Hi,
I have found yet another incompatibility between ssh2 and the secsh draft.
This time it is publickey user authentication. The draft says:
byte SSH_MSG_USERAUTH_REQUEST
string user name
string service
string "publickey"
boolean TRUE
string public key algorithm name
string public key to be used for authentication
string signature
Signature is a signature by the corresponding private key over the
following data, in this order:
o session identifier, and
o packet payload without the signature.
The problem is with the "service" field, which should contain the service
the client is authenticating for. ssh2 generates signature on a throw-away
packet, which contains a constant "ssh-userauth" in the service field, then
sends a packet containing "ssh-connection", which is obviously not the
"packet payload without the signature". Here's a hex dump of packets what
ssh2 signs, and sends:
This datablock is signed by ssh2:
0x3d 0x2c 0x3e 0x1c 0x2d 0x65 0x4f 0x2b
0x39 0xbc 0xf6 0xb4 0xe4 0x08 0xca 0x0f
0xa3 0x53 0x18 0x88 0x32 0x00 0x00 0x00
0x05 0x62 0x61 0x7a 0x73 0x69 0x00 0x00
0x00 0x0c 0x73 0x73 0x68 0x2d 0x75 0x73
0x65 0x72 0x61 0x75 0x74 0x68 0x00 0x00
0x00 0x09 0x70 0x75 0x62 0x6c 0x69 0x63
0x6b 0x65 0x79 0x01 0x00 0x00 0x00 0x07
0x73 0x73 0x68 0x2d 0x64 0x73 0x73 0x00
0x00 0x01 0xb3 0x00 0x00 0x00 0x07 0x73
0x73 0x68 0x2d 0x64 0x73 0x73 0x00 0x00
0x00 0x81 0x00 0xe7 0x9e 0x22 0xcc 0x85
0x75 0x70 0xdc 0x41 0x36 0x8f 0x21 0xc9
0x0b 0x29 0x00 0x8e 0x5a 0x6a 0xb0 0x3f
0x8a 0xab 0xf5 0xe9 0x4f 0x12 0x44 0x45
0x1b 0xdd 0xd1 0xc6 0x06 0x74 0x58 0x9d
0x2e 0x10 0x6c 0x2c 0xe9 0x4a 0xfe 0xa7
0xf6 0x99 0x6c 0x0a 0x41 0x9c 0x9c 0x4a
0xe2 0xfc 0x18 0xc2 0xe3 0x04 0xe9 0x44
0x6d 0x57 0x38 0x41 0xde 0x5f 0xe3 0xfe
0xb5 0xc5 0xff 0x41 0xb3 0x4a 0x2d 0xcf
0x5a 0x75 0x77 0x9f 0xc6 0x74 0x82 0xa9
0x55 0x39 0x87 0x69 0x40 0xf1 0x02 0xd3
0xb2 0xba 0xb4 0x7b 0xe3 0x18 0x80 0x00
0x32 0x65 0xac 0x29 0x8b 0x57 0xa7 0x82
0xd0 0xa4 0x30 0xb2 0x83 0x97 0x27 0x80
0xc4 0x1e 0xad 0xae 0x8d 0xa9 0x20 0x20
0xa0 0x51 0xa7 0x00 0x00 0x00 0x15 0x00
0xb9 0xfc 0x93 0x7f 0xaf 0x89 0xee 0x89
