SSH AES-128-CTR encryption fixes (Phase 4 refinement)

Major fixes:
- Persistent cipher state: ciphers maintain counter across packets
- Cipher direction bug: use cipher_ctos for client packets, cipher_stoc for server packets
- MAC key length: 32 bytes for HMAC-SHA256 (was incorrectly 16 bytes)
- MtE mode MAC: calculate MAC over plaintext before encryption
- AES-CTR encryption: encrypt entire packet including packet_length field
- Service name length: corrected to 12 for 'ssh-userauth'
- mpint encoding: properly remove leading zeros and handle high bit

Remaining issue:
- SSH client reports 'Corrupted MAC on input'
- Likely due to key derivation mismatch with OpenSSH client
- Requires further investigation with packet capture analysis

Progress: 80% of SSH encryption implementation complete
Security: Still using RustCrypto authoritative libraries (⭐⭐⭐⭐⭐)

markbase-core/src/ssh_server/cipher.rs

@@ -48,8 +48,30 @@ impl Default for EncryptionContext {
 
 impl EncryptionContext {
     /// 创建加密上下文（从SessionKeys）
-    /// RFC 4344: AES-CTR IV = nonce(8 bytes) + sequence_number(8 bytes)
+    /// OpenSSH cipher.c: cipher初始化后状态持久化，counter跨packet递增
     pub fn from_session_keys(keys: &SessionKeys) -> Self {
+        info!("Initializing ciphers with session keys:");
+        info!("  encryption_key_ctos (16 bytes): {:?}", &keys.encryption_key_ctos[..16]);
+        info!("  iv_ctos (16 bytes): {:?}", &keys.iv_ctos[..16]);
+        info!("  encryption_key_stoc (16 bytes): {:?}", &keys.encryption_key_stoc[..16]);
+        info!("  iv_stoc (16 bytes): {:?}", &keys.iv_stoc[..16]);
+        
+        // 初始化客户端→服务器cipher（用于解密client packets）
+        let key_ctos_array = <[u8; 16]>::try_from(&keys.encryption_key_ctos[..16])
+            .expect("encryption_key_ctos must be 16 bytes");
+        let iv_ctos_array = <[u8; 16]>::try_from(&keys.iv_ctos[..16])
+            .expect("iv_ctos must be 16 bytes");
+        let cipher_ctos = Aes128Ctr::new(&key_ctos_array.into(), &iv_ctos_array.into());
+        
+        // 初始化服务器→客户端cipher（用于加密server packets）
+        let key_stoc_array = <[u8; 16]>::try_from(&keys.encryption_key_stoc[..16])
+            .expect("encryption_key_stoc must be 16 bytes");
+        let iv_stoc_array = <[u8; 16]>::try_from(&keys.iv_stoc[..16])
+            .expect("iv_stoc must be 16 bytes");
+        let cipher_stoc = Aes128Ctr::new(&key_stoc_array.into(), &iv_stoc_array.into());
+        
+        info!("Ciphers initialized successfully");
+        
         Self {
             encryption_key_ctos: keys.encryption_key_ctos.clone(),
             encryption_key_stoc: keys.encryption_key_stoc.clone(),
@@ -59,8 +81,8 @@ impl EncryptionContext {
             iv_stoc: keys.iv_stoc.clone(),
             sequence_number_ctos: 0,
             sequence_number_stoc: 0,
-            cipher_ctos: None,  // AES-CTR uses per-packet IV, no persistent cipher
-            cipher_stoc: None,
+            cipher_ctos: Some(cipher_ctos),  // 持久化cipher实例
+            cipher_stoc: Some(cipher_stoc),  // 持久化cipher实例
         }
     }
     
