def _continueGEX_REPLY(self, ignored, pubKey, f, signature):
        """
        The host key has been verified, so we generate the keys.

        @param ignored: Ignored.

        @param pubKey: the public key blob for the server's public key.
        @type pubKey: L{str}
        @param f: the server's Diffie-Hellman public key.
        @type f: L{long}
        @param signature: the server's signature, verifying that it has the
            correct private key.
        @type signature: L{str}
        """
        serverKey = keys.Key.fromString(pubKey)
        sharedSecret = self._finishEphemeralDH(f)
        h = _kex.getHashProcessor(self.kexAlg)()
        h.update(NS(self.ourVersionString))
        h.update(NS(self.otherVersionString))
        h.update(NS(self.ourKexInitPayload))
        h.update(NS(self.otherKexInitPayload))
        h.update(NS(pubKey))
        h.update(struct.pack(
            '!LLL',
            self._dhMinimalGroupSize,
            self._dhPreferredGroupSize,
            self._dhMaximalGroupSize,
            ))
        h.update(MP(self.p))
        h.update(MP(self.g))
        h.update(self.dhSecretKeyPublicMP)
        h.update(MP(f))
        h.update(sharedSecret)
        exchangeHash = h.digest()
        if not serverKey.verify(signature, exchangeHash):
            self.sendDisconnect(DISCONNECT_KEY_EXCHANGE_FAILED,
                                b'bad signature')
            return
        self._keySetup(sharedSecret, exchangeHash)

        The host key has been verified, so we generate the keys.

        @param ignored: Ignored.

        @param pubKey: the public key blob for the server's public key.
        @type pubKey: L{str}
        @param f: the server's Diffie-Hellman public key.
        @type f: L{long}
        @param signature: the server's signature, verifying that it has the
            correct private key.
        @type signature: L{str}
        
stackoverflow/venv/lib/python3.6/site-packages/twisted/conch/ssh/transport.py