0x31 0xee 0xc8 0xf9 0x07 0x45 0xa3 0xa1
0x55 0x4c 0xe4 0x6f 0x00 0x00 0x00 0x81
0x00 0xe6 0x57 0x14 0x1c 0x5e 0x1f 0x1f
0xe0 0x41 0xc8 0x96 0xdf 0x34 0x34 0x0b
0x3f 0xaf 0x10 0x80 0x69 0xf7 0x73 0xaa
0x30 0x01 0xa8 0xa4 0xd5 0xba 0xe8 0x58
0x9f 0x11 0x24 0x49 0x67 0x51 0xd1 0x57
0x4e 0xed 0x8c 0x38 0x15 0xb8 0xed 0x8c
0xd7 0xb3 0x9f 0x76 0xee 0xcd 0xf5 0x03
0x5e 0xfc 0xa0 0x6c 0xd7 0x74 0x1c 0x46
0xe1 0x44 0x06 0xdc 0x5d 0x53 0xcf 0xbe
0xf5 0xd4 0x25 0x1d 0xe0 0x25 0x13 0xe3
0xed 0x25 0x31 0x59 0x07 0xb3 0x0d 0x41
0x6f 0x56 0x9f 0x63 0x4d 0x89 0xf1 0xc4
0x67 0xd8 0xd7 0x79 0x9f 0xe9 0xdf 0xa9
0x93 0xf2 0x07 0x46 0xd9 0xf6 0x8b 0x47
0x09 0xee 0xd1 0x4f 0x16 0x73 0x46 0x37
0x20 0x68 0x59 0x2f 0x15 0x86 0x4c 0x05
0xc5 0x00 0x00 0x00 0x81 0x00 0xcd 0x6d
0xeb 0x6f 0xe0 0x00 0x07 0xdc 0x58 0x83
0xd4 0xbc 0x68 0xb3 0x86 0xdf 0x4a 0xb9
0xf4 0xac 0xc9 0xcf 0x64 0x82 0xbb 0x71
0xa7 0x47 0x92 0xa5 0x15 0x42 0x48 0xc3
0xda 0x22 0xc7 0x58 0xe2 0xfd 0xf1 0x18
0xab 0xad 0x48 0x26 0x85 0x3f 0xe0 0xc9
0xba 0xc1 0x35 0xb8 0xb0 0x0a 0xf6 0xda
0x62 0x95 0x59 0x50 0xe5 0xc1 0x87 0x94
0x08 0xf8 0x53 0x76 0x78 0x06 0x58 0x3e
0xc6 0x5e 0xe8 0xe4 0xbe 0xad 0x0a 0x30
0xd8 0xc8 0x27 0x95 0xb8 0xa3 0x90 0x51
0x12 0x3f 0x72 0x54 0x26 0x13 0x99 0x6b
0x54 0x1a 0x71 0xd6 0xf6 0x4b 0xb1 0x28
0x12 0x52 0x51 0xd1 0xe7 0xb6 0xe2 0xe4
0x0e 0x6d 0xc0 0xe3 0xef 0xf7 0xe7 0xd2
0x73 0xd5 0x2b 0x99 0x43 0xd4
And this is what lsh constructs when the packet is received. The first 20
bytes of both packets is the session id.
0x3d 0x2c 0x3e 0x1c 0x2d 0x65 0x4f 0x2b
0x39 0xbc 0xf6 0xb4 0xe4 0x08 0xca 0x0f
0xa3 0x53 0x18 0x88 0x32 0x00 0x00 0x00
0x05 0x62 0x61 0x7a 0x73 0x69 0x00 0x00
0x00 0x0e 0x73 0x73 0x68 0x2d 0x63 0x6f
0x6e 0x6e 0x65 0x63 0x74 0x69 0x6f 0x6e
0x00 0x00 0x00 0x09 0x70 0x75 0x62 0x6c
0x69 0x63 0x6b 0x65 0x79 0x01 0x00 0x00
0x00 0x07 0x73 0x73 0x68 0x2d 0x64 0x73
0x73 0x00 0x00 0x01 0xb3 0x00 0x00 0x00
0x07 0x73 0x73 0x68 0x2d 0x64 0x73 0x73
0x00 0x00 0x00 0x81 0x00 0xe7 0x9e 0x22
0xcc 0x85 0x75 0x70 0xdc 0x41 0x36 0x8f
0x21 0xc9 0x0b 0x29 0x00 0x8e 0x5a 0x6a
0xb0 0x3f 0x8a 0xab 0xf5 0xe9 0x4f 0x12
