[openssh.git] / dh.c

/* $OpenBSD: dh.c,v 1.45 2007/09/27 00:15:57 ray Exp $ */
/*
 * Copyright (c) 2000 Niels Provos.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */

#include "includes.h"

#include <sys/param.h>

#include <openssl/bn.h>
#include <openssl/dh.h>

#include <stdarg.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#include "dh.h"
#include "pathnames.h"
#include "log.h"
#include "misc.h"

static int
parse_prime(int linenum, char *line, struct dhgroup *dhg)
{
	char *cp, *arg;
	char *strsize, *gen, *prime;
	const char *errstr = NULL;

	cp = line;
	if ((arg = strdelim(&cp)) == NULL)
		return 0;
	/* Ignore leading whitespace */
	if (*arg == '\0')
		arg = strdelim(&cp);
	if (!arg || !*arg || *arg == '#')
		return 0;

	/* time */
	if (cp == NULL || *arg == '\0')
		goto fail;
	arg = strsep(&cp, " "); /* type */
	if (cp == NULL || *arg == '\0')
		goto fail;
	arg = strsep(&cp, " "); /* tests */
	if (cp == NULL || *arg == '\0')
		goto fail;
	arg = strsep(&cp, " "); /* tries */
	if (cp == NULL || *arg == '\0')
		goto fail;
	strsize = strsep(&cp, " "); /* size */
	if (cp == NULL || *strsize == '\0' ||
	    (dhg->size = (u_int)strtonum(strsize, 0, 64*1024, &errstr)) == 0 ||
	    errstr)
		goto fail;
	/* The whole group is one bit larger */
	dhg->size++;
	gen = strsep(&cp, " "); /* gen */
	if (cp == NULL || *gen == '\0')
		goto fail;
	prime = strsep(&cp, " "); /* prime */
	if (cp != NULL || *prime == '\0')
		goto fail;

	if ((dhg->g = BN_new()) == NULL)
		fatal("parse_prime: BN_new failed");
	if ((dhg->p = BN_new()) == NULL)
		fatal("parse_prime: BN_new failed");
	if (BN_hex2bn(&dhg->g, gen) == 0)
		goto failclean;

	if (BN_hex2bn(&dhg->p, prime) == 0)
		goto failclean;

	if (BN_num_bits(dhg->p) != dhg->size)
		goto failclean;

	if (BN_is_zero(dhg->g) || BN_is_one(dhg->g))
		goto failclean;

	return (1);

 failclean:
	BN_clear_free(dhg->g);
	BN_clear_free(dhg->p);
 fail:
	error("Bad prime description in line %d", linenum);
	return (0);
}

DH *
choose_dh(int min, int wantbits, int max)
{
	FILE *f;
	char line[4096];
	int best, bestcount, which;
	int linenum;
	struct dhgroup dhg;

	if ((f = fopen(_PATH_DH_MODULI, "r")) == NULL &&
	    (f = fopen(_PATH_DH_PRIMES, "r")) == NULL) {
		logit("WARNING: %s does not exist, using fixed modulus",
		    _PATH_DH_MODULI);
		return (dh_new_group14());
	}

	linenum = 0;
	best = bestcount = 0;
	while (fgets(line, sizeof(line), f)) {
		linenum++;
		if (!parse_prime(linenum, line, &dhg))
			continue;
		BN_clear_free(dhg.g);
		BN_clear_free(dhg.p);

		if (dhg.size > max || dhg.size < min)
			continue;

		if ((dhg.size > wantbits && dhg.size < best) ||
		    (dhg.size > best && best < wantbits)) {
			best = dhg.size;
			bestcount = 0;
		}
		if (dhg.size == best)
			bestcount++;
	}
	rewind(f);

	if (bestcount == 0) {
		fclose(f);
		logit("WARNING: no suitable primes in %s", _PATH_DH_PRIMES);
		return (dh_new_group14());
	}

	linenum = 0;
	which = arc4random() % bestcount;
	while (fgets(line, sizeof(line), f)) {
		if (!parse_prime(linenum, line, &dhg))
			continue;
		if ((dhg.size > max || dhg.size < min) ||
		    dhg.size != best ||
		    linenum++ != which) {
			BN_clear_free(dhg.g);
			BN_clear_free(dhg.p);
			continue;
		}
		break;
	}
	fclose(f);
	if (linenum != which+1)
		fatal("WARNING: line %d disappeared in %s, giving up",
		    which, _PATH_DH_PRIMES);

