com>wrote:
>
>> See this link
>>
>> http://tools.ietf.org/html/rfc4253#page-15
>>
>> Per the link, DSA signature is encoded as follows:
>> string "ssh-dss"
>> string dss_signature_blob
>>
>> RSA signature is encoded as follows:
>> string "ssh-rsa"
>> string rsa_signature_blob
>>
>>
>> On Mon, Jul 8, 2013 at 8:48 AM, Kalpesh Parekh <kalpesh.ork2_at_gmail.com>wrote:
>>
>>> First, apologies for not replying inline to the emails.
>>>
>>> After your suggestions Alex, here is what I could determine.
>>>
>>> I printed out the hex code for the session key for both RSA and DSA
>>> types in my setup.
>>>
>>> Here are the first few bytes:
>>> (RSA) 00 00 00 07 73 73 68 2D 72 73 61 00 00 00 01 23 00 00 00 81
>>>
>>> (DSA) 00 00 00 07 73 73 68 2D 64 73 73 00 00 00 81
>>>
>>> As you mentioned, the first four bytes indicate, the length of the
>>> identifier (7 in this case)
>>> 73 73 68 2D 72 73 61=ssh-rsa
>>> 73 73 68 2D 64 73 73=ssh-dsa
>>>
>>> The next four bytes for RSA indicates some sort of value. In my case it
>>> is #. For DSA, it indicates (length of the key + 1) verified through
>>> ssh-keygen -l command.
>>> For RSA, the last four bytes printed above indicate (length of the key +
>>> 1).
>>>
>>>
>>>
>>>
>>> My next target is to decode the signature blobs. I feel like I am close
>>> and can close this if any one can help.
>>>
>>>
>>>
>>>
>>>
>>>
>>>
>>>
>>> On Thu, Jul 4, 2013 at 3:07 AM, Kalpesh Parekh <kalpesh.ork2_at_gmail.com>wrote:
>>>
>>>> Thanks Alex,
>>>>
>>>> So far it has been helpful.
>>>>
>>>> So based on the RFC, I understand that the host key received from the
>>>> server has following components
>>>> K_S || f || s
>>>>
>>>> I need to parse the K_S part for RSA key. How do I do that.
>>>>
>>>> Also, how can I implement a generic logic for getting the bit strength
>>>> from the host key.
>>>>
>>>>
>>>
>>>
>>
>
_______________________________________________
libssh2-devel http://cool.haxx.se/cgi-bin/mailman/listinfo/libssh2-devel
Received on 2013-07-10