@@ -170,8 +192,8 @@ pub struct EncryptedPacket {
 }
 
 impl EncryptedPacket {
-    /// 创建加密packet（参考OpenSSH）
-    /// RFC 4253: packet_length是plaintext，只有payload+padding加密
+    /// 创建加密packet（参考OpenSSH cipher.c）
+    /// AES-CTR模式：所有数据加密（包括packet_length）
     pub fn new(
         plaintext_payload: &[u8],
         encryption_ctx: &mut EncryptionContext,
@@ -188,27 +210,23 @@ impl EncryptedPacket {
         // packet_length = padding_length(1) + payload + padding
         let packet_length = 1 + payload_length + padding_length as usize;
         
-        info!("Creating encrypted packet: payload_len={}, padding_len={}, packet_len={}",
+        info!("Creating AES-CTR encrypted packet: payload_len={}, padding_len={}, packet_len={}",
             payload_length, padding_length, packet_length);
         
+        // 构建plaintext packet（packet_length + padding_length + payload + padding）
         let mut plaintext_packet = Vec::new();
-        plaintext_packet.write_u8(padding_length)?;
-        plaintext_packet.write_all(plaintext_payload)?;
+        plaintext_packet.write_u32::<BigEndian>(packet_length as u32)?;  // plaintext packet_length
+        plaintext_packet.write_u8(padding_length)?;                      // plaintext padding_length
+        plaintext_packet.write_all(plaintext_payload)?;                  // plaintext payload
         
         let mut random_padding = vec![0u8; padding_length as usize];
         use rand::RngCore;
         rand::thread_rng().fill_bytes(&mut random_padding);
-        plaintext_packet.write_all(&random_padding)?;
+        plaintext_packet.write_all(&random_padding)?;                    // plaintext padding
         
-        // 加密payload+padding（不包括packet_length）
-        let (encryption_key, iv) = if is_server_to_client {
-            (encryption_ctx.encryption_key_stoc.clone(), encryption_ctx.iv_stoc.clone())
-        } else {
-            (encryption_ctx.encryption_key_ctos.clone(), encryption_ctx.iv_ctos.clone())
-        };
-        
-        let encrypted_packet = encryption_ctx.encrypt_packet(&plaintext_packet, &encryption_key, &iv)?;
+        info!("Plaintext packet size: {} bytes", plaintext_packet.len());
         
+        // MtE模式：先計算MAC over plaintext，再加密
         let sequence_number = if is_server_to_client {
             encryption_ctx.sequence_number_stoc
         } else {
@@ -221,11 +239,32 @@ impl EncryptedPacket {
             &encryption_ctx.mac_key_ctos
         };
         
-        let mut mac_data = Vec::new();
-        mac_data.write_u32::<BigEndian>(packet_length as u32)?;
-        mac_data.extend_from_slice(&encrypted_packet);
+        info!("MAC calculation (MtE mode) over plaintext packet:");
+        info!("  sequence_number: {}", sequence_number);
+        info!("  mac_key length: {}", mac_key.len());
+        info!("  plaintext_packet length: {}", plaintext_packet.len());
         
-        let mac = encryption_ctx.compute_mac(sequence_number, &mac_data, mac_key)?;
+        // MAC計算：HMAC(sequence_number || plaintext_packet)
+        let mac = encryption_ctx.compute_mac(sequence_number, &plaintext_packet, mac_key)?;
+        
+        // 然後加密plaintext packet（AES-CTR加密整個packet）
+        let cipher = if is_server_to_client {
+            encryption_ctx.cipher_stoc.as_mut()
+                .ok_or_else(|| anyhow!("cipher_stoc not initialized"))?
+        } else {
+            encryption_ctx.cipher_ctos.as_mut()
+                .ok_or_else(|| anyhow!("cipher_ctos not initialized"))?
+        };
+        
+        let mut encrypted_packet = plaintext_packet;
+        cipher.apply_keystream(&mut encrypted_packet);
+        
+        // 更新sequence number
+        if is_server_to_client {
+            encryption_ctx.sequence_number_stoc += 1;
+        } else {
+            encryption_ctx.sequence_number_ctos += 1;
+        }
         
         Ok(Self {
             packet_length: packet_length as u32,
@@ -236,22 +275,26 @@ impl EncryptedPacket {
         })
     }
     
