X-Git-Url: http://git.silcnet.org/gitweb/?a=blobdiff_plain;f=lib%2Fsilccore%2Fsilcauth.c;h=f2c73f0ece9fad49a5081d464595d561760068db;hb=1ea936cbf1bb3b19bd55839b904ef59ada84b8b5;hp=9a00903b4d814b8a37eb555f5617e32d2be9022b;hpb=2a2db637fb3b961add7baa38b057648e100df046;p=silc.git

diff --git a/lib/silccore/silcauth.c b/lib/silccore/silcauth.c
index 9a00903b..f2c73f0e 100644
--- a/lib/silccore/silcauth.c
+++ b/lib/silccore/silcauth.c
@@ -2,15 +2,14 @@
 
   silcauth.c
 
-  Author: Pekka Riikonen <priikone@poseidon.pspt.fi>
+  Author: Pekka Riikonen <priikone@silcnet.org>
 
-  Copyright (C) 2001 Pekka Riikonen
+  Copyright (C) 2001 - 2007 Pekka Riikonen
 
   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
-  the Free Software Foundation; either version 2 of the License, or
-  (at your option) any later version.
-  
+  the Free Software Foundation; version 2 of the License.
+
   This program is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
@@ -19,7 +18,7 @@
 */
 /* $Id$ */
 
-#include "silcincludes.h"
+#include "silc.h"
 #include "silcauth.h"
 
 /******************************************************************************
@@ -30,78 +29,124 @@
 
 /* Authentication Payload structure */
 struct SilcAuthPayloadStruct {
-  unsigned short len;
-  unsigned short auth_method;
-  unsigned short random_len;
+  SilcStack stack;
   unsigned char *random_data;
-  unsigned short auth_len;
   unsigned char *auth_data;
+  SilcUInt16 auth_len;
+  SilcUInt16 len;
+  SilcUInt16 auth_method;
+  SilcUInt16 random_len;
 };
 
 /* Parses and returns Authentication Payload */
 
-SilcAuthPayload silc_auth_payload_parse(SilcBuffer buffer)
+SilcAuthPayload silc_auth_payload_parse(SilcStack stack,
+					const unsigned char *data,
+					SilcUInt32 data_len)
 {
-  SilcAuthPayload new;
+  SilcBufferStruct buffer;
+  SilcAuthPayload newp;
   int ret;
 
   SILC_LOG_DEBUG(("Parsing Authentication Payload"));
 
-  new = silc_calloc(1, sizeof(*new));
+  silc_buffer_set(&buffer, (unsigned char *)data, data_len);
+
+  if (stack)
+    stack = silc_stack_alloc(0, stack);
+
+  newp = silc_scalloc(stack, 1, sizeof(*newp));
+  if (!newp) {
+    silc_stack_free(stack);
+    return NULL;
+  }
+  newp->stack = stack;
 
   /* Parse the payload */
-  ret = silc_buffer_unformat(buffer, 
-			     SILC_STR_UI_SHORT(&new->len),
-			     SILC_STR_UI_SHORT(&new->auth_method),
-			     SILC_STR_UI16_NSTRING_ALLOC(&new->random_data,
-							 &new->random_len),
-			     SILC_STR_UI16_NSTRING_ALLOC(&new->auth_data,
-							 &new->auth_len),
-			     SILC_STR_END);
+  ret = silc_buffer_sunformat(stack, &buffer,
+			      SILC_STR_UI_SHORT(&newp->len),
+			      SILC_STR_UI_SHORT(&newp->auth_method),
+			      SILC_STR_UI16_NSTRING_ALLOC(&newp->random_data,
+							  &newp->random_len),
+			      SILC_STR_UI16_NSTRING_ALLOC(&newp->auth_data,
+							  &newp->auth_len),
+			      SILC_STR_END);
   if (ret == -1) {
-    silc_free(new);
+    silc_sfree(stack, newp);
+    silc_stack_free(stack);
     return NULL;
   }
 
