Rename diffie_hellman_t to key_exchange_t and change the interface etc.

This makes it more generic so we can use it for QSKE methods.

src/libcharon/sa/authenticator.c

@@ -121,7 +121,7 @@ authenticator_t *authenticator_create_verifier(
  * Described in header.
  */
 authenticator_t *authenticator_create_v1(ike_sa_t *ike_sa, bool initiator,
-								auth_method_t auth_method, diffie_hellman_t *dh,
+								auth_method_t auth_method, key_exchange_t *dh,
 								chunk_t dh_value, chunk_t sa_payload,
 								chunk_t id_payload)
 {

src/libcharon/sa/authenticator.h

@@ -238,7 +238,7 @@ authenticator_t *authenticator_create_verifier(
  * @return					authenticator, NULL if not supported
  */
 authenticator_t *authenticator_create_v1(ike_sa_t *ike_sa, bool initiator,
-								auth_method_t auth_method, diffie_hellman_t *dh,
+								auth_method_t auth_method, key_exchange_t *dh,
 								chunk_t dh_value, chunk_t sa_payload,
 								chunk_t id_payload);
 

src/libcharon/sa/ikev1/authenticators/hybrid_authenticator.c

@@ -78,7 +78,7 @@ METHOD(authenticator_t, destroy, void,
  * Described in header.
  */
 hybrid_authenticator_t *hybrid_authenticator_create(ike_sa_t *ike_sa,
-										bool initiator, diffie_hellman_t *dh,
+										bool initiator, key_exchange_t *dh,
 										chunk_t dh_value, chunk_t sa_payload,
 										chunk_t id_payload)
 {

src/libcharon/sa/ikev1/authenticators/hybrid_authenticator.h

@@ -50,7 +50,7 @@ struct hybrid_authenticator_t {
  * @return					hybrid authenticator
  */
 hybrid_authenticator_t *hybrid_authenticator_create(ike_sa_t *ike_sa,
-										bool initiator, diffie_hellman_t *dh,
+										bool initiator, key_exchange_t *dh,
 										chunk_t dh_value, chunk_t sa_payload,
 										chunk_t id_payload);
 

src/libcharon/sa/ikev1/authenticators/psk_v1_authenticator.c

@@ -45,7 +45,7 @@ struct private_psk_v1_authenticator_t {
 	/**
 	 * DH key exchange
 	 */
-	diffie_hellman_t *dh;
+	key_exchange_t *dh;
 
 	/**
 	 * Others DH public value
@@ -75,7 +75,7 @@ METHOD(authenticator_t, build, status_t,
 	keymat_v1_t *keymat;
 	chunk_t hash, dh;
 
-	if (!this->dh->get_my_public_value(this->dh, &dh))
+	if (!this->dh->get_public_key(this->dh, &dh))
 	{
 		return FAILED;
 	}
@@ -112,7 +112,7 @@ METHOD(authenticator_t, process, status_t,
 		return FAILED;
 	}
 
-	if (!this->dh->get_my_public_value(this->dh, &dh))
+	if (!this->dh->get_public_key(this->dh, &dh))
 	{
 		return FAILED;
 	}
@@ -151,7 +151,7 @@ METHOD(authenticator_t, destroy, void,
  * Described in header.
  */
 psk_v1_authenticator_t *psk_v1_authenticator_create(ike_sa_t *ike_sa,
-										bool initiator, diffie_hellman_t *dh,
+										bool initiator, key_exchange_t *dh,
 										chunk_t dh_value, chunk_t sa_payload,
 										chunk_t id_payload, bool hybrid)
 {

src/libcharon/sa/ikev1/authenticators/psk_v1_authenticator.h

@@ -51,7 +51,7 @@ struct psk_v1_authenticator_t {
  * @return					PSK authenticator
  */
 psk_v1_authenticator_t *psk_v1_authenticator_create(ike_sa_t *ike_sa,
-										bool initiator, diffie_hellman_t *dh,
+										bool initiator, key_exchange_t *dh,
 										chunk_t dh_value, chunk_t sa_payload,
 										chunk_t id_payload, bool hybrid);
 

src/libcharon/sa/ikev1/authenticators/pubkey_v1_authenticator.c

@@ -46,7 +46,7 @@ struct private_pubkey_v1_authenticator_t {
 	/**
 	 * DH key exchange
 	 */
-	diffie_hellman_t *dh;
+	key_exchange_t *dh;
 
 	/**
 	 * Others DH public value
@@ -96,7 +96,7 @@ METHOD(authenticator_t, build, status_t,
 		return NOT_FOUND;
 	}
 