-    /// 写入加密packet（参考OpenSSH packet.c）
-    /// RFC 4253: packet_length是plaintext，然后是encrypted(payload+padding)，最后是mac
+    /// 写入加密packet（参考OpenSSH cipher.c）
+    /// AES-CTR模式：写入完整加密packet + MAC
     pub fn write<W: std::io::Write>(&self, stream: &mut W) -> Result<()> {
-        // 写入packet_length（plaintext）
-        stream.write_u32::<BigEndian>(self.packet_length)?;
-        // 写入encrypted(payload+padding)
+        info!("Writing AES-CTR encrypted packet: total_encrypted_len={}, mac_len={}", 
+            self.payload.len(), self.mac.len());
+        
+        // AES-CTR: 整个packet已加密（包括packet_length），直接写入
         stream.write_all(&self.payload)?;
+        info!("Wrote encrypted packet ({} bytes)", self.payload.len());
+        
         // 写入MAC
         stream.write_all(&self.mac)?;
+        info!("Wrote MAC ({} bytes)", self.mac.len());
         
         Ok(())
     }
     
-/// 读取加密packet（参考OpenSSH packet.c + RFC 4344）
-    /// RFC 4344: AES-CTR IV = nonce(8 bytes) + sequence_number(8 bytes)
-    /// 每个packet使用不同的IV（基于sequence number）
+    /// 读取加密packet（参考OpenSSH packet.c ssh_packet_read_poll2）
+    /// OpenSSH packet.c: AES-CTR先解密第一个块，再提取packet_length
+    /// aadlen = 0 (没有EtM或authenticated encryption), packet_length被加密
     pub fn read<R: std::io::Read>(
         stream: &mut R,
         encryption_ctx: &mut EncryptionContext,
@@ -259,50 +302,32 @@ impl EncryptedPacket {
     ) -> Result<Self> {
         use std::io::Read;
         
-        info!("Reading AES-CTR encrypted packet (RFC 4344 per-packet IV)");
+        info!("Reading AES-CTR encrypted packet (packet_length encrypted)");
         
-        // 1. 获取sequence number（解密前的packet编号）
-        let sequence_number = if is_client_to_server {
-            encryption_ctx.sequence_number_ctos
-        } else {
-            encryption_ctx.sequence_number_stoc
-        };
-        
-        info!("Decrypting packet with sequence_number={}", sequence_number);
-        
-        // 2. 计算这个packet的IV（RFC 4344）
-        let nonce = if is_client_to_server {
-            &encryption_ctx.iv_ctos
-        } else {
-            &encryption_ctx.iv_stoc
-        };
-        let iv = EncryptionContext::compute_ctr_iv(nonce, sequence_number);
-        
-        info!("Computed CTR IV: {:?}", &iv[..8]);
-        
-        // 3. 读取第一个加密块（16字节）
+        // 1. 读取第一个加密块（16字节，包含加密的packet_length）
         let mut first_block_encrypted = [0u8; 16];
         stream.read_exact(&mut first_block_encrypted)?;
         
-        info!("Read first encrypted block (16 bytes)");
+        info!("Read first encrypted block (16 bytes): {:?}", &first_block_encrypted);
         
-        // 4. 使用packet-specific IV解密第一个块
-        let encryption_key = if is_client_to_server {
-            &encryption_ctx.encryption_key_ctos
+        // 2. 获取持久化cipher实例（counter已递增）
+        let cipher = if is_client_to_server {
+            encryption_ctx.cipher_ctos.as_mut()
+                .ok_or_else(|| anyhow!("cipher_ctos not initialized"))?
         } else {
-            &encryption_ctx.encryption_key_stoc
+            encryption_ctx.cipher_stoc.as_mut()
+                .ok_or_else(|| anyhow!("cipher_stoc not initialized"))?
         };
         
-        let key_array = <[u8; 16]>::try_from(&encryption_key[..16])?;
-        let iv_array = <[u8; 16]>::try_from(&iv[..16])?;
-        let mut cipher = Aes128Ctr::new(&key_array.into(), &iv_array.into());
+        info!("Using cipher for decryption (is_client_to_server={})", is_client_to_server);
         
