[gssapi-openssh.git] / openssh / dh.c

/* $OpenBSD: dh.c,v 1.44 2006/11/07 13:02:07 markus Exp $ */
/*
 * Copyright (c) 2000 Niels Provos.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */

#include "includes.h"

#include <sys/param.h>

#include <openssl/bn.h>
#include <openssl/dh.h>

#include <stdarg.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#include "dh.h"
#include "pathnames.h"
#include "log.h"
#include "misc.h"

static int
parse_prime(int linenum, char *line, struct dhgroup *dhg)
{
	char *cp, *arg;
	char *strsize, *gen, *prime;
	const char *errstr = NULL;

	cp = line;
	if ((arg = strdelim(&cp)) == NULL)
		return 0;
	/* Ignore leading whitespace */
	if (*arg == '\0')
		arg = strdelim(&cp);
	if (!arg || !*arg || *arg == '#')
		return 0;

	/* time */
	if (cp == NULL || *arg == '\0')
		goto fail;
	arg = strsep(&cp, " "); /* type */
	if (cp == NULL || *arg == '\0')
		goto fail;
	arg = strsep(&cp, " "); /* tests */
	if (cp == NULL || *arg == '\0')
		goto fail;
	arg = strsep(&cp, " "); /* tries */
	if (cp == NULL || *arg == '\0')
		goto fail;
	strsize = strsep(&cp, " "); /* size */
	if (cp == NULL || *strsize == '\0' ||
	    (dhg->size = (u_int)strtonum(strsize, 0, 64*1024, &errstr)) == 0 ||
	    errstr)
		goto fail;
	/* The whole group is one bit larger */
	dhg->size++;
	gen = strsep(&cp, " "); /* gen */
	if (cp == NULL || *gen == '\0')
		goto fail;
	prime = strsep(&cp, " "); /* prime */
	if (cp != NULL || *prime == '\0')
		goto fail;

	if ((dhg->g = BN_new()) == NULL)
		fatal("parse_prime: BN_new failed");
	if ((dhg->p = BN_new()) == NULL)
		fatal("parse_prime: BN_new failed");
	if (BN_hex2bn(&dhg->g, gen) == 0)
		goto failclean;

	if (BN_hex2bn(&dhg->p, prime) == 0)
		goto failclean;

	if (BN_num_bits(dhg->p) != dhg->size)
		goto failclean;

	if (BN_is_zero(dhg->g) || BN_is_one(dhg->g))
		goto failclean;

	return (1);

 failclean:
	BN_clear_free(dhg->g);
	BN_clear_free(dhg->p);
 fail:
	error("Bad prime description in line %d", linenum);
	return (0);
}

DH *
choose_dh(int min, int wantbits, int max)
{
	FILE *f;
	char line[4096];
	int best, bestcount, which;
	int linenum;
	struct dhgroup dhg;

	if ((f = fopen(_PATH_DH_MODULI, "r")) == NULL &&
	    (f = fopen(_PATH_DH_PRIMES, "r")) == NULL) {
		logit("WARNING: %s does not exist, using fixed modulus",
		    _PATH_DH_MODULI);
		return (dh_new_group14());
	}

	linenum = 0;
	best = bestcount = 0;
	while (fgets(line, sizeof(line), f)) {
		linenum++;
		if (!parse_prime(linenum, line, &dhg))
			continue;
		BN_clear_free(dhg.g);
		BN_clear_free(dhg.p);

		if (dhg.size > max || dhg.size < min)
			continue;

		if ((dhg.size > wantbits && dhg.size < best) ||
		    (dhg.size > best && best < wantbits)) {
			best = dhg.size;
			bestcount = 0;
		}
		if (dhg.size == best)
			bestcount++;
	}
	rewind(f);

	if (bestcount == 0) {
		fclose(f);
		logit("WARNING: no suitable primes in %s", _PATH_DH_PRIMES);
		return (dh_new_group14());
	}

	linenum = 0;
	which = arc4random() % bestcount;
	while (fgets(line, sizeof(line), f)) {
		if (!parse_prime(linenum, line, &dhg))
			continue;
		if ((dhg.size > max || dhg.size < min) ||
		    dhg.size != best ||
		    linenum++ != which) {
			BN_clear_free(dhg.g);
			BN_clear_free(dhg.p);
			continue;
		}
		break;
	}
	fclose(f);
	if (linenum != which+1)
		fatal("WARNING: line %d disappeared in %s, giving up",
		    which, _PATH_DH_PRIMES);