-  if (new->len != buffer->len) {
-    silc_auth_payload_free(new);
+  if (newp->len != silc_buffer_len(&buffer) ||
+      newp->random_len + newp->auth_len > silc_buffer_len(&buffer) - 8) {
+    silc_auth_payload_free(newp);
+    return NULL;
+  }
+
+  /* Authentication data must be provided */
+  if (newp->auth_len < 1)  {
+    silc_auth_payload_free(newp);
     return NULL;
   }
 
   /* If password authentication, random data must not be set */
-  if (new->auth_method == SILC_AUTH_PASSWORD && new->random_len) {
-    silc_auth_payload_free(new);
+  if (newp->auth_method == SILC_AUTH_PASSWORD && newp->random_len) {
+    silc_auth_payload_free(newp);
+    return NULL;
+  }
+
+  /* If public key authentication, random data must be at least 128 bytes */
+  if (newp->auth_method == SILC_AUTH_PUBLIC_KEY && newp->random_len < 128) {
+    silc_auth_payload_free(newp);
     return NULL;
   }
 
-  return new;
+  return newp;
 }
 
 /* Encodes authentication payload into buffer and returns it */
 
-SilcBuffer silc_auth_payload_encode(SilcAuthMethod method,
-				    unsigned char *random_data,
-				    unsigned short random_len,
-				    unsigned char *auth_data,
-				    unsigned short auth_len)
+SilcBuffer silc_auth_payload_encode(SilcStack stack,
+				    SilcAuthMethod method,
+				    const unsigned char *random_data,
+				    SilcUInt16 random_len,
+				    const unsigned char *auth_data,
+				    SilcUInt16 auth_len)
 {
   SilcBuffer buffer;
-  unsigned int len;
+  SilcUInt32 len;
+  unsigned char *autf8 = NULL;
+  SilcUInt32 autf8_len;
 
   SILC_LOG_DEBUG(("Encoding Authentication Payload"));
 
-  len = 4 + 4 + random_len + auth_len;
-  buffer = silc_buffer_alloc(len);
-  silc_buffer_pull_tail(buffer, SILC_BUFFER_END(buffer));
-  silc_buffer_format(buffer,
-		     SILC_STR_UI_SHORT(len),
-		     SILC_STR_UI_SHORT(method),
-		     SILC_STR_UI_SHORT(random_len),
-		     SILC_STR_UI_XNSTRING(random_data, random_len),
-		     SILC_STR_UI_SHORT(auth_len),
-		     SILC_STR_UI_XNSTRING(auth_data, auth_len),
-		     SILC_STR_END);
+  /* Passphrase MUST be UTF-8 encoded, encode if it is not */
+  if (method == SILC_AUTH_PASSWORD && !silc_utf8_valid(auth_data, auth_len)) {
+    autf8_len = silc_utf8_encoded_len(auth_data, auth_len, 0);
+    if (!autf8_len)
+      return NULL;
+    autf8 = silc_scalloc(stack, autf8_len, sizeof(*autf8));
+    auth_len = silc_utf8_encode(auth_data, auth_len, 0, autf8, autf8_len);
+    auth_data = (const unsigned char *)autf8;
+  }
+
+  len = 2 + 2 + 2 + random_len + 2 + auth_len;
+  buffer = silc_buffer_salloc_size(stack, len);
+  if (!buffer) {
+    silc_sfree(stack, autf8);
+    return NULL;
+  }
+
+  silc_buffer_sformat(stack, buffer,
+		      SILC_STR_UI_SHORT(len),
+		      SILC_STR_UI_SHORT(method),
+		      SILC_STR_UI_SHORT(random_len),
+		      SILC_STR_UI_XNSTRING(random_data, random_len),
+		      SILC_STR_UI_SHORT(auth_len),
+		      SILC_STR_UI_XNSTRING(auth_data, auth_len),
+		      SILC_STR_END);
 