-	if (!this->dh->get_my_public_value(this->dh, &dh))
+	if (!this->dh->get_public_key(this->dh, &dh))
 	{
 		private->destroy(private);
 		return FAILED;
@@ -181,7 +181,7 @@ METHOD(authenticator_t, process, status_t,
 	}
 
 	id = this->ike_sa->get_other_id(this->ike_sa);
-	if (!this->dh->get_my_public_value(this->dh, &dh))
+	if (!this->dh->get_public_key(this->dh, &dh))
 	{
 		return FAILED;
 	}
@@ -238,7 +238,7 @@ METHOD(authenticator_t, destroy, void,
  * Described in header.
  */
 pubkey_v1_authenticator_t *pubkey_v1_authenticator_create(ike_sa_t *ike_sa,
-										bool initiator, diffie_hellman_t *dh,
+										bool initiator, key_exchange_t *dh,
 										chunk_t dh_value, chunk_t sa_payload,
 										chunk_t id_payload, key_type_t type)
 {

src/libcharon/sa/ikev1/authenticators/pubkey_v1_authenticator.h

@@ -51,7 +51,7 @@ struct pubkey_v1_authenticator_t {
  * @return					pubkey authenticator
  */
 pubkey_v1_authenticator_t *pubkey_v1_authenticator_create(ike_sa_t *ike_sa,
-										bool initiator, diffie_hellman_t *dh,
+										bool initiator, key_exchange_t *dh,
 										chunk_t dh_value, chunk_t sa_payload,
 										chunk_t id_payload, key_type_t type);
 

src/libcharon/sa/ikev1/keymat_v1.c

@@ -314,7 +314,7 @@ static void adjust_keylen(uint16_t alg, chunk_t *key)
 }
 
 METHOD(keymat_v1_t, derive_ike_keys, bool,
-	private_keymat_v1_t *this, proposal_t *proposal, diffie_hellman_t *dh,
+	private_keymat_v1_t *this, proposal_t *proposal, key_exchange_t *dh,
 	chunk_t dh_other, chunk_t nonce_i, chunk_t nonce_r, ike_sa_id_t *id,
 	auth_method_t auth, shared_key_t *shared_key)
 {
@@ -494,7 +494,7 @@ METHOD(keymat_v1_t, derive_ike_keys, bool,
 		return FALSE;
 	}
 
-	if (!dh->get_my_public_value(dh, &dh_me))
+	if (!dh->get_public_key(dh, &dh_me))
 	{
 		return FALSE;
 	}
@@ -539,7 +539,7 @@ static bool derive_child_keymat(private_keymat_v1_t *this, chunk_t seed,
 }
 
 METHOD(keymat_v1_t, derive_child_keys, bool,
-	private_keymat_v1_t *this, proposal_t *proposal, diffie_hellman_t *dh,
+	private_keymat_v1_t *this, proposal_t *proposal, key_exchange_t *dh,
 	uint32_t spi_i, uint32_t spi_r, chunk_t nonce_i, chunk_t nonce_r,
 	chunk_t *encr_i, chunk_t *integ_i, chunk_t *encr_r, chunk_t *integ_r)
 {
@@ -914,10 +914,10 @@ METHOD(keymat_t, get_version, ike_version_t,
 	return IKEV1;
 }
 
-METHOD(keymat_t, create_dh, diffie_hellman_t*,
-	private_keymat_v1_t *this, diffie_hellman_group_t group)
+METHOD(keymat_t, create_ke, key_exchange_t*,
+	private_keymat_v1_t *this, key_exchange_method_t method)
 {
-	return lib->crypto->create_dh(lib->crypto, group);
+	return lib->crypto->create_ke(lib->crypto, method);
 }
 
 METHOD(keymat_t, create_nonce_gen, nonce_gen_t*,
@@ -956,7 +956,7 @@ keymat_v1_t *keymat_v1_create(bool initiator)
 		.public = {
 			.keymat = {
 				.get_version = _get_version,
-				.create_dh = _create_dh,
+				.create_ke = _create_ke,
 				.create_nonce_gen = _create_nonce_gen,
 				.get_aead = _get_aead,
 				.destroy = _destroy,

src/libcharon/sa/ikev1/keymat_v1.h

@@ -44,7 +44,7 @@ struct keymat_v1_t {
 	 * crypters and authentication functions.
 	 *
 	 * @param proposal		selected algorithms
-	 * @param dh			diffie hellman key allocated by create_dh()
+	 * @param dh			diffie hellman key allocated by create_ke()
 	 * @param dh_other		public DH value from other peer
 	 * @param nonce_i		initiators nonce value
 	 * @param nonce_r		responders nonce value
@@ -54,7 +54,7 @@ struct keymat_v1_t {
 	 * @return				TRUE on success
 	 */
 	bool (*derive_ike_keys)(keymat_v1_t *this, proposal_t *proposal,
-							diffie_hellman_t *dh, chunk_t dh_other,
+							key_exchange_t *dh, chunk_t dh_other,
 							chunk_t nonce_i, chunk_t nonce_r, ike_sa_id_t *id,
 							auth_method_t auth, shared_key_t *shared_key);
 
@@ -73,7 +73,7 @@ struct keymat_v1_t {
 	 * @param integ_r		allocated responders integrity key
 	 */
 	bool (*derive_child_keys)(keymat_v1_t *this, proposal_t *proposal,
-						diffie_hellman_t *dh, uint32_t spi_i, uint32_t spi_r,
+						key_exchange_t *dh, uint32_t spi_i, uint32_t spi_r,
 						chunk_t nonce_i, chunk_t nonce_r,
 						chunk_t *encr_i, chunk_t *integ_i,
 						chunk_t *encr_r, chunk_t *integ_r);

src/libcharon/sa/ikev1/phase1.c

@@ -63,7 +63,7 @@ struct private_phase1_t {
 	/**
 	 * DH exchange
 	 */
-	diffie_hellman_t *dh;
+	key_exchange_t *dh;
 