	return (dh_new_group(dhg.g, dhg.p));
}

/* diffie-hellman-groupN-sha1 */

int
dh_pub_is_valid(DH *dh, BIGNUM *dh_pub)
{
	int i;
	int n = BN_num_bits(dh_pub);
	int bits_set = 0;
	BIGNUM *tmp;

	if (dh_pub->neg) {
		logit("invalid public DH value: negativ");
		return 0;
	}
	if (BN_cmp(dh_pub, BN_value_one()) != 1) {	/* pub_exp <= 1 */
		logit("invalid public DH value: <= 1");
		return 0;
	}

	if ((tmp = BN_new()) == NULL)
		return (-1);
	if (!BN_sub(tmp, dh->p, BN_value_one()) ||
	    BN_cmp(dh_pub, tmp) != -1) {		/* pub_exp > p-2 */
		BN_clear_free(tmp);
		logit("invalid public DH value: >= p-1");
		return 0;
	}
	BN_clear_free(tmp);

	for (i = 0; i <= n; i++)
		if (BN_is_bit_set(dh_pub, i))
			bits_set++;
	debug2("bits set: %d/%d", bits_set, BN_num_bits(dh->p));

	/* if g==2 and bits_set==1 then computing log_g(dh_pub) is trivial */
	if (bits_set > 1)
		return 1;

	logit("invalid public DH value (%d/%d)", bits_set, BN_num_bits(dh->p));
	return 0;
}

void
dh_gen_key(DH *dh, int need)
{
	int i, bits_set, tries = 0;

	if (dh->p == NULL)
		fatal("dh_gen_key: dh->p == NULL");
	if (need > INT_MAX / 2 || 2 * need >= BN_num_bits(dh->p))
		fatal("dh_gen_key: group too small: %d (2*need %d)",
		    BN_num_bits(dh->p), 2*need);
	do {
		if (dh->priv_key != NULL)
			BN_clear_free(dh->priv_key);
		if ((dh->priv_key = BN_new()) == NULL)
			fatal("dh_gen_key: BN_new failed");
		/* generate a 2*need bits random private exponent */
		if (!BN_rand(dh->priv_key, 2*need, 0, 0))
			fatal("dh_gen_key: BN_rand failed");
		if (DH_generate_key(dh) == 0)
			fatal("DH_generate_key");
		for (i = 0, bits_set = 0; i <= BN_num_bits(dh->priv_key); i++)
			if (BN_is_bit_set(dh->priv_key, i))
				bits_set++;
		debug2("dh_gen_key: priv key bits set: %d/%d",
		    bits_set, BN_num_bits(dh->priv_key));
		if (tries++ > 10)
			fatal("dh_gen_key: too many bad keys: giving up");
	} while (!dh_pub_is_valid(dh, dh->pub_key));
}

DH *
dh_new_group_asc(const char *gen, const char *modulus)
{
	DH *dh;

	if ((dh = DH_new()) == NULL)
		fatal("dh_new_group_asc: DH_new");

	if (BN_hex2bn(&dh->p, modulus) == 0)
		fatal("BN_hex2bn p");
	if (BN_hex2bn(&dh->g, gen) == 0)
		fatal("BN_hex2bn g");

	return (dh);
}

/*
 * This just returns the group, we still need to generate the exchange
 * value.
 */

DH *
dh_new_group(BIGNUM *gen, BIGNUM *modulus)
{
	DH *dh;

	if ((dh = DH_new()) == NULL)
		fatal("dh_new_group: DH_new");
	dh->p = modulus;
	dh->g = gen;