	return (dh_new_group(dhg.g, dhg.p));
}

/* diffie-hellman-groupN-sha1 */

int
dh_pub_is_valid(DH *dh, BIGNUM *dh_pub)
{
	int i;
	int n = BN_num_bits(dh_pub);
	int bits_set = 0;
	BIGNUM *tmp;

	if (dh_pub->neg) {
		logit("invalid public DH value: negative");
		return 0;
	}
	if (BN_cmp(dh_pub, BN_value_one()) != 1) {	/* pub_exp <= 1 */
		logit("invalid public DH value: <= 1");
		return 0;
	}

	if ((tmp = BN_new()) == NULL) {
		error("%s: BN_new failed", __func__);
		return 0;
	}
	if (!BN_sub(tmp, dh->p, BN_value_one()) ||
	    BN_cmp(dh_pub, tmp) != -1) {		/* pub_exp > p-2 */
		BN_clear_free(tmp);
		logit("invalid public DH value: >= p-1");
		return 0;
	}
	BN_clear_free(tmp);

	for (i = 0; i <= n; i++)
		if (BN_is_bit_set(dh_pub, i))
			bits_set++;
	debug2("bits set: %d/%d", bits_set, BN_num_bits(dh->p));

	/* if g==2 and bits_set==1 then computing log_g(dh_pub) is trivial */
	if (bits_set > 1)
		return 1;

	logit("invalid public DH value (%d/%d)", bits_set, BN_num_bits(dh->p));
	return 0;
}

void
dh_gen_key(DH *dh, int need)
{
	int i, bits_set, tries = 0;

	if (dh->p == NULL)
		fatal("dh_gen_key: dh->p == NULL");
	if (need > INT_MAX / 2 || 2 * need >= BN_num_bits(dh->p))
		fatal("dh_gen_key: group too small: %d (2*need %d)",
		    BN_num_bits(dh->p), 2*need);
	do {
		if (dh->priv_key != NULL)
			BN_clear_free(dh->priv_key);
		if ((dh->priv_key = BN_new()) == NULL)
			fatal("dh_gen_key: BN_new failed");
		/* generate a 2*need bits random private exponent */
		if (!BN_rand(dh->priv_key, 2*need, 0, 0))
			fatal("dh_gen_key: BN_rand failed");
		if (DH_generate_key(dh) == 0)
			fatal("DH_generate_key");
		for (i = 0, bits_set = 0; i <= BN_num_bits(dh->priv_key); i++)
			if (BN_is_bit_set(dh->priv_key, i))
				bits_set++;
		debug2("dh_gen_key: priv key bits set: %d/%d",
		    bits_set, BN_num_bits(dh->priv_key));
		if (tries++ > 10)
			fatal("dh_gen_key: too many bad keys: giving up");
	} while (!dh_pub_is_valid(dh, dh->pub_key));
}

DH *
dh_new_group_asc(const char *gen, const char *modulus)
{
	DH *dh;

	if ((dh = DH_new()) == NULL)
		fatal("dh_new_group_asc: DH_new");

	if (BN_hex2bn(&dh->p, modulus) == 0)
		fatal("BN_hex2bn p");
	if (BN_hex2bn(&dh->g, gen) == 0)
		fatal("BN_hex2bn g");

	return (dh);
}

/*
 * This just returns the group, we still need to generate the exchange
 * value.
 */

DH *
dh_new_group(BIGNUM *gen, BIGNUM *modulus)
{
	DH *dh;

	if ((dh = DH_new()) == NULL)
		fatal("dh_new_group: DH_new");
	dh->p = modulus;
	dh->g = gen;

	return (dh);
}

DH *
dh_new_group1(void)
{
	static char *gen = "2", *group1 =
	    "FFFFFFFF" "FFFFFFFF" "C90FDAA2" "2168C234" "C4C6628B" "80DC1CD1"
	    "29024E08" "8A67CC74" "020BBEA6" "3B139B22" "514A0879" "8E3404DD"
	    "EF9519B3" "CD3A431B" "302B0A6D" "F25F1437" "4FE1356D" "6D51C245"
	    "E485B576" "625E7EC6" "F44C42E9" "A637ED6B" "0BFF5CB6" "F406B7ED"
	    "EE386BFB" "5A899FA5" "AE9F2411" "7C4B1FE6" "49286651" "ECE65381"
	    "FFFFFFFF" "FFFFFFFF";

