RFC 4419

Diffie-Hellman Group Exchange for the Secure Shell (SSH) Transport Layer Protocol

📅 published March 2006, from ietf

RFC 4419: Diffie-Hellman Group Exchange for the Secure Shell (SSH) Transport Layer Protocol ✨

Network Working Group 🌸 this one is from March 2006, and it's on the Standards Track 👑

Authors: M. Friedl, N. Provos, W. Simpson 🫶

Request for Comments: 4419

Obsoletes / Updates: the original doesn't list anything for either one, so this RFC doesn't formally replace or change any other document 💅

Status of This Memo

okay so this document is an Internet standards track protocol for the Internet community, and it's openly asking for discussion and suggestions for improvements 🦋 Check the current edition of the "Internet Official Protocol Standards" (STD 1) for the standardization state and status of this protocol. Distribution of this memo is unlimited.

Copyright Notice

Abstract

okay this memo describes a brand new key exchange method for the Secure Shell (SSH) protocol 🔐 It lets the SSH server propose new groups to the client for doing the Diffie-Hellman key exchange on. The proposed groups don't have to stay fixed, so they can change over time ✨ the way that's giving flexibility!!

1. Overview and Rationale 🎀

SSH [RFC4251] is super common for secure remote login on the Internet 💖 Right now, SSH does its initial key exchange with the diffie-hellman-group1-sha1 method [RFC4253]. That method uses one fixed group for every single operation 🙈

The Diffie-Hellman key exchange gives you a shared secret that neither party could work out alone 🔥 Plus, the shared secret is only known to the two people involved. In SSH, the key exchange is signed with the host key so the host gets authenticated 🫶

The security of Diffie-Hellman depends on how hard it is to solve the Discrete Logarithm Problem (DLP) 🧠 SSH is going to be around for many years, so there's a worry that heavy precomputation and better algorithms for computing discrete logarithms over one fixed group could become a security threat to SSH 😭 Not okay!!

Being able to propose new groups lowers the incentive to do precomputation for faster discrete logarithm calculations 🦋 The server can keep computing new groups in the background, so it's always got fresh ones ready to go 💅

2. Requirements Notation 🌈

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119]. ✨

3. Diffie-Hellman Group and Key Exchange 💜

The server keeps a list of safe primes and matching generators to pick from 🌸 A prime p counts as safe if p = 2q + 1 and q is prime. New primes can be generated in the background 🧚

The generator g should be picked so that the order of the generated subgroup doesn't factor into small primes. In other words, with p = 2q + 1, the order has to be either q or p - 1. If the order is p - 1, the exponents generate every possible public value, spread evenly across the whole range of the modulus p, without cycling through a smaller subset 😍 A generator like that is called a "primitive root" (which is trivial to find when p is "safe") 👑

The client asks the server for a modulus and says what size it would like. Here's the setup for the description below 🎀

C is the client.
S is the server.
The modulus p is a large safe prime.
g is a generator for a subgroup of GF(p).
min is the smallest size of p in bits that the client will accept.
n is the size of the modulus p in bits that the client would like to get from the server.
max is the largest size of p in bits that the client can accept.
V_S is S's version string.
V_C is C's version string.
K_S is S's public host key.
I_C is C's KEXINIT message.
I_S is S's KEXINIT message. Both KEXINIT messages were exchanged before this part begins.

Here's how the exchange goes, step by step 💅

C sends min || n || max to S. This tells the server the minimal acceptable group size, the preferred size of the group, and the maximal group size in bits the client will accept.
S finds a group that best matches the client's request, and sends p || g to C.
C generates a random number x, where 1 < x < (p-1)/2. It computes e = g^x mod p, and sends e to S.
S generates a random number y, where 0 < y < (p-1)/2, and computes f = g^y mod p. S receives e. It computes K = e^y mod p, and H = hash(V_C || V_S || I_C || I_S || K_S || min || n || max || p || g || e || f || K). The elements in H are encoded according to their types (see below). S also makes a signature s on H with its private host key. Then S sends K_S || f || s to C. The signing operation may involve a second hashing operation. 🔥
C checks that K_S really is the host key for S. It might use certificates or a local database to get the public key 🔍 C is also allowed to accept the key without verification. However, doing that will make the protocol insecure against active attacks. It might still be useful for practical reasons in the short term in many environments, though 🙈 After that, C computes K = f^x mod p and H = hash(V_C || V_S || I_C || I_S || K_S || min || n || max || p || g || e || f || K), and then verifies the signature s on H.

Servers and clients SHOULD support groups with a modulus length of k bits, where 1024 <= k <= 8192. The recommended values for min and max are 1024 and 8192, respectively 🌈

Either side MUST NOT send or accept e or f values that are not in the range [1, p-1]. If this condition is violated, the key exchange fails 💀 To prevent confinement attacks, they MUST accept the shared secret K only if 1 < K < p - 1. Not negotiable, bestie!! 😤

The server should return the smallest group it knows that is larger than the size the client requested. If the server doesn't know a group that's larger than the client's request, then it SHOULD return the largest group it knows. In all cases, the size of the returned group SHOULD be at least 1024 bits 🎀

This part is where the messages happen, so watch the byte order and the field types carefully. Implementers depend on every single one of these 👀

This is carried out with the following messages. The hash algorithm for computing the exchange hash is defined by the method name, and it's called HASH. The public key algorithm for signing is negotiated with the KEXINIT messages 🦋