	return (dh);
}

DH *
dh_new_group1(void)
{
	static char *gen = "2", *group1 =
	    "FFFFFFFF" "FFFFFFFF" "C90FDAA2" "2168C234" "C4C6628B" "80DC1CD1"
	    "29024E08" "8A67CC74" "020BBEA6" "3B139B22" "514A0879" "8E3404DD"
	    "EF9519B3" "CD3A431B" "302B0A6D" "F25F1437" "4FE1356D" "6D51C245"
	    "E485B576" "625E7EC6" "F44C42E9" "A637ED6B" "0BFF5CB6" "F406B7ED"
	    "EE386BFB" "5A899FA5" "AE9F2411" "7C4B1FE6" "49286651" "ECE65381"
	    "FFFFFFFF" "FFFFFFFF";

	return (dh_new_group_asc(gen, group1));
}

DH *
dh_new_group14(void)
{
	static char *gen = "2", *group14 =
	    "FFFFFFFF" "FFFFFFFF" "C90FDAA2" "2168C234" "C4C6628B" "80DC1CD1"
	    "29024E08" "8A67CC74" "020BBEA6" "3B139B22" "514A0879" "8E3404DD"
	    "EF9519B3" "CD3A431B" "302B0A6D" "F25F1437" "4FE1356D" "6D51C245"
	    "E485B576" "625E7EC6" "F44C42E9" "A637ED6B" "0BFF5CB6" "F406B7ED"
	    "EE386BFB" "5A899FA5" "AE9F2411" "7C4B1FE6" "49286651" "ECE45B3D"
	    "C2007CB8" "A163BF05" "98DA4836" "1C55D39A" "69163FA8" "FD24CF5F"
	    "83655D23" "DCA3AD96" "1C62F356" "208552BB" "9ED52907" "7096966D"
	    "670C354E" "4ABC9804" "F1746C08" "CA18217C" "32905E46" "2E36CE3B"
	    "E39E772C" "180E8603" "9B2783A2" "EC07A28F" "B5C55DF0" "6F4C52C9"
	    "DE2BCBF6" "95581718" "3995497C" "EA956AE5" "15D22618" "98FA0510"
	    "15728E5A" "8AACAA68" "FFFFFFFF" "FFFFFFFF";

	return (dh_new_group_asc(gen, group14));
}

/*
 * Estimates the group order for a Diffie-Hellman group that has an
 * attack complexity approximately the same as O(2**bits).  Estimate
 * with:  O(exp(1.9223 * (ln q)^(1/3) (ln ln q)^(2/3)))
 */