 	/**
 	 * Keymat derivation (from SA)
@@ -210,9 +210,9 @@ METHOD(phase1_t, create_hasher, bool,
 }
 
 METHOD(phase1_t, create_dh, bool,
-	private_phase1_t *this, diffie_hellman_group_t group)
+	private_phase1_t *this, key_exchange_method_t group)
 {
-	this->dh = this->keymat->keymat.create_dh(&this->keymat->keymat, group);
+	this->dh = this->keymat->keymat.create_ke(&this->keymat->keymat, group);
 	return this->dh != NULL;
 }
 
@@ -705,8 +705,8 @@ METHOD(phase1_t, add_nonce_ke, bool,
 	nonce_gen_t *nonceg;
 	chunk_t nonce;
 
-	ke_payload = ke_payload_create_from_diffie_hellman(PLV1_KEY_EXCHANGE,
-													   this->dh);
+	ke_payload = ke_payload_create_from_key_exchange(PLV1_KEY_EXCHANGE,
+													 this->dh);
 	if (!ke_payload)
 	{
 		DBG1(DBG_IKE, "creating KE payload failed");
@@ -756,7 +756,7 @@ METHOD(phase1_t, get_nonce_ke, bool,
 		return FALSE;
 	}
 	this->dh_value = chunk_clone(ke_payload->get_key_exchange_data(ke_payload));
-	if (!this->dh->set_other_public_value(this->dh, this->dh_value))
+	if (!this->dh->set_public_key(this->dh, this->dh_value))
 	{
 		DBG1(DBG_IKE, "unable to apply received KE value");
 		return FALSE;

src/libcharon/sa/ikev1/phase1.h

@@ -25,7 +25,7 @@
 typedef struct phase1_t phase1_t;
 
 #include <sa/ike_sa.h>
-#include <crypto/diffie_hellman.h>
+#include <crypto/key_exchange.h>
 
 /**
  * Common phase 1 helper for main and aggressive mode.
@@ -45,7 +45,7 @@ struct phase1_t {
 	 * @param group			negotiated DH group
 	 * @return				TRUE if group supported
 	 */
-	bool (*create_dh)(phase1_t *this, diffie_hellman_group_t group);
+	bool (*create_dh)(phase1_t *this, key_exchange_method_t group);
 
 	/**
 	 * Derive key material.

src/libcharon/sa/ikev1/tasks/aggressive_mode.c

@@ -252,7 +252,7 @@ METHOD(task_t, build_i, status_t,
 
 			message->add_payload(message, &sa_payload->payload_interface);
 
-			group = this->ike_cfg->get_dh_group(this->ike_cfg);
+			group = this->ike_cfg->get_ke_method(this->ike_cfg);
 			if (group == MODP_NONE)
 			{
 				DBG1(DBG_IKE, "DH group selection failed");
@@ -261,7 +261,7 @@ METHOD(task_t, build_i, status_t,
 			if (!this->ph1->create_dh(this->ph1, group))
 			{
 				DBG1(DBG_IKE, "DH group %N not supported",
-					 diffie_hellman_group_names, group);
+					 key_exchange_method_names, group);
 				return FAILED;
 			}
 			if (!this->ph1->add_nonce_ke(this->ph1, message))
@@ -438,7 +438,7 @@ METHOD(task_t, process_r, status_t,
 			}
 
 			if (!this->proposal->get_algorithm(this->proposal,
-										DIFFIE_HELLMAN_GROUP, &group, NULL))
+										KEY_EXCHANGE_METHOD, &group, NULL))
 			{
 				DBG1(DBG_IKE, "DH group selection failed");
 				return send_notify(this, INVALID_KEY_INFORMATION);

src/libcharon/sa/ikev1/tasks/main_mode.c

@@ -314,7 +314,7 @@ METHOD(task_t, build_i, status_t,
 				return send_notify(this, NO_PROPOSAL_CHOSEN);
 			}
 			if (!this->proposal->get_algorithm(this->proposal,
-										DIFFIE_HELLMAN_GROUP, &group, NULL))
+										KEY_EXCHANGE_METHOD, &group, NULL))
 			{
 				DBG1(DBG_IKE, "DH group selection failed");
 				return send_notify(this, NO_PROPOSAL_CHOSEN);
@@ -428,7 +428,7 @@ METHOD(task_t, process_r, status_t,
 				return send_notify(this, INVALID_KEY_INFORMATION);
 			}
 			if (!this->proposal->get_algorithm(this->proposal,
-										DIFFIE_HELLMAN_GROUP, &group, NULL))
+										KEY_EXCHANGE_METHOD, &group, NULL))
 			{
 				DBG1(DBG_IKE, "DH group selection failed");
 				return send_notify(this, INVALID_KEY_INFORMATION);

src/libcharon/sa/ikev1/tasks/quick_mode.c

@@ -137,7 +137,7 @@ struct private_quick_mode_t {
 	/**
 	 * DH exchange, when PFS is in use
 	 */
-	diffie_hellman_t *dh;
+	key_exchange_t *dh;
 
 	/**
 	 * Negotiated lifetime of new SA
@@ -486,8 +486,8 @@ static bool add_ke(private_quick_mode_t *this, message_t *message)
 {
 	ke_payload_t *ke_payload;
 