0x44 0x45 0x1b 0xdd 0xd1 0xc6 0x06 0x74
0x58 0x9d 0x2e 0x10 0x6c 0x2c 0xe9 0x4a
0xfe 0xa7 0xf6 0x99 0x6c 0x0a 0x41 0x9c
0x9c 0x4a 0xe2 0xfc 0x18 0xc2 0xe3 0x04
0xe9 0x44 0x6d 0x57 0x38 0x41 0xde 0x5f
0xe3 0xfe 0xb5 0xc5 0xff 0x41 0xb3 0x4a
0x2d 0xcf 0x5a 0x75 0x77 0x9f 0xc6 0x74
0x82 0xa9 0x55 0x39 0x87 0x69 0x40 0xf1
0x02 0xd3 0xb2 0xba 0xb4 0x7b 0xe3 0x18
0x80 0x00 0x32 0x65 0xac 0x29 0x8b 0x57
0xa7 0x82 0xd0 0xa4 0x30 0xb2 0x83 0x97
0x27 0x80 0xc4 0x1e 0xad 0xae 0x8d 0xa9
0x20 0x20 0xa0 0x51 0xa7 0x00 0x00 0x00
0x15 0x00 0xb9 0xfc 0x93 0x7f 0xaf 0x89
0xee 0x89 0x31 0xee 0xc8 0xf9 0x07 0x45
0xa3 0xa1 0x55 0x4c 0xe4 0x6f 0x00 0x00
0x00 0x81 0x00 0xe6 0x57 0x14 0x1c 0x5e
0x1f 0x1f 0xe0 0x41 0xc8 0x96 0xdf 0x34
0x34 0x0b 0x3f 0xaf 0x10 0x80 0x69 0xf7
0x73 0xaa 0x30 0x01 0xa8 0xa4 0xd5 0xba
0xe8 0x58 0x9f 0x11 0x24 0x49 0x67 0x51
0xd1 0x57 0x4e 0xed 0x8c 0x38 0x15 0xb8
0xed 0x8c 0xd7 0xb3 0x9f 0x76 0xee 0xcd
0xf5 0x03 0x5e 0xfc 0xa0 0x6c 0xd7 0x74
0x1c 0x46 0xe1 0x44 0x06 0xdc 0x5d 0x53
0xcf 0xbe 0xf5 0xd4 0x25 0x1d 0xe0 0x25
0x13 0xe3 0xed 0x25 0x31 0x59 0x07 0xb3
0x0d 0x41 0x6f 0x56 0x9f 0x63 0x4d 0x89
0xf1 0xc4 0x67 0xd8 0xd7 0x79 0x9f 0xe9
0xdf 0xa9 0x93 0xf2 0x07 0x46 0xd9 0xf6
0x8b 0x47 0x09 0xee 0xd1 0x4f 0x16 0x73
0x46 0x37 0x20 0x68 0x59 0x2f 0x15 0x86
0x4c 0x05 0xc5 0x00 0x00 0x00 0x81 0x00
0xcd 0x6d 0xeb 0x6f 0xe0 0x00 0x07 0xdc
0x58 0x83 0xd4 0xbc 0x68 0xb3 0x86 0xdf
0x4a 0xb9 0xf4 0xac 0xc9 0xcf 0x64 0x82
0xbb 0x71 0xa7 0x47 0x92 0xa5 0x15 0x42
0x48 0xc3 0xda 0x22 0xc7 0x58 0xe2 0xfd
0xf1 0x18 0xab 0xad 0x48 0x26 0x85 0x3f
0xe0 0xc9 0xba 0xc1 0x35 0xb8 0xb0 0x0a
0xf6 0xda 0x62 0x95 0x59 0x50 0xe5 0xc1
0x87 0x94 0x08 0xf8 0x53 0x76 0x78 0x06
0x58 0x3e 0xc6 0x5e 0xe8 0xe4 0xbe 0xad
0x0a 0x30 0xd8 0xc8 0x27 0x95 0xb8 0xa3
0x90 0x51 0x12 0x3f 0x72 0x54 0x26 0x13
0x99 0x6b 0x54 0x1a 0x71 0xd6 0xf6 0x4b
0xb1 0x28 0x12 0x52 0x51 0xd1 0xe7 0xb6
0xe2 0xe4 0x0e 0x6d 0xc0 0xe3 0xef 0xf7
0xe7 0xd2 0x73 0xd5 0x2b 0x99 0x43 0xd4
I am trying to add a workaround to lsh.
--
Bazsi
PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1
url: http://www.balabit.hu/pgpkey.txt
PGP signature