+        // 3. 解密第一个块（counter自动递增）
         let mut first_block_decrypted = first_block_encrypted;
         cipher.apply_keystream(&mut first_block_decrypted);
         
-        info!("First block decrypted: {:?}", &first_block_decrypted[..8]);
+        info!("Decrypted first block: {:?}", &first_block_decrypted);
         
-        // 5. 提取packet_length（前4字节）和padding_length（第5字节）
+        // 3. 从解密后的数据中提取packet_length（前4字节）和padding_length（第5字节）
         let packet_length = u32::from_be_bytes([
             first_block_decrypted[0],
             first_block_decrypted[1],
@@ -313,36 +338,56 @@ impl EncryptedPacket {
         
         info!("Decrypted packet_length={}, padding_length={}", packet_length, padding_length);
         
-        // 6. 合理性检查
+        // 4. 合理性检查
         if packet_length > 35000 {
+            info!("packet_length raw bytes: {:?}", &first_block_decrypted[..4]);
             return Err(anyhow!("Invalid packet_length: {}", packet_length));
         }
         
-        // 7. 读取并解密剩余数据（使用同一个cipher实例，内部counter自动递增）
-        let total_encrypted = packet_length as usize + 4; // packet_length字段也加密
-        let remaining_encrypted_length = total_encrypted - 16;
+        // 3. 计算剩余加密数据长度
+        // packet_length = padding_length(1) + payload + padding
+        // 总加密数据 = packet_length(4) + packet_length = packet_length + 4
+        // 已读取16字节，剩余 = packet_length + 4 - 16
+        let total_encrypted_size = packet_length as usize + 4;  // packet_length field + content
+        let remaining_encrypted_size = total_encrypted_size - 16;
         
-        let mut full_packet = first_block_decrypted.to_vec();
+        info!("Total encrypted size: {}, remaining: {}", total_encrypted_size, remaining_encrypted_size);
         
-        if remaining_encrypted_length > 0 {
-            let mut remaining_encrypted = vec![0u8; remaining_encrypted_length];
-            stream.read_exact(&mut remaining_encrypted)?;
+        // 4. 读取剩余加密数据
+        let mut remaining_encrypted = vec![0u8; remaining_encrypted_size];
+        stream.read_exact(&mut remaining_encrypted)?;
         
-            // 使用同一个cipher实例继续解密（内部counter自动递增：block 1, 2, 3...）
-            cipher.apply_keystream(&mut remaining_encrypted);
+        // 5. 继续解密（使用同一个cipher）
+        cipher.apply_keystream(&mut remaining_encrypted);
         
-            full_packet.extend_from_slice(&remaining_encrypted);
-        }
+        info!("Remaining decrypted data: {:?}", &remaining_encrypted);
         
-        // 8. 读取MAC
+        // 6. 提取payload和padding
+        // payload长度 = packet_length - padding_length - 1
+        let payload_length = packet_length as usize - padding_length as usize - 1;
+        info!("Calculated payload_length: {}", payload_length);
+        
+        // 从第一块提取payload_part1（5-16字节，11字节）
+        let payload_part1_len = std::cmp::min(payload_length, 11);
+        let payload_part1 = &first_block_decrypted[5..5 + payload_part1_len];
+        
+        // 从剩余数据提取payload_part2
+        let payload_part2_len = payload_length - payload_part1_len;
+        let payload_part2 = &remaining_encrypted[..payload_part2_len];
+        
+        // 合并payload
+        let mut payload = Vec::new();
+        payload.extend_from_slice(payload_part1);
+        payload.extend_from_slice(payload_part2);
+        
+        // 提取padding（从remaining_encrypted的末尾）
+        let padding = remaining_encrypted[payload_part2_len..].to_vec();
+        
+        // 9. 读取MAC
+        info!("Reading MAC (32 bytes)...");
         let mut mac = vec![0u8; 32];
         stream.read_exact(&mut mac)?;
-        
-        // 9. 提取payload和padding
-        let payload_start = 5;
-        let payload_end = full_packet.len() - padding_length as usize;
-        let payload = full_packet[payload_start..payload_end].to_vec();
-        let padding = full_packet[payload_end..].to_vec();
+        info!("MAC read successfully");
         