	return (dh_new_group_asc(gen, group1));
}

DH *
dh_new_group14(void)
{
	static char *gen = "2", *group14 =
	    "FFFFFFFF" "FFFFFFFF" "C90FDAA2" "2168C234" "C4C6628B" "80DC1CD1"
	    "29024E08" "8A67CC74" "020BBEA6" "3B139B22" "514A0879" "8E3404DD"
	    "EF9519B3" "CD3A431B" "302B0A6D" "F25F1437" "4FE1356D" "6D51C245"
	    "E485B576" "625E7EC6" "F44C42E9" "A637ED6B" "0BFF5CB6" "F406B7ED"
	    "EE386BFB" "5A899FA5" "AE9F2411" "7C4B1FE6" "49286651" "ECE45B3D"
	    "C2007CB8" "A163BF05" "98DA4836" "1C55D39A" "69163FA8" "FD24CF5F"
	    "83655D23" "DCA3AD96" "1C62F356" "208552BB" "9ED52907" "7096966D"
	    "670C354E" "4ABC9804" "F1746C08" "CA18217C" "32905E46" "2E36CE3B"
	    "E39E772C" "180E8603" "9B2783A2" "EC07A28F" "B5C55DF0" "6F4C52C9"
	    "DE2BCBF6" "95581718" "3995497C" "EA956AE5" "15D22618" "98FA0510"
	    "15728E5A" "8AACAA68" "FFFFFFFF" "FFFFFFFF";

	return (dh_new_group_asc(gen, group14));
}

/*
 * Estimates the group order for a Diffie-Hellman group that has an
 * attack complexity approximately the same as O(2**bits).  Estimate
 * with:  O(exp(1.9223 * (ln q)^(1/3) (ln ln q)^(2/3)))
 */

