Ephemeral Diffie-Hellman state for one SSH connection. More...

#include <ssh_keymat.h>

Public Attributes
SshBigNum	y
	Server ephemeral private DH scalar (SENSITIVE - wiped after KEX).

SshBigNum	f
	Server DH public value = g^y mod p (sent to client).

SshBigNum	K
	Shared DH secret = e^y mod p (SENSITIVE - wiped after key derivation).

uint8_t	H [32]
	SHA-256 exchange hash; doubles as session_id after first KEX.

bool	kex_done
	True once NEWKEYS has been sent and received.

Detailed Description

Ephemeral Diffie-Hellman state for one SSH connection.

The three SshBigNum fields (y, f, K) together hold 768 bytes of sensitive material. The entire struct is wiped by ssh_dh_wipe() immediately after session keys are derived from K.

FIELD LIFETIME: y - generated by ssh_dh_generate(); zeroed in ssh_dh_wipe(). f - computed in ssh_dh_generate() as g^y mod p; sent in KEXDH_REPLY; zeroed in ssh_dh_wipe(). K - computed in ssh_dh_finish() as e^y mod p; used for key derivation; zeroed in ssh_dh_wipe() AFTER keys are installed. H - the exchange hash; becomes the session_id for the connection's lifetime (RFC 4253 §7.2); stored in H[], NOT zeroed (it is a commitment to the handshake, and is not secret).

Definition at line 242 of file ssh_keymat.h.