int
dh_estimate(int bits)
{

	if (bits <= 128)
		return (1024);	/* O(2**86) */
	if (bits <= 192)
		return (2048);	/* O(2**116) */
	return (4096);		/* O(2**156) */
}
Commit	Line	Data
799ae497	1	/* $OpenBSD: dh.c,v 1.44 2006/11/07 13:02:07 markus Exp $ */
3c0ef626	2	/*
	3	* Copyright (c) 2000 Niels Provos. All rights reserved.
	4	*
	5	* Redistribution and use in source and binary forms, with or without
	6	* modification, are permitted provided that the following conditions
	7	* are met:
	8	* 1. Redistributions of source code must retain the above copyright
	9	* notice, this list of conditions and the following disclaimer.
	10	* 2. Redistributions in binary form must reproduce the above copyright
	11	* notice, this list of conditions and the following disclaimer in the
	12	* documentation and/or other materials provided with the distribution.
	13	*
	14	* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
	15	* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
	16	* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
	17	* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
	18	* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
	19	* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
	20	* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
	21	* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
	22	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
	23	* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	24	*/
	25
	26	#include "includes.h"
3c0ef626	27
9108f8d9	28	#include <sys/param.h>
3c0ef626	29
	30	#include <openssl/bn.h>
	31	#include <openssl/dh.h>
3c0ef626	32
9108f8d9	33	#include <stdarg.h>
	34	#include <stdio.h>
	35	#include <stdlib.h>
	36	#include <string.h>
	37
3c0ef626	38	#include "dh.h"
	39	#include "pathnames.h"
	40	#include "log.h"
	41	#include "misc.h"
	42
	43	static int
	44	parse_prime(int linenum, char line, struct dhgroup dhg)
	45	{
	46	char cp, arg;
	47	char strsize, gen, *prime;
9108f8d9	48	const char *errstr = NULL;
3c0ef626	49
3c0ef626	50	cp = line;
9108f8d9	51	if ((arg = strdelim(&cp)) == NULL)
9108f8d9	52	return 0;
3c0ef626	53	/* Ignore leading whitespace */
	54	if (*arg == '\0')
	55	arg = strdelim(&cp);
41b2f314	56	if (!arg \|\| !arg \|\| arg == '#')
3c0ef626	57	return 0;
	58
	59	/* time */
	60	if (cp == NULL \|\| *arg == '\0')
	61	goto fail;
	62	arg = strsep(&cp, " "); /* type */
	63	if (cp == NULL \|\| *arg == '\0')
	64	goto fail;
	65	arg = strsep(&cp, " "); /* tests */
	66	if (cp == NULL \|\| *arg == '\0')
	67	goto fail;
	68	arg = strsep(&cp, " "); /* tries */
	69	if (cp == NULL \|\| *arg == '\0')
	70	goto fail;
	71	strsize = strsep(&cp, " "); /* size */
	72	if (cp == NULL \|\| *strsize == '\0' \|\|
9108f8d9	73	(dhg->size = (u_int)strtonum(strsize, 0, 64*1024, &errstr)) == 0 \|\|
9108f8d9	74	errstr)
3c0ef626	75	goto fail;
	76	/* The whole group is one bit larger */
	77	dhg->size++;
	78	gen = strsep(&cp, " "); /* gen */
	79	if (cp == NULL \|\| *gen == '\0')
	80	goto fail;
	81	prime = strsep(&cp, " "); /* prime */
	82	if (cp != NULL \|\| *prime == '\0')
	83	goto fail;
	84
e9a17296	85	if ((dhg->g = BN_new()) == NULL)
	86	fatal("parse_prime: BN_new failed");
	87	if ((dhg->p = BN_new()) == NULL)
	88	fatal("parse_prime: BN_new failed");
3c0ef626	89	if (BN_hex2bn(&dhg->g, gen) == 0)
	90	goto failclean;
	91
	92	if (BN_hex2bn(&dhg->p, prime) == 0)
	93	goto failclean;
	94
	95	if (BN_num_bits(dhg->p) != dhg->size)
	96	goto failclean;
	97
99be0775	98	if (BN_is_zero(dhg->g) \|\| BN_is_one(dhg->g))