+  silc_sfree(stack, autf8);
   return buffer;
 }
 
@@ -110,18 +155,51 @@ SilcBuffer silc_auth_payload_encode(SilcAuthMethod method,
 void silc_auth_payload_free(SilcAuthPayload payload)
 {
   if (payload) {
+    SilcStack stack = payload->stack;
+
     if (payload->random_data) {
       memset(payload->random_data, 0, payload->random_len);
-      silc_free(payload->random_data);
+      silc_sfree(stack, payload->random_data);
     }
     if (payload->auth_data) {
       memset(payload->auth_data, 0, payload->auth_len);
-      silc_free(payload->auth_data);
+      silc_sfree(stack, payload->auth_data);
     }
-    silc_free(payload);
+
+    silc_sfree(stack, payload);
+    silc_stack_free(stack);
   }
 }
 
+/* Get authentication method */
+
+SilcAuthMethod silc_auth_get_method(SilcAuthPayload payload)
+{
+  return payload->auth_method;
+}
+
+/* Get the public data from the auth payload. */
+
+unsigned char *silc_auth_get_public_data(SilcAuthPayload payload,
+					 SilcUInt32 *pubdata_len)
+{
+  if (pubdata_len)
+    *pubdata_len = (SilcUInt32)payload->random_len;
+
+  return payload->random_data;
+}
+
+/* Get the authentication data. If this is passphrase it is UTF-8 encoded. */
+
+unsigned char *silc_auth_get_data(SilcAuthPayload payload,
+				  SilcUInt32 *auth_len)
+{
+  if (auth_len)
+    *auth_len = (SilcUInt32)payload->auth_len;
+
+  return payload->auth_data;
+}
+
 /******************************************************************************
 
                            Authentication Routines
@@ -132,155 +210,430 @@ void silc_auth_payload_free(SilcAuthPayload payload)
    dictates. */
 
 static unsigned char *
-silc_auth_public_key_encode_data(SilcPKCS pkcs, unsigned char *random,
-				 unsigned int random_len, void *id,
-				 SilcIdType type, unsigned int *ret_len)
+silc_auth_public_key_encode_data(SilcStack stack,
+				 SilcPublicKey public_key,
+				 const unsigned char *randomdata,
+				 SilcUInt32 random_len, const void *id,
+				 SilcIdType type, SilcUInt32 *ret_len)
 {
   SilcBuffer buf;
-  unsigned char *pk, *id_data, *ret;
-  unsigned int pk_len, id_len;
+  unsigned char *pk, id_data[32], *ret;
+  SilcUInt32 pk_len, id_len;
 
-  pk = silc_pkcs_get_public_key(pkcs, &pk_len);
+  pk = silc_pkcs_public_key_encode(stack, public_key, &pk_len);
   if (!pk)
     return NULL;
 
-  id_data = silc_id_id2str(id, type);
-  if (!id_data) {
+  if (!silc_id_id2str(id, type, id_data, sizeof(id_data), &id_len)) {
     silc_free(pk);
     return NULL;
   }
-  id_len = silc_id_get_len(type);
-
-  buf = silc_buffer_alloc(random_len + pk_len);
-  silc_buffer_pull_tail(buf, SILC_BUFFER_END(buf));
-  silc_buffer_format(buf,
-		     SILC_STR_UI_XNSTRING(random, random_len),
-		     SILC_STR_UI_XNSTRING(id_data, id_len),
-		     SILC_STR_UI_XNSTRING(pk, pk_len),
-		     SILC_STR_END);
-  
-  ret = silc_calloc(buf->len, sizeof(*ret));
-  memcpy(ret, buf->data, buf->len);
 
-  if (ret_len)
-    *ret_len = buf->len;
+  buf = silc_buffer_salloc_size(stack, random_len + id_len + pk_len);
+  if (!buf) {
+    silc_free(pk);
+    return NULL;
+  }
+  silc_buffer_sformat(stack, buf,
+		      SILC_STR_UI_XNSTRING(randomdata, random_len),
+		      SILC_STR_UI_XNSTRING(id_data, id_len),
+		      SILC_STR_UI_XNSTRING(pk, pk_len),
+		      SILC_STR_END);
+
+  ret = silc_buffer_steal(buf, ret_len);
 