int
dh_estimate(int bits)
{

	if (bits <= 128)
		return (1024);	/* O(2**86) */
	if (bits <= 192)
		return (2048);	/* O(2**116) */
	return (4096);		/* O(2**156) */
}
Commit	Line	Data
5e4fce9c	1	/* $OpenBSD: dh.c,v 1.45 2007/09/27 00:15:57 ray Exp $ */
94ec8c6b	2	/*
	3	* Copyright (c) 2000 Niels Provos. All rights reserved.
	4	*
	5	* Redistribution and use in source and binary forms, with or without
	6	* modification, are permitted provided that the following conditions
	7	* are met:
	8	* 1. Redistributions of source code must retain the above copyright
	9	* notice, this list of conditions and the following disclaimer.
	10	* 2. Redistributions in binary form must reproduce the above copyright
	11	* notice, this list of conditions and the following disclaimer in the
	12	* documentation and/or other materials provided with the distribution.
	13	*
	14	* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
	15	* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
	16	* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
	17	* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
	18	* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
	19	* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
	20	* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
	21	* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
	22	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
	23	* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	24	*/
	25
	26	#include "includes.h"
94ec8c6b	27
536c14e8	28	#include <sys/param.h>
536c14e8	29
94ec8c6b	30	#include <openssl/bn.h>
94ec8c6b	31	#include <openssl/dh.h>
94ec8c6b	32
24436b92	33	#include <stdarg.h>
cf851879	34	#include <stdio.h>
ffa517a8	35	#include <stdlib.h>
00146caa	36	#include <string.h>
00146caa	37
94ec8c6b	38	#include "dh.h"
42f11eb2	39	#include "pathnames.h"
	40	#include "log.h"
	41	#include "misc.h"
94ec8c6b	42
396c147e	43	static int
94ec8c6b	44	parse_prime(int linenum, char line, struct dhgroup dhg)
	45	{
	46	char cp, arg;
	47	char strsize, gen, *prime;
fd06fbe0	48	const char *errstr = NULL;
94ec8c6b	49
94ec8c6b	50	cp = line;
88299971	51	if ((arg = strdelim(&cp)) == NULL)
88299971	52	return 0;
94ec8c6b	53	/* Ignore leading whitespace */
	54	if (*arg == '\0')
	55	arg = strdelim(&cp);
f11fe301	56	if (!arg \|\| !arg \|\| arg == '#')
94ec8c6b	57	return 0;
	58
	59	/* time */
	60	if (cp == NULL \|\| *arg == '\0')
	61	goto fail;
	62	arg = strsep(&cp, " "); /* type */
	63	if (cp == NULL \|\| *arg == '\0')
	64	goto fail;
	65	arg = strsep(&cp, " "); /* tests */
	66	if (cp == NULL \|\| *arg == '\0')
	67	goto fail;
	68	arg = strsep(&cp, " "); /* tries */
	69	if (cp == NULL \|\| *arg == '\0')
	70	goto fail;
	71	strsize = strsep(&cp, " "); /* size */
	72	if (cp == NULL \|\| *strsize == '\0' \|\|
fd06fbe0	73	(dhg->size = (u_int)strtonum(strsize, 0, 64*1024, &errstr)) == 0 \|\|
fd06fbe0	74	errstr)
94ec8c6b	75	goto fail;
db1cd2f3	76	/* The whole group is one bit larger */
db1cd2f3	77	dhg->size++;
94ec8c6b	78	gen = strsep(&cp, " "); /* gen */
	79	if (cp == NULL \|\| *gen == '\0')
	80	goto fail;
	81	prime = strsep(&cp, " "); /* prime */
	82	if (cp != NULL \|\| *prime == '\0')
	83	goto fail;
	84
b775c6f2	85	if ((dhg->g = BN_new()) == NULL)
	86	fatal("parse_prime: BN_new failed");
	87	if ((dhg->p = BN_new()) == NULL)
	88	fatal("parse_prime: BN_new failed");
ec1f12d3	89	if (BN_hex2bn(&dhg->g, gen) == 0)
c8682232	90	goto failclean;
c8682232	91
ec1f12d3	92	if (BN_hex2bn(&dhg->p, prime) == 0)
c8682232	93	goto failclean;
	94
	95	if (BN_num_bits(dhg->p) != dhg->size)
	96	goto failclean;
94ec8c6b	97
8b0a55ac	98	if (BN_is_zero(dhg->g) \|\| BN_is_one(dhg->g))