-	ke_payload = ke_payload_create_from_diffie_hellman(PLV1_KEY_EXCHANGE,
-													   this->dh);
+	ke_payload = ke_payload_create_from_key_exchange(PLV1_KEY_EXCHANGE,
+													 this->dh);
 	if (!ke_payload)
 	{
 		DBG1(DBG_IKE, "creating KE payload failed");
@@ -510,7 +510,7 @@ static bool get_ke(private_quick_mode_t *this, message_t *message)
 		DBG1(DBG_IKE, "KE payload missing");
 		return FALSE;
 	}
-	if (!this->dh->set_other_public_value(this->dh,
+	if (!this->dh->set_public_key(this->dh,
 								ke_payload->get_key_exchange_data(ke_payload)))
 	{
 		DBG1(DBG_IKE, "unable to apply received KE value");
@@ -785,7 +785,7 @@ static status_t send_notify(private_quick_mode_t *this, notify_type_t type)
  * DH group, unless it is set to MODP_NONE.
  */
 static linked_list_t *get_proposals(private_quick_mode_t *this,
-									diffie_hellman_group_t group)
+									key_exchange_method_t group)
 {
 	linked_list_t *list;
 	proposal_t *proposal;
@@ -797,13 +797,13 @@ static linked_list_t *get_proposals(private_quick_mode_t *this,
 	{
 		if (group != MODP_NONE)
 		{
-			if (!proposal->has_dh_group(proposal, group))
+			if (!proposal->has_ke_method(proposal, group))
 			{
 				list->remove_at(list, enumerator);
 				proposal->destroy(proposal);
 				continue;
 			}
-			proposal->promote_dh_group(proposal, group);
+			proposal->promote_ke_method(proposal, group);
 		}
 		proposal->set_spi(proposal, this->spi_i);
 	}
@@ -822,7 +822,7 @@ METHOD(task_t, build_i, status_t,
 			sa_payload_t *sa_payload;
 			linked_list_t *list, *tsi, *tsr;
 			proposal_t *proposal;
-			diffie_hellman_group_t group;
+			key_exchange_method_t group;
 			encap_t encap;
 
 			this->mode = this->config->get_mode(this->config);
@@ -866,14 +866,14 @@ METHOD(task_t, build_i, status_t,
 				return FAILED;
 			}
 
-			group = this->config->get_dh_group(this->config);
+			group = this->config->get_ke_method(this->config);
 			if (group != MODP_NONE)
 			{
 				proposal_t *proposal;
 				uint16_t preferred_group;
 
 				proposal = this->ike_sa->get_proposal(this->ike_sa);
-				proposal->get_algorithm(proposal, DIFFIE_HELLMAN_GROUP,
+				proposal->get_algorithm(proposal, KEY_EXCHANGE_METHOD,
 										&preferred_group, NULL);
 				/* try the negotiated DH group from IKE_SA */
 				list = get_proposals(this, preferred_group);
@@ -888,12 +888,12 @@ METHOD(task_t, build_i, status_t,
 					list = get_proposals(this, group);
 				}
 
-				this->dh = this->keymat->keymat.create_dh(&this->keymat->keymat,
+				this->dh = this->keymat->keymat.create_ke(&this->keymat->keymat,
 														  group);
 				if (!this->dh)
 				{
 					DBG1(DBG_IKE, "configured DH group %N not supported",
-						 diffie_hellman_group_names, group);
+						 key_exchange_method_names, group);
 					list->destroy_offset(list, offsetof(proposal_t, destroy));
 					return FAILED;
 				}
@@ -1165,14 +1165,14 @@ METHOD(task_t, process_r, status_t,
 			}
 
 			if (this->proposal->get_algorithm(this->proposal,
-										DIFFIE_HELLMAN_GROUP, &group, NULL))
+										KEY_EXCHANGE_METHOD, &group, NULL))
 			{
-				this->dh = this->keymat->keymat.create_dh(&this->keymat->keymat,
+				this->dh = this->keymat->keymat.create_ke(&this->keymat->keymat,
 														  group);
 				if (!this->dh)
 				{
 					DBG1(DBG_IKE, "negotiated DH group %N not supported",
-						 diffie_hellman_group_names, group);
+						 key_exchange_method_names, group);
 					return send_notify(this, INVALID_KEY_INFORMATION);
 				}
 				if (!get_ke(this, message))

src/libcharon/sa/ikev2/keymat_v2.c

@@ -84,10 +84,10 @@ METHOD(keymat_t, get_version, ike_version_t,
 	return IKEV2;
 }
 
-METHOD(keymat_t, create_dh, diffie_hellman_t*,
-	private_keymat_v2_t *this, diffie_hellman_group_t group)
+METHOD(keymat_t, create_ke, key_exchange_t*,
+	private_keymat_v2_t *this, key_exchange_method_t method)
 {
-	return lib->crypto->create_dh(lib->crypto, group);
+	return lib->crypto->create_ke(lib->crypto, method);
 }
 
 METHOD(keymat_t, create_nonce_gen, nonce_gen_t*,
@@ -237,7 +237,7 @@ static bool set_aead_keys(private_keymat_v2_t *this, uint16_t enc_alg,
 }
 
