Hello,

I have run into an isue where putty key exchange is unable to agree with a device I only have ssh access to.

How can I update putty.exe to handle diffie-hellman-group16-sha1 ?

OR is there a client out there I can use in the mean time until putty updates come through ?

The error when I SSH is:
Key exchange failed.
No compatible key-exchange method. The server supports these methods: diffie-hellman-group16-sha1

Regards
Antony

Antony Somerville <antony.somerville@gmail.com> wrote:
> How can I update putty.exe to handle diffie-hellman-group16-sha1 ?

It's not very difficult, provided you know the group parameters. All
the code is in crypto/diffie-hellman.c.

But where does this method come from? The SSH assigned numbers page at
http://www.iana.org/assignments/ssh-parameters/ssh-parameters.xhtml
lists diffie-hellman-group16-sha512, but not -sha1. Even under the
assumption that it's the same group with a different hash function,
that's going outside the bounds of the standard - there's no
expectation that you should be able to make up new names in that
namespace by re-composing existing names in that way.

What SSH server is supporting this nonstandard name as its only kex
method?
--
for k in [pow(x,37,0x1a1298d262b49c895d47f) for x in [0x50deb914257022de7fff,
0x213558f2215127d5a2d1, 0x90c99e86d08b91218630, 0x109f3d0cfbf640c0beee7,
0xc83e01379a5fbec5fdd1, 0x19d3d70a8d567e388600e, 0x534e2f6e8a4a33155123]]:
print("".join([chr(32+3*((k>>x)&1))for x in range(79)])) # <anakin@pobox.com>

Hi Simon,

Thanks for replying. The kex on a Cisco access point with a DH min key size of 4096 and the IOS prompted for this particular cipher.

I remedied for myself by changing that parameter to min size 2048. The IOS then prompted for the DH kex that already is present in putty.

Regards
Antony.

> But where does this method come from? The SSH assigned numbers page at
> http://www.iana.org/assignments/ssh-parameters/ssh-parameters.xhtml
> lists diffie-hellman-group16-sha512, but not -sha1. Even under the
> assumption that it's the same group with a different hash function,
> that's going outside the bounds of the standard - there's no
> expectation that you should be able to make up new names in that
> namespace by re-composing existing names in that way.
>
> What SSH server is supporting this nonstandard name as its only kex
> method?

Antony Somerville <antony.somerville@gmail.com> wrote:
> Thanks for replying. The kex on a Cisco access point with a DH min key
> size of 4096 and the IOS prompted for this particular cipher.

Please report a bug to Cisco - they should not be unilaterally
inventing kex names in the IANA-controlled (non-domain-suffixed)
namespace, no matter how obvious they think the meaning of those names
are!

> I remedied for myself by changing that parameter to min size 2048. The
> IOS then prompted for the DH kex that already is present in putty.

That's good to hear.
--
import hashlib; print((lambda p,q,g,y,r,s,m: (lambda w:(pow(g,int(hashlib.sha1(
m.encode('ascii')).hexdigest(),16)*w%q,p)*pow(y,r*w%q,p)%p)%q)(pow(s,q-2,q))==r
and m)(0xb80b5dacabab6145,0xf70027d345023,0x7643bc4018957897,0x11c2e5d9951130c9
,0xa54d9cbe4e8ab,0x746c50eaa1910, "Simon Tatham <anakin@pobox.com>" ))