	99	goto failclean;
	100
94ec8c6b	101	return (1);
c8682232	102
c8682232	103	failclean:
108d362e	104	BN_clear_free(dhg->g);
108d362e	105	BN_clear_free(dhg->p);
94ec8c6b	106	fail:
54b974dc	107	error("Bad prime description in line %d", linenum);
94ec8c6b	108	return (0);
	109	}
	110
	111	DH *
db1cd2f3	112	choose_dh(int min, int wantbits, int max)
94ec8c6b	113	{
94ec8c6b	114	FILE *f;
cd744742	115	char line[4096];
94ec8c6b	116	int best, bestcount, which;
	117	int linenum;
	118	struct dhgroup dhg;
	119
e2854364	120	if ((f = fopen(_PATH_DH_MODULI, "r")) == NULL &&
e2854364	121	(f = fopen(_PATH_DH_PRIMES, "r")) == NULL) {
41e5bd9a	122	logit("WARNING: %s does not exist, using fixed modulus",
	123	_PATH_DH_MODULI);
	124	return (dh_new_group14());
94ec8c6b	125	}
	126
	127	linenum = 0;
	128	best = bestcount = 0;
	129	while (fgets(line, sizeof(line), f)) {
	130	linenum++;
	131	if (!parse_prime(linenum, line, &dhg))
	132	continue;
108d362e	133	BN_clear_free(dhg.g);
108d362e	134	BN_clear_free(dhg.p);
94ec8c6b	135
db1cd2f3	136	if (dhg.size > max \|\| dhg.size < min)
	137	continue;
	138
	139	if ((dhg.size > wantbits && dhg.size < best) \|\|
	140	(dhg.size > best && best < wantbits)) {
94ec8c6b	141	best = dhg.size;
	142	bestcount = 0;
	143	}
	144	if (dhg.size == best)
	145	bestcount++;
	146	}
826676b3	147	rewind(f);
94ec8c6b	148
94ec8c6b	149	if (bestcount == 0) {
826676b3	150	fclose(f);
bbe88b6d	151	logit("WARNING: no suitable primes in %s", _PATH_DH_PRIMES);
0875a0a2	152	return (dh_new_group14());
94ec8c6b	153	}
94ec8c6b	154
94ec8c6b	155	linenum = 0;
	156	which = arc4random() % bestcount;
	157	while (fgets(line, sizeof(line), f)) {
	158	if (!parse_prime(linenum, line, &dhg))
	159	continue;
a7ca6275	160	if ((dhg.size > max \|\| dhg.size < min) \|\|
	161	dhg.size != best \|\|
	162	linenum++ != which) {
108d362e	163	BN_clear_free(dhg.g);
108d362e	164	BN_clear_free(dhg.p);
94ec8c6b	165	continue;
	166	}
	167	break;
	168	}
	169	fclose(f);
a7ca6275	170	if (linenum != which+1)
	171	fatal("WARNING: line %d disappeared in %s, giving up",
	172	which, _PATH_DH_PRIMES);
94ec8c6b	173
	174	return (dh_new_group(dhg.g, dhg.p));
	175	}
03b8f8be	176
41e5bd9a	177	/* diffie-hellman-groupN-sha1 */
03b8f8be	178
	179	int
	180	dh_pub_is_valid(DH dh, BIGNUM dh_pub)
	181	{
	182	int i;
	183	int n = BN_num_bits(dh_pub);
	184	int bits_set = 0;
397d64d2	185	BIGNUM *tmp;
03b8f8be	186
03b8f8be	187	if (dh_pub->neg) {
5e4fce9c	188	logit("invalid public DH value: negative");
03b8f8be	189	return 0;
03b8f8be	190	}
397d64d2	191	if (BN_cmp(dh_pub, BN_value_one()) != 1) { /* pub_exp <= 1 */
	192	logit("invalid public DH value: <= 1");
	193	return 0;
	194	}
	195
5e4fce9c	196	if ((tmp = BN_new()) == NULL) {
	197	error("%s: BN_new failed", __func__);
	198	return 0;
	199	}
397d64d2	200	if (!BN_sub(tmp, dh->p, BN_value_one()) \|\|
	201	BN_cmp(dh_pub, tmp) != -1) { /* pub_exp > p-2 */
	202	BN_clear_free(tmp);
	203	logit("invalid public DH value: >= p-1");
	204	return 0;
	205	}
	206	BN_clear_free(tmp);
	207
03b8f8be	208	for (i = 0; i <= n; i++)
	209	if (BN_is_bit_set(dh_pub, i))
	210	bits_set++;
35efb24c	211	debug2("bits set: %d/%d", bits_set, BN_num_bits(dh->p));
03b8f8be	212
03b8f8be	213	/* if g==2 and bits_set==1 then computing log_g(dh_pub) is trivial */
397d64d2	214	if (bits_set > 1)
03b8f8be	215	return 1;
397d64d2	216
bbe88b6d	217	logit("invalid public DH value (%d/%d)", bits_set, BN_num_bits(dh->p));
03b8f8be	218	return 0;
	219	}
	220
	221	void
	222	dh_gen_key(DH *dh, int need)
	223	{
e24bb7d5	224	int i, bits_set, tries = 0;
03b8f8be	225
	226	if (dh->p == NULL)
	227	fatal("dh_gen_key: dh->p == NULL");
bb92e5cc	228	if (need > INT_MAX / 2 \|\| 2 * need >= BN_num_bits(dh->p))