-  silc_buffer_free(buf);
-  silc_free(id_data);
-  silc_free(pk);
+  silc_buffer_sfree(stack, buf);
+  silc_sfree(stack, pk);
 
   return ret;
 }
 
+typedef struct {
+  SilcStack stack;
+  unsigned char *pubdata;
+  SilcUInt32 pubdata_len;
+  SilcAuthGenerated generated;
+  void *context;
+} *SilcAuthGenerateContext;
+
+/* Signature callback */
+
+static void
+silc_auth_public_key_auth_generate_cb(SilcBool success,
+				      const unsigned char *signature,
+				      SilcUInt32 signature_len,
+				      void *context)
+{
+  SilcAuthGenerateContext a = context;
+  SilcStack stack = a->stack;
+  SilcBuffer buf;
+
+  if (!success) {
+    a->generated(NULL, context);
+    silc_sfree(stack, a->pubdata);
+    silc_sfree(stack, a);
+    silc_stack_free(stack);
+    return;
+  }
+
+  /* Encode Authentication Payload */
+  buf = silc_auth_payload_encode(stack, SILC_AUTH_PUBLIC_KEY, a->pubdata,
+				 a->pubdata_len, signature, signature_len);
+
+  a->generated(buf, context);
+
+  silc_buffer_sfree(stack, buf);
+  silc_sfree(stack, a->pubdata);
+  silc_sfree(stack, a);
+  silc_stack_free(stack);
+}
+
+/* Generates Authentication Payload with authentication data. This is used
+   to do public key based authentication. This generates the random data
+   and the actual authentication data. Returns NULL on error. */
+
+SilcAsyncOperation
+silc_auth_public_key_auth_generate(SilcPublicKey public_key,
+				   SilcPrivateKey private_key,
+				   SilcRng rng, SilcHash hash,
+				   const void *id, SilcIdType type,
+				   SilcAuthGenerated generated,
+				   void *context)
+{
+  unsigned char randomdata[256];
+
+  /* Get random data */
+  if (rng)
+    silc_rng_get_rn_data(rng, sizeof(randomdata), randomdata,
+			 sizeof(randomdata));
+  else
+    silc_rng_global_get_rn_data(rng, sizeof(randomdata), randomdata,
+				sizeof(randomdata));
+
+  return silc_auth_public_key_auth_generate_wpub(public_key, private_key,
+						 randomdata, sizeof(randomdata),
+						 hash, rng, id, type, generated,
+						 context);
+}
+
 /* Generates Authentication Payload with authentication data. This is used
    to do public key based authentication. This generates the random data
    and the actual authentication data. Returns NULL on error. */
 
-SilcBuffer silc_auth_public_key_auth_generate(SilcPKCS pkcs,
-					      SilcHash hash,
-					      void *id, SilcIdType type)
+SilcAsyncOperation
+silc_auth_public_key_auth_generate_wpub(SilcPublicKey public_key,
+					SilcPrivateKey private_key,
+					const unsigned char *pubdata,
+					SilcUInt32 pubdata_len,
+					SilcHash hash,
+					SilcRng rng,
+					const void *id, SilcIdType type,
+					SilcAuthGenerated generated,
+					void *context)
 {
-  unsigned char *random;
-  unsigned char auth_data[32];
-  unsigned int auth_len;
+  SilcAuthGenerateContext a;
+  SilcAsyncOperation op;
   unsigned char *tmp;
-  unsigned int tmp_len;
-  SilcBuffer buf;
+  SilcUInt32 tmp_len;
+  SilcStack stack;
 
   SILC_LOG_DEBUG(("Generating Authentication Payload with data"));
 