 METHOD(keymat_v2_t, derive_ike_keys, bool,
-	private_keymat_v2_t *this, proposal_t *proposal, diffie_hellman_t *dh,
+	private_keymat_v2_t *this, proposal_t *proposal, key_exchange_t *dh,
 	chunk_t nonce_i, chunk_t nonce_r, ike_sa_id_t *id,
 	pseudo_random_function_t rekey_function, chunk_t rekey_skd)
 {
@@ -523,7 +523,7 @@ METHOD(keymat_v2_t, derive_ike_keys_ppk, bool,
 }
 
 METHOD(keymat_v2_t, derive_child_keys, bool,
-	private_keymat_v2_t *this, proposal_t *proposal, diffie_hellman_t *dh,
+	private_keymat_v2_t *this, proposal_t *proposal, key_exchange_t *dh,
 	chunk_t nonce_i, chunk_t nonce_r, chunk_t *encr_i, chunk_t *integ_i,
 	chunk_t *encr_r, chunk_t *integ_r)
 {
@@ -796,7 +796,7 @@ keymat_v2_t *keymat_v2_create(bool initiator)
 		.public = {
 			.keymat = {
 				.get_version = _get_version,
-				.create_dh = _create_dh,
+				.create_ke = _create_ke,
 				.create_nonce_gen = _create_nonce_gen,
 				.get_aead = _get_aead,
 				.destroy = _destroy,

src/libcharon/sa/ikev2/keymat_v2.h

@@ -44,7 +44,7 @@ struct keymat_v2_t {
 	 * crypters and authentication functions.
 	 *
 	 * @param proposal	selected algorithms
-	 * @param dh		diffie hellman key allocated by create_dh()
+	 * @param dh		diffie hellman key allocated by create_ke()
 	 * @param nonce_i	initiators nonce value
 	 * @param nonce_r	responders nonce value
 	 * @param id		IKE_SA identifier
@@ -53,7 +53,7 @@ struct keymat_v2_t {
 	 * @return			TRUE on success
 	 */
 	bool (*derive_ike_keys)(keymat_v2_t *this, proposal_t *proposal,
-							diffie_hellman_t *dh, chunk_t nonce_i,
+							key_exchange_t *dh, chunk_t nonce_i,
 							chunk_t nonce_r, ike_sa_id_t *id,
 							pseudo_random_function_t rekey_function,
 							chunk_t rekey_skd);
@@ -77,7 +77,7 @@ struct keymat_v2_t {
 	 * If no PFS is used for the CHILD_SA, dh can be NULL.
 	 *
 	 * @param proposal	selected algorithms
-	 * @param dh		diffie hellman key allocated by create_dh(), or NULL
+	 * @param dh		diffie hellman key allocated by create_ke(), or NULL
 	 * @param nonce_i	initiators nonce value
 	 * @param nonce_r	responders nonce value
 	 * @param encr_i	chunk to write initiators encryption key to
@@ -87,7 +87,7 @@ struct keymat_v2_t {
 	 * @return			TRUE on success
 	 */
 	bool (*derive_child_keys)(keymat_v2_t *this,
-							  proposal_t *proposal, diffie_hellman_t *dh,
+							  proposal_t *proposal, key_exchange_t *dh,
 							  chunk_t nonce_i, chunk_t nonce_r,
 							  chunk_t *encr_i, chunk_t *integ_i,
 							  chunk_t *encr_r, chunk_t *integ_r);

src/libcharon/sa/ikev2/tasks/child_create.c

@@ -20,7 +20,7 @@
 
 #include <daemon.h>
 #include <sa/ikev2/keymat_v2.h>
-#include <crypto/diffie_hellman.h>
+#include <crypto/key_exchange.h>
 #include <credentials/certificates/x509.h>
 #include <encoding/payloads/sa_payload.h>
 #include <encoding/payloads/ke_payload.h>
@@ -117,7 +117,7 @@ struct private_child_create_t {
 	/**
 	 * optional diffie hellman exchange
 	 */
-	diffie_hellman_t *dh;
+	key_exchange_t *dh;
 
 	/**
 	 * Applying DH public value failed?
@@ -127,7 +127,7 @@ struct private_child_create_t {
 	/**
 	 * group used for DH exchange
 	 */
-	diffie_hellman_group_t dh_group;
+	key_exchange_method_t dh_group;
 
 	/**
 	 * IKE_SAs keymat
@@ -328,7 +328,7 @@ static bool update_and_check_proposals(private_child_create_t *this)
 		if (this->dh_group != MODP_NONE)
 		{	/* proposals that don't contain the selected group are
 			 * moved to the back */
-			if (!proposal->promote_dh_group(proposal, this->dh_group))
+			if (!proposal->promote_ke_method(proposal, this->dh_group))
 			{
 				this->proposals->remove_at(this->proposals, enumerator);
 				other_dh_groups->insert_last(other_dh_groups, proposal);
@@ -518,7 +518,7 @@ static status_t select_and_install(private_child_create_t *this,
 
 	if (no_dh)
 	{
-		flags |= PROPOSAL_SKIP_DH;
+		flags |= PROPOSAL_SKIP_KE;
 	}
 	if (!this->ike_sa->supports_extension(this->ike_sa, EXT_STRONGSWAN) &&
 		!lib->settings->get_bool(lib->settings, "%s.accept_private_algs",
@@ -554,16 +554,16 @@ static status_t select_and_install(private_child_create_t *this,
 	}
 	this->child_sa->set_proposal(this->child_sa, this->proposal);
 