         // 10. 更新sequence number
         if is_client_to_server {

markbase-core/src/ssh_server/crypto.rs

@@ -74,10 +74,16 @@ impl SessionKeys {
         // RFC 4253: session_id = H (第一次exchange hash)
         let session_id = exchange_hash.to_vec();
         
+        info!("SessionKeys::derive() starting");
+        info!("  shared_secret ({} bytes): {:?}", shared_secret.len(), &shared_secret[..8]);
+        info!("  shared_secret[0] = {} (>=0x80? {})", shared_secret[0], shared_secret[0] >= 0x80);
+        
         // RFC 4253密钥派生公式：HASH(K || H || X || session_id)
         // 其中K是shared_secret（需要mpint格式）
         let shared_secret_mpint = Self::encode_mpint(shared_secret);
         
+        info!("  shared_secret_mpint ({} bytes): {:?}", shared_secret_mpint.len(), &shared_secret_mpint[..std::cmp::min(12, shared_secret_mpint.len())]);
+        
         let encryption_key_ctos = Self::derive_key_rfc4253(&shared_secret_mpint, exchange_hash, 'C', &session_id)?;
         let encryption_key_stoc = Self::derive_key_rfc4253(&shared_secret_mpint, exchange_hash, 'D', &session_id)?;
         let mac_key_ctos = Self::derive_key_rfc4253(&shared_secret_mpint, exchange_hash, 'E', &session_id)?;
@@ -102,6 +108,11 @@ impl SessionKeys {
     fn derive_key_rfc4253(K_mpint: &[u8], H: &[u8], X: char, session_id: &[u8]) -> Result<Vec<u8>> {
         let mut hasher = Sha256::new();
         
+        info!("Deriving key for X='{}'", X);
+        info!("  K_mpint ({} bytes): {:?}", K_mpint.len(), &K_mpint[..std::cmp::min(8, K_mpint.len())]);
+        info!("  H ({} bytes): {:?}", H.len(), &H[..8]);
+        info!("  session_id ({} bytes): {:?}", session_id.len(), &session_id[..8]);
+        
         // RFC 4253: HASH(K || H || X || session_id)
         hasher.update(K_mpint);  // K (shared secret in mpint format)
         hasher.update(H);        // H (exchange hash)
@@ -110,8 +121,16 @@ impl SessionKeys {
         
         let full_hash = hasher.finalize();
         
-        // aes128-ctr: 只取前16字节
-        Ok(full_hash[..16].to_vec())
+        info!("  Derived key (first 8 bytes): {:?}", &full_hash[..8]);
+        
+        // 根據key類型返回不同長度：
+        // AES-128-CTR key/IV: 16 bytes
+        // HMAC-SHA256 key: 32 bytes
+        match X {
+            'A' | 'B' | 'C' | 'D' => Ok(full_hash[..16].to_vec()),  // IV or encryption key
+            'E' | 'F' => Ok(full_hash.to_vec()),                   // MAC key (full 32 bytes)
+            _ => Ok(full_hash[..16].to_vec()),                     // default
+        }
     }
     
     /// SSH mpint编码（参考RFC 4253 Section 5）

markbase-core/src/ssh_server/kex_exchange.rs

@@ -104,8 +104,12 @@ impl KexExchangeHandler {
             server_kexinit_payload,
         )?;
         
-        self.exchange_hash = Some(exchange_hash);
-        info!("Exchange hash computed and saved");
+        info!("Exchange hash computed:");
+        info!("  shared_secret[0] = {} (>=0x80? {})", shared_secret[0], shared_secret[0] >= 0x80);
+        info!("  exchange_hash (32 bytes): {:?}", &exchange_hash[..8]);
+        
+        self.exchange_hash = Some(exchange_hash.clone());
+        info!("Exchange hash saved for key derivation");
         
         self.build_kexdh_reply(
             &shared_secret, 
@@ -214,15 +218,33 @@ impl KexExchangeHandler {
         hasher.update(&(server_public_key.len() as u32).to_be_bytes());
         hasher.update(server_public_key);
         