-  /* Get 256 bytes of random data */
-  random = silc_rng_global_get_rn_data(256);
-  if (!random)
+  /* We use the Crypto Toolkit's stack since we're doing crypto */
+  stack = silc_stack_alloc(2048, silc_crypto_stack());
+
+  a = silc_scalloc(stack, 1, sizeof(*a));
+  if (!a) {
+    generated(NULL, context);
     return NULL;
-  
+  }
+  a->stack = stack;
+
   /* Encode the auth data */
-  tmp = silc_auth_public_key_encode_data(pkcs, random, 256, id, type, 
-					 &tmp_len);
-  if (!tmp)
+  tmp = silc_auth_public_key_encode_data(stack, public_key, pubdata,
+					 pubdata_len, id, type, &tmp_len);
+  if (!tmp) {
+    silc_sfree(stack, a);
+    silc_stack_free(stack);
+    generated(NULL, context);
     return NULL;
+  }
 
-  /* Compute the hash and the signature. */
-  if (!silc_pkcs_sign_with_hash(pkcs, hash, tmp, tmp_len, auth_data,
-				&auth_len)) {
-    memset(random, 0, 256);
+  a->pubdata = silc_smemdup(stack, pubdata, pubdata_len);
+  if (!a->pubdata) {
     memset(tmp, 0, tmp_len);
-    silc_free(tmp);
-    silc_free(random);
+    silc_sfree(stack, tmp);
+    silc_sfree(stack, a);
+    silc_stack_free(stack);
+    generated(NULL, context);
     return NULL;
   }
 
-  /* Encode Authentication Payload */
-  buf = silc_auth_payload_encode(SILC_AUTH_PUBLIC_KEY, random, 256,
-				 auth_data, auth_len);
+  /* Compute the hash and the signature. */
+  op = silc_pkcs_sign_async(private_key, tmp, tmp_len, TRUE, hash, rng,
+			    silc_auth_public_key_auth_generate_cb, a);
 
   memset(tmp, 0, tmp_len);
-  memset(auth_data, 0, sizeof(auth_data));
-  memset(random, 0, 256);
-  silc_free(tmp);
-  silc_free(random);
+  silc_sfree(stack, tmp);
 
-  return buf;
+  return op;
 }
 
-/* Verifies the authentication data. Returns TRUE if authentication was
-   successfull. */
+/* Verifies the authentication data. */
 
-int silc_auth_public_key_auth_verify(SilcAuthPayload payload,
-				     SilcPKCS pkcs, SilcHash hash,
-				     void *id, SilcIdType type)
+SilcAsyncOperation
+silc_auth_public_key_auth_verify(SilcAuthPayload payload,
+				 SilcPublicKey public_key,
+				 SilcHash hash,
+				 const void *id,
+				 SilcIdType type,
+				 SilcAuthResultCb result,
+				 void *context)
 {
+  SilcAsyncOperation op;
   unsigned char *tmp;
-  unsigned int tmp_len;
+  SilcUInt32 tmp_len;
 
   SILC_LOG_DEBUG(("Verifying authentication data"));
 
   /* Encode auth data */
-  tmp = silc_auth_public_key_encode_data(pkcs, payload->random_data, 
-					 payload->random_len, 
+  tmp = silc_auth_public_key_encode_data(payload->stack,
+					 public_key, payload->random_data,
+					 payload->random_len,
 					 id, type, &tmp_len);
   if (!tmp) {
     SILC_LOG_DEBUG(("Authentication failed"));
-    return FALSE;
+    result(FALSE, context);
+    return NULL;
   }
 
   /* Verify the authentication data */
-  if (!silc_pkcs_verify_with_hash(pkcs, hash, payload->auth_data,
-				  payload->auth_len, tmp, tmp_len)) {
-
-    memset(tmp, 0, tmp_len);
-    silc_free(tmp);
-    SILC_LOG_DEBUG(("Authentication failed"));
-    return FALSE;
-  }
+  op = silc_pkcs_verify_async(public_key, payload->auth_data,
+			      payload->auth_len, tmp, tmp_len, TRUE, hash,
+			      result, context);
 
   memset(tmp, 0, tmp_len);
-  silc_free(tmp);
+  silc_sfree(payload->stack, tmp);
 