-	if (!this->proposal->has_dh_group(this->proposal, this->dh_group))
+	if (!this->proposal->has_ke_method(this->proposal, this->dh_group))
 	{
 		uint16_t group;
 
-		if (this->proposal->get_algorithm(this->proposal, DIFFIE_HELLMAN_GROUP,
+		if (this->proposal->get_algorithm(this->proposal, KEY_EXCHANGE_METHOD,
 										  &group, NULL))
 		{
 			DBG1(DBG_IKE, "DH group %N unacceptable, requesting %N",
-				 diffie_hellman_group_names, this->dh_group,
-				 diffie_hellman_group_names, group);
+				 key_exchange_method_names, this->dh_group,
+				 key_exchange_method_names, group);
 			this->dh_group = group;
 			return INVALID_ARG;
 		}
@@ -836,8 +836,8 @@ static bool build_payloads(private_child_create_t *this, message_t *message)
 	/* diffie hellman exchange, if PFS enabled */
 	if (this->dh)
 	{
-		ke_payload = ke_payload_create_from_diffie_hellman(PLV2_KEY_EXCHANGE,
-														   this->dh);
+		ke_payload = ke_payload_create_from_key_exchange(PLV2_KEY_EXCHANGE,
+														 this->dh);
 		if (!ke_payload)
 		{
 			DBG1(DBG_IKE, "creating KE payload failed");
@@ -979,18 +979,19 @@ static void process_payloads(private_child_create_t *this, message_t *message)
 				ke_payload = (ke_payload_t*)payload;
 				if (!this->initiator)
 				{
-					this->dh_group = ke_payload->get_dh_group_number(ke_payload);
-					this->dh = this->keymat->keymat.create_dh(
+					this->dh_group = ke_payload->get_key_exchange_method(
+																	ke_payload);
+					this->dh = this->keymat->keymat.create_ke(
 										&this->keymat->keymat, this->dh_group);
 				}
 				else if (this->dh)
 				{
-					this->dh_failed = this->dh->get_dh_group(this->dh) !=
-									ke_payload->get_dh_group_number(ke_payload);
+					this->dh_failed = this->dh->get_method(this->dh) !=
+								ke_payload->get_key_exchange_method(ke_payload);
 				}
 				if (this->dh && !this->dh_failed)
 				{
-					this->dh_failed = !this->dh->set_other_public_value(this->dh,
+					this->dh_failed = !this->dh->set_public_key(this->dh,
 								ke_payload->get_key_exchange_data(ke_payload));
 				}
 				break;
@@ -1157,7 +1158,7 @@ METHOD(task_t, build_i, status_t,
 			}
 			if (!this->retry && this->dh_group == MODP_NONE)
 			{	/* during a rekeying the group might already be set */
-				this->dh_group = this->config->get_dh_group(this->config);
+				this->dh_group = this->config->get_ke_method(this->config);
 			}
 			break;
 		case IKE_AUTH:
@@ -1287,13 +1288,13 @@ METHOD(task_t, build_i, status_t,
 	{
 		DBG1(DBG_IKE, "requested DH group %N not contained in any of our "
 			 "proposals",
-			 diffie_hellman_group_names, this->dh_group);
+			 key_exchange_method_names, this->dh_group);
 		return FAILED;
 	}
 
 	if (this->dh_group != MODP_NONE)
 	{
-		this->dh = this->keymat->keymat.create_dh(&this->keymat->keymat,
+		this->dh = this->keymat->keymat.create_ke(&this->keymat->keymat,
 												  this->dh_group);
 	}
 
@@ -1829,15 +1830,15 @@ METHOD(task_t, process_i, status_t,
 					if (this->retry)
 					{
 						DBG1(DBG_IKE, "already retried with DH group %N, "
-							 "ignore requested %N", diffie_hellman_group_names,
-							 this->dh_group, diffie_hellman_group_names, group);
+							 "ignore requested %N", key_exchange_method_names,
+							 this->dh_group, key_exchange_method_names, group);
 						handle_child_sa_failure(this, message);
 						/* an error in CHILD_SA creation is not critical */
 						return SUCCESS;
 					}
 					DBG1(DBG_IKE, "peer didn't accept DH group %N, "
-						 "it requested %N", diffie_hellman_group_names,
-						 this->dh_group, diffie_hellman_group_names, group);
+						 "it requested %N", key_exchange_method_names,
+						 this->dh_group, key_exchange_method_names, group);
 					this->retry = TRUE;
 					this->dh_group = group;
 					this->child_sa->set_state(this->child_sa, CHILD_RETRYING);
@@ -1945,7 +1946,7 @@ METHOD(child_create_t, use_label, void,
 }
 
 METHOD(child_create_t, use_dh_group, void,
-	private_child_create_t *this, diffie_hellman_group_t dh_group)
+	private_child_create_t *this, key_exchange_method_t dh_group)
 {
 	this->dh_group = dh_group;
 }

src/libcharon/sa/ikev2/tasks/child_create.h

@@ -83,7 +83,7 @@ struct child_create_t {
 	 *
 	 * @param dh_group	DH group to use
 	 */
-	void (*use_dh_group)(child_create_t *this, diffie_hellman_group_t dh_group);
+	void (*use_dh_group)(child_create_t *this, key_exchange_method_t dh_group);
 
