SSH: Understanding Algorithm Negotiation -


i'm writing ssh honeypot in java personal project. i'm having trouble understanding algorithm negotiation. precise, structure of received data client. here receive, personal annotations:

00 00 07 ac == packet length  08 == padding length  14 ==  ssh_msg_kexinit  6c 31 89 77 eb 54 e1 8b d4 b1 35 08 fd 52 65 6e == cookie  00 00 00 d4 == string length kex algorithms in byte form   00 00 01 67 == string length server host key algorithms in byte form  00 00 00 e9 == string length encryption_algorithms_client_to_server in byte form  00 00 00 e9 == string length encryption_algorithms_server_to_client in byte form  00 00 01 92 == string length mac_algorithms_client_to_server in byte form  00 00 01 92 == string length mac_algorithms_server_to_client in byte form  00 00 00 1a == string length compression_algorithms_client_to_server in byte form  00 00 00 1a == string length compression_algorithms_server_to_client in byte form  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 

information negotiation can found here: rfc4253

there 2 things don't understand:

  1. the padding: how calculated? according rfc4253, there should random padding (8 bytes in case). don't see anywhere. moreover, size of packet length + padding length + payload + padding should multiple of 8, isn't case here. (?)

  2. the packet length: if sum after packet length, 0x797. adding 8 byte padding (wherever is), 0x79f. correct in thinking languages client->server , server->client, although not defined, still take 4 byte each? gets me 0x7a7. if add boolean , reserved 4 bytes (see packet structure), 0x7ac. correct? mean trailing zeros have following structure:

    00 00 00 00 == length of string language_client_to_server 00 00 00 00 == length of string language_server_to_client 00 == boolean first_kex_packet_follows 00 00 00 00 == reserved rest: garbage? 


Comments

Popular posts from this blog

Android : Making Listview full screen -

javascript - Parse JSON from the body of the POST -

javascript - Chrome Extension: Interacting with iframe embedded within popup -