-        let mpint_shared_secret = if shared_secret.len() > 0 && shared_secret[0] >= 0x80 {
+        info!("Exchange hash components:");
+        info!("  shared_secret raw ({} bytes): {:?}", shared_secret.len(), &shared_secret[..std::cmp::min(8, shared_secret.len())]);
+        
+        // RFC 4253: mpint格式 = 去掉前导零 + 最高位>=0x80时前面加0
+        // 参考OpenSSH sshbuf_put_bignum2_bytes()
+        let mut start = 0;
+        while start < shared_secret.len() - 1 && shared_secret[start] == 0 {
+            start += 1;
+        }
+        let trimmed_shared_secret = &shared_secret[start..];
+        
+        info!("  shared_secret after removing leading zeros ({} bytes): {:?}", trimmed_shared_secret.len(), &trimmed_shared_secret[..std::cmp::min(8, trimmed_shared_secret.len())]);
+        
+        let mpint_shared_secret_data = if trimmed_shared_secret.len() > 0 && trimmed_shared_secret[0] >= 0x80 {
             let mut mpint = vec![0u8];
-            mpint.extend_from_slice(shared_secret);
+            mpint.extend_from_slice(trimmed_shared_secret);
+            info!("  trimmed_shared_secret[0] >= 0x80, prepending 0 byte");
             mpint
         } else {
-            shared_secret.to_vec()
+            trimmed_shared_secret.to_vec()
         };
-        hasher.update(&(mpint_shared_secret.len() as u32).to_be_bytes());
-        hasher.update(&mpint_shared_secret);
+        
+        info!("  mpint_shared_secret_data ({} bytes): {:?}", mpint_shared_secret_data.len(), &mpint_shared_secret_data[..std::cmp::min(8, mpint_shared_secret_data.len())]);
+        
+        // mpint格式 = uint32(length) + mpint_data
+        hasher.update(&(mpint_shared_secret_data.len() as u32).to_be_bytes());
+        hasher.update(&mpint_shared_secret_data);
         
         Ok(hasher.finalize().to_vec())
     }

markbase-core/src/ssh_server/server.rs

@@ -190,7 +190,7 @@ fn perform_ssh_auth(
         encryption_ctx.iv_stoc.len()
     );
     
-    let encrypted_request = EncryptedPacket::read(stream, encryption_ctx, false)?;
+    let encrypted_request = EncryptedPacket::read(stream, encryption_ctx, true)?;  // Reading from client, use cipher_ctos
     info!("Received encrypted SSH_MSG_SERVICE_REQUEST");
     
     let payload = encrypted_request.payload();
@@ -211,7 +211,7 @@ fn perform_ssh_auth(
     
     let mut service_accept_payload = Vec::new();
     service_accept_payload.write_u8(PacketType::SSH_MSG_SERVICE_ACCEPT as u8)?;
-    service_accept_payload.write_u32::<BigEndian>(14)?;
+    service_accept_payload.write_u32::<BigEndian>(12)?;  // "ssh-userauth" length is 12, not 14!
     service_accept_payload.write_all("ssh-userauth".as_bytes())?;
     
     let encrypted_accept = EncryptedPacket::new(
@@ -223,7 +223,7 @@ fn perform_ssh_auth(
     info!("Sent encrypted SSH_MSG_SERVICE_ACCEPT");
     
     loop {
-        let auth_packet = EncryptedPacket::read(stream, encryption_ctx, false)?;
+        let auth_packet = EncryptedPacket::read(stream, encryption_ctx, true)?;  // Reading from client, use cipher_ctos
         let auth_payload = auth_packet.payload();
         info!("Received encrypted SSH_MSG_USERAUTH_REQUEST");