03b8f8be	229	fatal("dh_gen_key: group too small: %d (2*need %d)",
	230	BN_num_bits(dh->p), 2*need);
	231	do {
	232	if (dh->priv_key != NULL)
108d362e	233	BN_clear_free(dh->priv_key);
b775c6f2	234	if ((dh->priv_key = BN_new()) == NULL)
03b8f8be	235	fatal("dh_gen_key: BN_new failed");
03b8f8be	236	/* generate a 2need bits random private exponent /
83a9aa63	237	if (!BN_rand(dh->priv_key, 2*need, 0, 0))
83a9aa63	238	fatal("dh_gen_key: BN_rand failed");
03b8f8be	239	if (DH_generate_key(dh) == 0)
03b8f8be	240	fatal("DH_generate_key");
e24bb7d5	241	for (i = 0, bits_set = 0; i <= BN_num_bits(dh->priv_key); i++)
03b8f8be	242	if (BN_is_bit_set(dh->priv_key, i))
03b8f8be	243	bits_set++;
35efb24c	244	debug2("dh_gen_key: priv key bits set: %d/%d",
03b8f8be	245	bits_set, BN_num_bits(dh->priv_key));
	246	if (tries++ > 10)
	247	fatal("dh_gen_key: too many bad keys: giving up");
	248	} while (!dh_pub_is_valid(dh, dh->pub_key));
	249	}
	250
	251	DH *
	252	dh_new_group_asc(const char gen, const char modulus)
	253	{
	254	DH *dh;
03b8f8be	255
b775c6f2	256	if ((dh = DH_new()) == NULL)
b775c6f2	257	fatal("dh_new_group_asc: DH_new");
03b8f8be	258
d4d9db8d	259	if (BN_hex2bn(&dh->p, modulus) == 0)
03b8f8be	260	fatal("BN_hex2bn p");
d4d9db8d	261	if (BN_hex2bn(&dh->g, gen) == 0)
03b8f8be	262	fatal("BN_hex2bn g");
	263
	264	return (dh);
	265	}
	266
	267	/*
	268	* This just returns the group, we still need to generate the exchange
	269	* value.
	270	*/
	271
	272	DH *
	273	dh_new_group(BIGNUM gen, BIGNUM modulus)
	274	{
	275	DH *dh;
	276
b775c6f2	277	if ((dh = DH_new()) == NULL)
b775c6f2	278	fatal("dh_new_group: DH_new");
03b8f8be	279	dh->p = modulus;
	280	dh->g = gen;
	281
	282	return (dh);
	283	}
	284
	285	DH *
	286	dh_new_group1(void)
	287	{
	288	static char gen = "2", group1 =
	289	"FFFFFFFF" "FFFFFFFF" "C90FDAA2" "2168C234" "C4C6628B" "80DC1CD1"
	290	"29024E08" "8A67CC74" "020BBEA6" "3B139B22" "514A0879" "8E3404DD"
	291	"EF9519B3" "CD3A431B" "302B0A6D" "F25F1437" "4FE1356D" "6D51C245"
	292	"E485B576" "625E7EC6" "F44C42E9" "A637ED6B" "0BFF5CB6" "F406B7ED"
	293	"EE386BFB" "5A899FA5" "AE9F2411" "7C4B1FE6" "49286651" "ECE65381"
	294	"FFFFFFFF" "FFFFFFFF";
	295
	296	return (dh_new_group_asc(gen, group1));
	297	}
a5c9ffdb	298
41e5bd9a	299	DH *
	300	dh_new_group14(void)
	301	{
	302	static char gen = "2", group14 =
	303	"FFFFFFFF" "FFFFFFFF" "C90FDAA2" "2168C234" "C4C6628B" "80DC1CD1"
	304	"29024E08" "8A67CC74" "020BBEA6" "3B139B22" "514A0879" "8E3404DD"
	305	"EF9519B3" "CD3A431B" "302B0A6D" "F25F1437" "4FE1356D" "6D51C245"
	306	"E485B576" "625E7EC6" "F44C42E9" "A637ED6B" "0BFF5CB6" "F406B7ED"
	307	"EE386BFB" "5A899FA5" "AE9F2411" "7C4B1FE6" "49286651" "ECE45B3D"
	308	"C2007CB8" "A163BF05" "98DA4836" "1C55D39A" "69163FA8" "FD24CF5F"
	309	"83655D23" "DCA3AD96" "1C62F356" "208552BB" "9ED52907" "7096966D"
	310	"670C354E" "4ABC9804" "F1746C08" "CA18217C" "32905E46" "2E36CE3B"
	311	"E39E772C" "180E8603" "9B2783A2" "EC07A28F" "B5C55DF0" "6F4C52C9"
	312	"DE2BCBF6" "95581718" "3995497C" "EA956AE5" "15D22618" "98FA0510"
	313	"15728E5A" "8AACAA68" "FFFFFFFF" "FFFFFFFF";
	314
	315	return (dh_new_group_asc(gen, group14));
	316	}
	317
a5c9ffdb	318	/*
	319	* Estimates the group order for a Diffie-Hellman group that has an
	320	* attack complexity approximately the same as O(2**bits). Estimate
	321	* with: O(exp(1.9223 * (ln q)^(1/3) (ln ln q)^(2/3)))
	322	*/
	323
	324	int
	325	dh_estimate(int bits)
	326	{
	327
b3c35b71	328	if (bits <= 128)
a5c9ffdb	329	return (1024); /* O(2*86) /
b3c35b71	330	if (bits <= 192)
a5c9ffdb	331	return (2048); /* O(2*116) /
	332	return (4096); /* O(2*156) /
	333	}