First, the client sends:

  byte    SSH_MSG_KEY_DH_GEX_REQUEST
  uint32  min, minimal size in bits of an acceptable group
  uint32  n, preferred size in bits of the group the server will send
  uint32  max, maximal size in bits of an acceptable group

The server responds with:

  byte    SSH_MSG_KEX_DH_GEX_GROUP
  mpint   p, safe prime
  mpint   g, generator for subgroup in GF(p)

The client responds with:

  byte    SSH_MSG_KEX_DH_GEX_INIT
  mpint   e

The server responds with:

  byte    SSH_MSG_KEX_DH_GEX_REPLY
  string  server public host key and certificates (K_S)
  mpint   f
  string  signature of H

The hash H is the HASH hash of the concatenation of the following 💖

  string  V_C, the client's version string (CR and NL excluded)
  string  V_S, the server's version string (CR and NL excluded)
  string  I_C, the payload of the client's SSH_MSG_KEXINIT
  string  I_S, the payload of the server's SSH_MSG_KEXINIT
  string  K_S, the host key
  uint32  min, minimal size in bits of an acceptable group
  uint32  n, preferred size in bits of the group the server will send
  uint32  max, maximal size in bits of an acceptable group
  mpint   p, safe prime
  mpint   g, generator for subgroup
  mpint   e, exchange value sent by the client
  mpint   f, exchange value sent by the server
  mpint   K, the shared secret

This value is called the exchange hash, and it's used to authenticate the key exchange as per [RFC4253] 🫶

8. Acknowledgements ✨

okay bestie, the shoutouts 🫶 this doc is partly built on "SSH Transport Layer Protocol" [RFC4253] by T. Ylonen, T. Kivinen, M. Saarinen, T. Rinne, and S. Lehtinen. iconic foundations 👑

Markku-Juhani Saarinen spotted that the least significant bit of the private exponent can be recovered efficiently when using safe primes and a subgroup with an order divisible by two. the way he caught that 😭🔥

Bodo Moeller suggested that the server send only one group. less complexity in the implementation and less data going back and forth between client and server. main character idea 💅

Appendix A: Generation of Safe Primes 🌸

okay so the "Handbook of Applied Cryptography" [MENEZES] has an algorithm for generating a k-bit safe prime p. it got a little tweak so that 2 is a generator for the multiplicative group mod p 🦋

Do the following:
1. Select a random (k-1)-bit prime q, so that q mod 12 = 5.
2. Compute p := 2q + 1, and test whether p is prime (using, e.g., trial division and the Rabin-Miller test).
Repeat until p is prime.

if you're using the OpenSSL libraries, you can make a group with a 1024-bit safe prime and 2 as the generator like this ✨

DH *d = NULL;
d = DH_generate_parameters(1024, DH_GENERATOR_2, NULL, NULL);
BN_print_fp(stdout, d->p);

and the order of the subgroup generated by 2 is q = p - 1 💖

References 📚

Normative References

[FIPS-180-2]   National Institute of Standards and Technology (NIST),
               "Secure Hash Standard (SHS)", FIPS PUB 180-2,
               August 2002.

[RFC4251]      Ylonen, T. and C. Lonvick, "The Secure Shell (SSH)
               Protocol Architecture", RFC 4251, January 2006.

[RFC4253]      Lonvick, C., "The Secure Shell (SSH) Transport Layer
               Protocol", RFC 4253, January 2006.

[RFC2119]      Bradner, S., "Key words for use in RFCs to Indicate
               Requirement Levels", BCP 14, RFC 2119, March 1997.

Informative References

[MENEZES]      Menezes, A., van Oorschot, P., and S. Vanstone,
               "Handbook of Applied Cryptography", CRC Press, p. 537,
               1996.

[VAN-OORSCHOT] van Oorschot, P. and M. Wiener, "On Diffie-Hellman key
               agreement with short exponents", Advances in
               Cryptology -EUROCRYPT'96, LNCS 1070,
               Springer-Verlag, pp. 332-343, 1996.

[WALDVOGEL]    Waldvogel, C. and J. Massey, "The probability
               distribution of the Diffie-Hellman key", Proceedings
               of AUSCRYPT 92, LNCS 718, Springer-Verlag, pp.
               492-504, 1993.

Authors' Addresses 💌

the people behind it, with their emails 🧚

Markus Friedl
EMail: markus@openbsd.org


Niels Provos
EMail: provos@citi.umich.edu


William A. Simpson
EMail: wsimpson@greendragon.com

Full Copyright Statement ⚖️

okay, the legal bit 🙈 the copyright belongs to The Internet Society (2006), and the rules are:

Copyright (C) The Internet Society (2006). This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights. This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Intellectual Property 🦋

the IETF doesn't take a side on whether any IPR claims apply to the tech in this doc, or whether licenses are available. it also doesn't claim it went looking for any. the info about rights for RFC docs is in BCP 78 and BCP 79.

copies of IPR disclosures sent to the IETF Secretariat, plus any assurances of licenses, or the results of trying to get a general license for implementers or users, can be found in the IETF on-line IPR repository at http://www.ietf.org/ipr.

the IETF also invites anyone to flag any copyrights, patents or patent applications, or other proprietary rights that might cover technology needed to implement this standard. send that to ietf-ipr@ietf.org 💅

Acknowledgement 💜

funding for the RFC Editor function comes from the IETF Administrative Support Activity (IASA). and that's a wrap, periodt ✨

📦 where this page comes from

ietf: rfc4419 2006-03
💖 girlified by claude-haiku-5-5 on 2026-10-16: a language model's rewrite of the original, under its terms