Add support for ECDH key exchange

[bk2204]

ECDH key exchange is faster than regular Diffie-Hellman with equivalent levels of security. It's been supported for some time in OpenSSH. It also uses longer session hashes, resulting in harder-to-guess key material. It would be nice if libssh2 supported this as well.

The NIST curves can probably be trivially implemented with OpenSSL and libgcrypt, but using curve25519-sha256@libssh.org would probably require custom code in libssh2.

[svoop]

Slightly off-thread: Will Cosgrove worked on diffie-hellman-group-exchange-sha256 support back in January:
http://www.libssh2.org/mail/libssh2-devel-archive-2015-01/0004.shtml

[fgouget]

This is getting somewhat urgent. libssh2 only supports the following key exchange protocols: diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1

But OpenSSH now disables diffie-hellman-group1-sha1 by default, and SHA1 in general is considered broken so the rest of libssh2's key exchange protocols are bound to follow suite. Indeed some SSH hardening guides recommend only supporting curve25519-sha256@libssh.org and diffie-hellman-group-exchange-sha256, neither of which libssh2 supports.

[bagder]

We accept pull requests as well as good old patches mailed to the mailing list.

[jakob]

@fgouget libssh2 does support diffie-hellman-group-exchange-sha256 in the most recent version (1.7.0). The website hasn't been updated yet with this info.

@Badger Could you update the website to include this info?

[bagder]

done!

[willco007]

I have ECDH using OpenSSL support done on a private fork; I just need some time to merge it back into master and create a pull request.

[prem-nm]

I am also looking for ECDH support in libssh2. Hope you find the time to merge back your changes :-)

[ehamberg]

Any news on this, @willco007? :)

[willco007]

@ehamberg Thanks for the reminder. I finally shipped the project I've been working on and will have some time in the coming weeks to get my changes into a pull request.

I've been continuing to work on my private fork. I've recently added OpenSSH key file format support. At this point I have diverged quite a bit from the official release (ECDHA, ED25519, ETM support, OpenSSH keys). The problems are:

1. my changes are numerous; someone needs to review them for the project in a timely manor
2. the crypto-related changes only work using OpenSSL
3. getting someone who uses the other crypto backends to make sure they don't blow up and/or getting them ported to those backends. Any takers out there? :)

[prem-nm]

I've implemented ECDH nistp384 on my local sandbox. I have tested this against openssh 7.3p1. Mine too works only with openssl. I can review the ECDH code. I've never used gcrypt etc , so I won't be of much help

[willco007]

@prem-nm great! I'm merging my changes now and will let you know when I submit the pull request.

[willco007]

@prem-nm have you had a chance to look over/try my pull request?

[prem-nm]

@willco007 , I had a look and I have commented. Good job !

[willco007]

ECDSA support has been merged in, closing.