-  SILC_LOG_DEBUG(("Authentication successfull"));
-
-  return TRUE;
+  return op;
 }
 
 /* Same as above but the payload is not parsed yet. This will parse it. */
 
-int silc_auth_public_key_auth_verify_data(SilcBuffer payload,
-					  SilcPKCS pkcs, SilcHash hash,
-					  void *id, SilcIdType type)
+SilcAsyncOperation
+silc_auth_public_key_auth_verify_data(const unsigned char *payload,
+				      SilcUInt32 payload_len,
+				      SilcPublicKey public_key,
+				      SilcHash hash,
+				      const void *id,
+				      SilcIdType type,
+				      SilcAuthResultCb result,
+				      void *context)
 {
+  SilcAsyncOperation op;
   SilcAuthPayload auth_payload;
-  int ret;
 
-  auth_payload = silc_auth_payload_parse(payload);
+  auth_payload = silc_auth_payload_parse(silc_crypto_stack(), payload,
+					 payload_len);
   if (!auth_payload) {
     SILC_LOG_DEBUG(("Authentication failed"));
-    return FALSE;
+    result(FALSE, context);
+    return NULL;
   }
 
-  ret = silc_auth_public_key_auth_verify(auth_payload, pkcs, hash, 
-					 id, type);
+  op = silc_auth_public_key_auth_verify(auth_payload, public_key, hash,
+					id, type, result, context);
 
   silc_auth_payload_free(auth_payload);
 