	99	goto failclean;
	100
3c0ef626	101	return (1);
	102
	103	failclean:
e9a17296	104	BN_clear_free(dhg->g);
e9a17296	105	BN_clear_free(dhg->p);
3c0ef626	106	fail:
	107	error("Bad prime description in line %d", linenum);
	108	return (0);
	109	}
	110
	111	DH *
	112	choose_dh(int min, int wantbits, int max)
	113	{
	114	FILE *f;
99be0775	115	char line[4096];
3c0ef626	116	int best, bestcount, which;
	117	int linenum;
	118	struct dhgroup dhg;
	119
	120	if ((f = fopen(_PATH_DH_MODULI, "r")) == NULL &&
	121	(f = fopen(_PATH_DH_PRIMES, "r")) == NULL) {
c9f39d2c	122	logit("WARNING: %s does not exist, using fixed modulus",
	123	_PATH_DH_MODULI);
	124	return (dh_new_group14());
3c0ef626	125	}
	126
	127	linenum = 0;
	128	best = bestcount = 0;
	129	while (fgets(line, sizeof(line), f)) {
	130	linenum++;
	131	if (!parse_prime(linenum, line, &dhg))
	132	continue;
e9a17296	133	BN_clear_free(dhg.g);
e9a17296	134	BN_clear_free(dhg.p);
3c0ef626	135
	136	if (dhg.size > max \|\| dhg.size < min)
	137	continue;
	138
	139	if ((dhg.size > wantbits && dhg.size < best) \|\|
	140	(dhg.size > best && best < wantbits)) {
	141	best = dhg.size;
	142	bestcount = 0;
	143	}
	144	if (dhg.size == best)
	145	bestcount++;
	146	}
	147	rewind(f);
	148
	149	if (bestcount == 0) {
	150	fclose(f);
0fff78ff	151	logit("WARNING: no suitable primes in %s", _PATH_DH_PRIMES);
c9f39d2c	152	return (dh_new_group14());
3c0ef626	153	}
	154
	155	linenum = 0;
	156	which = arc4random() % bestcount;
	157	while (fgets(line, sizeof(line), f)) {
	158	if (!parse_prime(linenum, line, &dhg))
	159	continue;
	160	if ((dhg.size > max \|\| dhg.size < min) \|\|
	161	dhg.size != best \|\|
	162	linenum++ != which) {
e9a17296	163	BN_clear_free(dhg.g);
e9a17296	164	BN_clear_free(dhg.p);
3c0ef626	165	continue;
	166	}
	167	break;
	168	}
	169	fclose(f);
	170	if (linenum != which+1)
	171	fatal("WARNING: line %d disappeared in %s, giving up",
	172	which, _PATH_DH_PRIMES);
	173
	174	return (dh_new_group(dhg.g, dhg.p));
	175	}
	176
c9f39d2c	177	/* diffie-hellman-groupN-sha1 */
3c0ef626	178
	179	int
	180	dh_pub_is_valid(DH dh, BIGNUM dh_pub)
	181	{
	182	int i;
	183	int n = BN_num_bits(dh_pub);
	184	int bits_set = 0;
9108f8d9	185	BIGNUM *tmp;
3c0ef626	186
3c0ef626	187	if (dh_pub->neg) {
0fff78ff	188	logit("invalid public DH value: negativ");
3c0ef626	189	return 0;
3c0ef626	190	}
9108f8d9	191	if (BN_cmp(dh_pub, BN_value_one()) != 1) { /* pub_exp <= 1 */
	192	logit("invalid public DH value: <= 1");
	193	return 0;
	194	}
	195
	196	if ((tmp = BN_new()) == NULL)
	197	return (-1);
	198	if (!BN_sub(tmp, dh->p, BN_value_one()) \|\|
	199	BN_cmp(dh_pub, tmp) != -1) { /* pub_exp > p-2 */
	200	BN_clear_free(tmp);
	201	logit("invalid public DH value: >= p-1");
	202	return 0;
	203	}
	204	BN_clear_free(tmp);
	205
3c0ef626	206	for (i = 0; i <= n; i++)
	207	if (BN_is_bit_set(dh_pub, i))
	208	bits_set++;
6a9b3198	209	debug2("bits set: %d/%d", bits_set, BN_num_bits(dh->p));
3c0ef626	210
3c0ef626	211	/* if g==2 and bits_set==1 then computing log_g(dh_pub) is trivial */
9108f8d9	212	if (bits_set > 1)
3c0ef626	213	return 1;
9108f8d9	214
0fff78ff	215	logit("invalid public DH value (%d/%d)", bits_set, BN_num_bits(dh->p));
3c0ef626	216	return 0;
	217	}
	218
	219	void
	220	dh_gen_key(DH *dh, int need)
	221	{
99be0775	222	int i, bits_set, tries = 0;
3c0ef626	223
	224	if (dh->p == NULL)
	225	fatal("dh_gen_key: dh->p == NULL");
cdd66111	226	if (need > INT_MAX / 2 \|\| 2 * need >= BN_num_bits(dh->p))
3c0ef626	227	fatal("dh_gen_key: group too small: %d (2*need %d)",
