SSH2_MSG_KEX_DH_GEX_REQUEST_OLD

[Niels Provos]

Hi,

> length  = 0000 008c
> padding length = 06
> messagetype = 1e (SSH2_MSG_KEX_DH_GEX_REQUEST_OLD)
> padding = b8 218e c680
> 
> and the next four byte should have the n which is 0000 0080 which is less
> than 1024.
According to the client code, this can never happen.

	nbits = dh_estimate(kex->we_need * 8);

	if (datafellows & SSH_OLD_DHGEX) {
		debug("SSH2_MSG_KEX_DH_GEX_REQUEST_OLD sent");

		/* Old GEX request */
		packet_start(SSH2_MSG_KEX_DH_GEX_REQUEST_OLD);
		packet_put_int(nbits);

The smallest possible value that dh_estimate returns is 512 bits.
I have no idea why you would see 128.  Are you sure that this
is an openssh client that you are talking with?

Niels.