haylen--, haystack++;          /* skip over comma itself */
    }
}

/*
 * SSH2 key creation method.
 */
static void ssh2_mkkey(Bignum K, char *H, char chr, char *keyspace) {
static void ssh2_mkkey(Bignum K, char *H, char *sessid, char chr, char *keyspace) {
    SHA_State s;
    /* First 20 bytes. */
    SHA_Init(&s);
    sha_mpint(&s, K);
    SHA_Bytes(&s, H, 20);
    SHA_Bytes(&s, &chr, 1);
    SHA_Bytes(&s, H, 20);
    SHA_Bytes(&s, sessid, 20);
    SHA_Final(&s, keyspace);
    /* Next 20 bytes. */
    SHA_Init(&s);
    sha_mpint(&s, K);
    SHA_Bytes(&s, H, 20);
    SHA_Bytes(&s, keyspace, 20);
    SHA_Final(&s, keyspace+20);

    static const struct ssh_mac *scmac_tobe = NULL;
    static const struct ssh_compress *cscomp_tobe = NULL;
    static const struct ssh_compress *sccomp_tobe = NULL;
    static char *hostkeydata, *sigdata, *keystr, *fingerprint;
    static int hostkeylen, siglen;
    static void *hkey;		       /* actual host key */
    static unsigned char exchange_hash[20];
    static unsigned char first_exchange_hash[20];
    static unsigned char keyspace[40];
    static const struct ssh_cipher *preferred_cipher;
    static const struct ssh_compress *preferred_comp;
    static int first_kex;

    crBegin;
    random_init();

     * Authenticate remote host: verify host key. (We've already
     * checked the signature of the exchange hash.)
     */
    keystr = hostkey->fmtkey(hkey);
    fingerprint = hostkey->fingerprint(hkey);
    verify_ssh_host_key(savedhost, savedport, hostkey->keytype,
                        keystr, fingerprint);
    if (first_kex) {		       /* don't bother logging this in rekeys */
    logevent("Host key fingerprint is:");
    logevent(fingerprint);
	logevent("Host key fingerprint is:");
	logevent(fingerprint);
    }
    sfree(fingerprint);
    sfree(keystr);
    hostkey->freekey(hkey);

    /*
     * Send SSH2_MSG_NEWKEYS.
     */

    csmac = csmac_tobe;
    scmac = scmac_tobe;
    cscomp = cscomp_tobe;
    sccomp = sccomp_tobe;
    cscomp->compress_init();
    sccomp->decompress_init();
    /*
     * Set IVs after keys.
     * Set IVs after keys. Here we use the exchange hash from the
     * _first_ key exchange.
     */
    if (first_kex)
	memcpy(first_exchange_hash, exchange_hash, sizeof(exchange_hash));
    ssh2_mkkey(K, exchange_hash, first_exchange_hash, 'C', keyspace);
    ssh2_mkkey(K, exchange_hash, 'C', keyspace); cscipher->setcskey(keyspace);
    ssh2_mkkey(K, exchange_hash, 'D', keyspace); sccipher->setsckey(keyspace);
    ssh2_mkkey(K, exchange_hash, 'A', keyspace); cscipher->setcsiv(keyspace);
    ssh2_mkkey(K, exchange_hash, 'B', keyspace); sccipher->setsciv(keyspace);
    ssh2_mkkey(K, exchange_hash, 'E', keyspace); csmac->setcskey(keyspace);
    ssh2_mkkey(K, exchange_hash, 'F', keyspace); scmac->setsckey(keyspace);
    cscipher->setcskey(keyspace);
    ssh2_mkkey(K, exchange_hash, first_exchange_hash, 'D', keyspace);
    sccipher->setsckey(keyspace);
    ssh2_mkkey(K, exchange_hash, first_exchange_hash, 'A', keyspace);
    cscipher->setcsiv(keyspace);
    ssh2_mkkey(K, exchange_hash, first_exchange_hash, 'B', keyspace);
    sccipher->setsciv(keyspace);
    ssh2_mkkey(K, exchange_hash, first_exchange_hash, 'E', keyspace);
    csmac->setcskey(keyspace);
    ssh2_mkkey(K, exchange_hash, first_exchange_hash, 'F', keyspace);
    scmac->setsckey(keyspace);

    /*
     * If this is the first key exchange phase, we must pass the
     * SSH2_MSG_NEWKEYS packet to the next layer, not because it
     * wants to see it but because it will need time to initialise
     * itself before it sees an actual packet. In subsequent key
     * exchange phases, we don't pass SSH2_MSG_NEWKEYS on, because

     * function so that other things can run on top of the
     * transport. If we ever see a KEXINIT, we must go back to the
     * start.
     */
    do {
        crReturn(1);
    } while (!(ispkt && pktin.type == SSH2_MSG_KEXINIT));
    logevent("Server initiated key re-exchange");
    goto begin_key_exchange;

    crFinish(1);
}

/*
 * Add data to an SSH2 channel output buffer.