 	/**
 	 * Get the lower of the two nonces, used for rekey collisions.

src/libcharon/sa/ikev2/tasks/child_rekey.c

@@ -197,7 +197,7 @@ METHOD(task_t, build_i, status_t,
 									config->get_ref(config), TRUE, NULL, NULL);
 
 		proposal = this->child_sa->get_proposal(this->child_sa);
-		if (proposal->get_algorithm(proposal, DIFFIE_HELLMAN_GROUP,
+		if (proposal->get_algorithm(proposal, KEY_EXCHANGE_METHOD,
 									&dh_group, NULL))
 		{	/* reuse the DH group negotiated previously */
 			this->child_create->use_dh_group(this->child_create, dh_group);

src/libcharon/sa/ikev2/tasks/ike_init.c

@@ -24,7 +24,7 @@
 #include <bio/bio_reader.h>
 #include <bio/bio_writer.h>
 #include <sa/ikev2/keymat_v2.h>
-#include <crypto/diffie_hellman.h>
+#include <crypto/key_exchange.h>
 #include <crypto/hashers/hash_algorithm_set.h>
 #include <encoding/payloads/sa_payload.h>
 #include <encoding/payloads/ke_payload.h>
@@ -58,12 +58,12 @@ struct private_ike_init_t {
 	/**
 	 * diffie hellman group to use
 	 */
-	diffie_hellman_group_t dh_group;
+	key_exchange_method_t dh_group;
 
 	/**
 	 * diffie hellman key exchange
 	 */
-	diffie_hellman_t *dh;
+	key_exchange_t *dh;
 
 	/**
 	 * Applying DH public value failed?
@@ -333,7 +333,7 @@ static bool build_payloads(private_ike_init_t *this, message_t *message)
 				proposal->set_spi(proposal, id->get_initiator_spi(id));
 			}
 			/* move the selected DH group to the front of the proposal */
-			if (!proposal->promote_dh_group(proposal, this->dh_group))
+			if (!proposal->promote_ke_method(proposal, this->dh_group))
 			{	/* the proposal does not include the group, move to the back */
 				proposal_list->remove_at(proposal_list, enumerator);
 				other_dh_groups->insert_last(other_dh_groups, proposal);
@@ -363,8 +363,8 @@ static bool build_payloads(private_ike_init_t *this, message_t *message)
 	}
 	message->add_payload(message, (payload_t*)sa_payload);
 
-	ke_payload = ke_payload_create_from_diffie_hellman(PLV2_KEY_EXCHANGE,
-													   this->dh);
+	ke_payload = ke_payload_create_from_key_exchange(PLV2_KEY_EXCHANGE,
+													 this->dh);
 	if (!ke_payload)
 	{
 		DBG1(DBG_IKE, "creating KE payload failed");
@@ -535,7 +535,7 @@ static void process_payloads(private_ike_init_t *this, message_t *message)
 			{
 				ke_payload = (ke_payload_t*)payload;
 
-				this->dh_group = ke_payload->get_dh_group_number(ke_payload);
+				this->dh_group = ke_payload->get_key_exchange_method(ke_payload);
 				break;
 			}
 			case PLV2_NONCE:
@@ -617,20 +617,20 @@ static void process_payloads(private_ike_init_t *this, message_t *message)
 	}
 
 	if (ke_payload && this->proposal &&
-		this->proposal->has_dh_group(this->proposal, this->dh_group))
+		this->proposal->has_ke_method(this->proposal, this->dh_group))
 	{
 		if (!this->initiator)
 		{
-			this->dh = this->keymat->keymat.create_dh(
+			this->dh = this->keymat->keymat.create_ke(
 								&this->keymat->keymat, this->dh_group);
 		}
 		else if (this->dh)
 		{
-			this->dh_failed = this->dh->get_dh_group(this->dh) != this->dh_group;
+			this->dh_failed = this->dh->get_method(this->dh) != this->dh_group;
 		}
 		if (this->dh && !this->dh_failed)
 		{
-			this->dh_failed = !this->dh->set_other_public_value(this->dh,
+			this->dh_failed = !this->dh->set_public_key(this->dh,
 								ke_payload->get_key_exchange_data(ke_payload));
 		}
 	}
@@ -665,38 +665,38 @@ METHOD(task_t, build_i, status_t,
 			uint16_t dh_group;
 