	228	BN_num_bits(dh->p), 2*need);
	229	do {
	230	if (dh->priv_key != NULL)
e9a17296	231	BN_clear_free(dh->priv_key);
e9a17296	232	if ((dh->priv_key = BN_new()) == NULL)
3c0ef626	233	fatal("dh_gen_key: BN_new failed");
	234	/* generate a 2need bits random private exponent /
	235	if (!BN_rand(dh->priv_key, 2*need, 0, 0))
	236	fatal("dh_gen_key: BN_rand failed");
	237	if (DH_generate_key(dh) == 0)
	238	fatal("DH_generate_key");
99be0775	239	for (i = 0, bits_set = 0; i <= BN_num_bits(dh->priv_key); i++)
3c0ef626	240	if (BN_is_bit_set(dh->priv_key, i))
3c0ef626	241	bits_set++;
6a9b3198	242	debug2("dh_gen_key: priv key bits set: %d/%d",
3c0ef626	243	bits_set, BN_num_bits(dh->priv_key));
	244	if (tries++ > 10)
	245	fatal("dh_gen_key: too many bad keys: giving up");
	246	} while (!dh_pub_is_valid(dh, dh->pub_key));
	247	}
	248
	249	DH *
	250	dh_new_group_asc(const char gen, const char modulus)
	251	{
	252	DH *dh;
	253
e9a17296	254	if ((dh = DH_new()) == NULL)
e9a17296	255	fatal("dh_new_group_asc: DH_new");
3c0ef626	256
	257	if (BN_hex2bn(&dh->p, modulus) == 0)
	258	fatal("BN_hex2bn p");
	259	if (BN_hex2bn(&dh->g, gen) == 0)
	260	fatal("BN_hex2bn g");
	261
	262	return (dh);
	263	}
	264
	265	/*
	266	* This just returns the group, we still need to generate the exchange
	267	* value.
	268	*/
	269
	270	DH *
	271	dh_new_group(BIGNUM gen, BIGNUM modulus)
	272	{
	273	DH *dh;
	274
e9a17296	275	if ((dh = DH_new()) == NULL)
e9a17296	276	fatal("dh_new_group: DH_new");
3c0ef626	277	dh->p = modulus;
	278	dh->g = gen;
	279
	280	return (dh);
	281	}
	282
	283	DH *
	284	dh_new_group1(void)
	285	{
	286	static char gen = "2", group1 =
	287	"FFFFFFFF" "FFFFFFFF" "C90FDAA2" "2168C234" "C4C6628B" "80DC1CD1"
	288	"29024E08" "8A67CC74" "020BBEA6" "3B139B22" "514A0879" "8E3404DD"
	289	"EF9519B3" "CD3A431B" "302B0A6D" "F25F1437" "4FE1356D" "6D51C245"
	290	"E485B576" "625E7EC6" "F44C42E9" "A637ED6B" "0BFF5CB6" "F406B7ED"
	291	"EE386BFB" "5A899FA5" "AE9F2411" "7C4B1FE6" "49286651" "ECE65381"
	292	"FFFFFFFF" "FFFFFFFF";
	293
	294	return (dh_new_group_asc(gen, group1));
	295	}
	296
c9f39d2c	297	DH *
	298	dh_new_group14(void)
	299	{
	300	static char gen = "2", group14 =
	301	"FFFFFFFF" "FFFFFFFF" "C90FDAA2" "2168C234" "C4C6628B" "80DC1CD1"
	302	"29024E08" "8A67CC74" "020BBEA6" "3B139B22" "514A0879" "8E3404DD"
	303	"EF9519B3" "CD3A431B" "302B0A6D" "F25F1437" "4FE1356D" "6D51C245"
	304	"E485B576" "625E7EC6" "F44C42E9" "A637ED6B" "0BFF5CB6" "F406B7ED"
	305	"EE386BFB" "5A899FA5" "AE9F2411" "7C4B1FE6" "49286651" "ECE45B3D"
	306	"C2007CB8" "A163BF05" "98DA4836" "1C55D39A" "69163FA8" "FD24CF5F"
	307	"83655D23" "DCA3AD96" "1C62F356" "208552BB" "9ED52907" "7096966D"
	308	"670C354E" "4ABC9804" "F1746C08" "CA18217C" "32905E46" "2E36CE3B"
	309	"E39E772C" "180E8603" "9B2783A2" "EC07A28F" "B5C55DF0" "6F4C52C9"
	310	"DE2BCBF6" "95581718" "3995497C" "EA956AE5" "15D22618" "98FA0510"
	311	"15728E5A" "8AACAA68" "FFFFFFFF" "FFFFFFFF";
	312
	313	return (dh_new_group_asc(gen, group14));
	314	}
	315
3c0ef626	316	/*
	317	* Estimates the group order for a Diffie-Hellman group that has an
	318	* attack complexity approximately the same as O(2**bits). Estimate
	319	* with: O(exp(1.9223 * (ln q)^(1/3) (ln ln q)^(2/3)))
	320	*/
	321
	322	int
	323	dh_estimate(int bits)
	324	{
	325
cdd66111	326	if (bits <= 128)
3c0ef626	327	return (1024); /* O(2*86) /
cdd66111	328	if (bits <= 192)
3c0ef626	329	return (2048); /* O(2*116) /
	330	return (4096); /* O(2*156) /
	331	}