-  return ret;
+  return op;
+}
+
+/* Verifies the authentication data directly from the Authentication
+   Payload. Supports all authentication methods. If the authentication
+   method is passphrase based then the `auth_data' and `auth_data_len'
+   are the passphrase and its length. If the method is public key
+   authentication then the `auth_data' is the SilcPublicKey and the
+   `auth_data_len' is ignored. */
+
+SilcAsyncOperation
+silc_auth_verify(SilcAuthPayload payload, SilcAuthMethod auth_method,
+		 const void *auth_data, SilcUInt32 auth_data_len,
+		 SilcHash hash, const void *id, SilcIdType type,
+		 SilcAuthResultCb result, void *context)
+{
+  SILC_LOG_DEBUG(("Verifying authentication"));
+
+  if (!payload || auth_method != payload->auth_method) {
+    result(FALSE, context);
+    return NULL;
+  }
+
+  switch (payload->auth_method) {
+  case SILC_AUTH_NONE:
+    /* No authentication */
+    SILC_LOG_DEBUG(("No authentication required"));
+    result(TRUE, context);
+    return NULL;
+
+  case SILC_AUTH_PASSWORD:
+    /* Passphrase based authentication. The `pkcs', `hash', `id' and `type'
+       arguments are not needed. */
+
+    /* Sanity checks */
+    if ((payload->auth_len == 0) || !auth_data ||
+	payload->auth_len != auth_data_len)
+      break;
+
+    if (!memcmp(payload->auth_data, auth_data, auth_data_len)) {
+      SILC_LOG_DEBUG(("Passphrase Authentication successful"));
+      result(TRUE, context);
+      return NULL;
+    }
+    break;
+
+  case SILC_AUTH_PUBLIC_KEY:
+    /* Public key based authentication */
+    return silc_auth_public_key_auth_verify(payload, (SilcPublicKey)auth_data,
+					    hash, id, type, result, context);
+    break;
+
+  default:
+    break;
+  }
+
+  SILC_LOG_DEBUG(("Authentication failed"));
+  result(FALSE, context);
+
+  return NULL;
+}
+
+/* Same as above but parses the authentication payload before verify. */
+
+SilcAsyncOperation
+silc_auth_verify_data(const unsigned char *payload,
+		      SilcUInt32 payload_len,
+		      SilcAuthMethod auth_method,
+		      const void *auth_data,
+		      SilcUInt32 auth_data_len, SilcHash hash,
+		      const void *id, SilcIdType type,
+		      SilcAuthResultCb result, void *context)
+{
+  SilcAsyncOperation op;
+  SilcAuthPayload auth_payload;
+
+  auth_payload = silc_auth_payload_parse(silc_crypto_stack(), payload,
+					 payload_len);
+  if (!auth_payload || (auth_payload->auth_len == 0)) {
+    result(FALSE, context);
+    return NULL;
+  }
+
+  op = silc_auth_verify(auth_payload, auth_method, auth_data, auth_data_len,
+			 hash, id, type, result, context);
+
+  silc_auth_payload_free(auth_payload);
+
+  return op;
+}
+
+/******************************************************************************
+
+                            Key Agreement Payload
+
+******************************************************************************/
+
+/* The Key Agreement protocol structure */
+struct SilcKeyAgreementPayloadStruct {
+  SilcUInt16 hostname_len;
+  unsigned char *hostname;
+  SilcUInt16 protocol;
+  SilcUInt16 port;
+};
+
+/* Parses and returns an allocated Key Agreement payload. */
+
+SilcKeyAgreementPayload
+silc_key_agreement_payload_parse(const unsigned char *payload,
+				 SilcUInt32 payload_len)
+{
+  SilcBufferStruct buffer;
+  SilcKeyAgreementPayload newp;
+  int ret;
+
+  SILC_LOG_DEBUG(("Parsing Key Agreement Payload"));
+
+  newp = silc_calloc(1, sizeof(*newp));
+  if (!newp)
+    return NULL;
+
+  /* Parse the payload */
+  silc_buffer_set(&buffer, (unsigned char *)payload, payload_len);
+  ret = silc_buffer_unformat(&buffer,
+			     SILC_STR_UI16_NSTRING_ALLOC(&newp->hostname,
+							 &newp->hostname_len),
+			     SILC_STR_UI_SHORT(&newp->protocol),
+			     SILC_STR_UI_SHORT(&newp->port),
+			     SILC_STR_END);
+  if (ret == -1 || newp->hostname_len > silc_buffer_len(&buffer) - 6) {
+    silc_free(newp);
+    return NULL;
+  }
+
+  return newp;
+}
+
+/* Encodes the Key Agreement protocol and returns the encoded buffer */
+
+SilcBuffer silc_key_agreement_payload_encode(const char *hostname,
+					     SilcUInt16 protocol,
+					     SilcUInt16 port)
+{
+  SilcBuffer buffer;
+  SilcUInt32 len = hostname ? strlen(hostname) : 0;
+
+  SILC_LOG_DEBUG(("Encoding Key Agreement Payload"));
+
+  buffer = silc_buffer_alloc_size(2 + len + 4);
+  if (!buffer)
+    return NULL;
+  silc_buffer_format(buffer,
+		     SILC_STR_UI_SHORT(len),
+		     SILC_STR_UI_XNSTRING(hostname, len),
+		     SILC_STR_UI_SHORT(protocol),
+		     SILC_STR_UI_SHORT(port),
+		     SILC_STR_END);
+
+  return buffer;
+}
+
+/* Frees the Key Agreement protocol */
+
+void silc_key_agreement_payload_free(SilcKeyAgreementPayload payload)
+{
+  if (payload) {
+    silc_free(payload->hostname);
+    silc_free(payload);
+  }
+}
+
+/* Returns the hostname in the payload */
+
+char *silc_key_agreement_get_hostname(SilcKeyAgreementPayload payload)
+{
+  return payload->hostname;
+}
+
+/* Returns the protocol in the payload */
+
+SilcUInt16 silc_key_agreement_get_protocol(SilcKeyAgreementPayload payload)
+{
+  return payload->protocol;
+}
+
+/* Returns the port in the payload */
+
+SilcUInt16 silc_key_agreement_get_port(SilcKeyAgreementPayload payload)
+{
+  return payload->port;
 }