 			proposal = this->old_sa->get_proposal(this->old_sa);
-			if (proposal->get_algorithm(proposal, DIFFIE_HELLMAN_GROUP,
+			if (proposal->get_algorithm(proposal, KEY_EXCHANGE_METHOD,
 										&dh_group, NULL))
 			{
 				this->dh_group = dh_group;
 			}
 			else
 			{	/* this shouldn't happen, but let's be safe */
-				this->dh_group = ike_cfg->get_dh_group(ike_cfg);
+				this->dh_group = ike_cfg->get_ke_method(ike_cfg);
 			}
 		}
 		else
 		{
-			this->dh_group = ike_cfg->get_dh_group(ike_cfg);
+			this->dh_group = ike_cfg->get_ke_method(ike_cfg);
 		}
-		this->dh = this->keymat->keymat.create_dh(&this->keymat->keymat,
+		this->dh = this->keymat->keymat.create_ke(&this->keymat->keymat,
 												  this->dh_group);
 		if (!this->dh)
 		{
 			DBG1(DBG_IKE, "configured DH group %N not supported",
-				diffie_hellman_group_names, this->dh_group);
+				key_exchange_method_names, this->dh_group);
 			return FAILED;
 		}
 	}
-	else if (this->dh->get_dh_group(this->dh) != this->dh_group)
+	else if (this->dh->get_method(this->dh) != this->dh_group)
 	{	/* reset DH instance if group changed (INVALID_KE_PAYLOAD) */
 		this->dh->destroy(this->dh);
-		this->dh = this->keymat->keymat.create_dh(&this->keymat->keymat,
+		this->dh = this->keymat->keymat.create_ke(&this->keymat->keymat,
 												  this->dh_group);
 		if (!this->dh)
 		{
 			DBG1(DBG_IKE, "requested DH group %N not supported",
-				 diffie_hellman_group_names, this->dh_group);
+				 key_exchange_method_names, this->dh_group);
 			return FAILED;
 		}
 	}
@@ -829,16 +829,16 @@ METHOD(task_t, build_r, status_t,
 	}
 
 	if (this->dh == NULL ||
-		!this->proposal->has_dh_group(this->proposal, this->dh_group))
+		!this->proposal->has_ke_method(this->proposal, this->dh_group))
 	{
 		uint16_t group;
 
-		if (this->proposal->get_algorithm(this->proposal, DIFFIE_HELLMAN_GROUP,
+		if (this->proposal->get_algorithm(this->proposal, KEY_EXCHANGE_METHOD,
 										  &group, NULL))
 		{
 			DBG1(DBG_IKE, "DH group %N unacceptable, requesting %N",
-				 diffie_hellman_group_names, this->dh_group,
-				 diffie_hellman_group_names, group);
+				 key_exchange_method_names, this->dh_group,
+				 key_exchange_method_names, group);
 			this->dh_group = group;
 			group = htons(group);
 			message->add_notify(message, FALSE, INVALID_KE_PAYLOAD,
@@ -976,14 +976,14 @@ METHOD(task_t, process_i, status_t,
 				case INVALID_KE_PAYLOAD:
 				{
 					chunk_t data;
-					diffie_hellman_group_t bad_group;
+					key_exchange_method_t bad_group;
 
 					bad_group = this->dh_group;
 					data = notify->get_notification_data(notify);
 					this->dh_group = ntohs(*((uint16_t*)data.ptr));
 					DBG1(DBG_IKE, "peer didn't accept DH group %N, "
-						 "it requested %N", diffie_hellman_group_names,
-						 bad_group, diffie_hellman_group_names, this->dh_group);
+						 "it requested %N", key_exchange_method_names,
+						 bad_group, key_exchange_method_names, this->dh_group);
 
 					if (this->old_sa == NULL)
 					{	/* reset the IKE_SA if we are not rekeying */
@@ -1064,7 +1064,7 @@ METHOD(task_t, process_i, status_t,
 	}
 
 	if (this->dh == NULL ||
-		!this->proposal->has_dh_group(this->proposal, this->dh_group))
+		!this->proposal->has_ke_method(this->proposal, this->dh_group))
 	{
 		DBG1(DBG_IKE, "peer DH group selection invalid");
 		return FAILED;

src/libcharon/sa/keymat.h

@@ -53,22 +53,21 @@ struct keymat_t {
 	ike_version_t (*get_version)(keymat_t *this);
 
 	/**
-	 * Create a diffie hellman object for key agreement.
+	 * Create a key exchange object for key agreement.
 	 *
-	 * The diffie hellman is either for IKE negotiation/rekeying or
-	 * CHILD_SA rekeying (using PFS). The resulting DH object must be passed
-	 * to derive_keys or to derive_child_keys and destroyed after use.
+	 * The key exchange is either for IKE negotiation/rekeying or
+	 * CHILD_SA rekeying (using PFS). The resulting object must be passed
+	 * to derive_ike_keys() or to derive_child_keys() and destroyed after use.
 	 *
-	 * Only DH objects allocated through this method are passed to other
-	 * keymat_t methods, allowing private DH implementations. In some cases
-	 * (such as retrying with a COOKIE), a DH object allocated from a different
+	 * Only objects allocated through this method are passed to other
+	 * keymat_t methods, allowing private KE implementations. In some cases
+	 * (such as retrying with a COOKIE), a KE object allocated from a different
 	 * keymat_t instance may be passed to other methods.
 	 *
-	 * @param group			diffie hellman group
-	 * @return				DH object, NULL if group not supported
+	 * @param method		key exchange method
+	 * @return				key exchange object, NULL if method not supported
 	 */
-	diffie_hellman_t* (*create_dh)(keymat_t *this,
-								   diffie_hellman_group_t group);
+	key_exchange_t* (*create_ke)(keymat_t *this, key_exchange_method_t method);
 
 	/**
 	 * Create a nonce generator object.