diff options
-rw-r--r-- | ChangeLog | 5 | ||||
-rw-r--r-- | Makefile.in | 5 | ||||
-rw-r--r-- | cipher-3des1.c | 171 | ||||
-rw-r--r-- | cipher-aes.c | 156 | ||||
-rw-r--r-- | cipher-bf1.c | 97 | ||||
-rw-r--r-- | cipher.c | 338 |
6 files changed, 437 insertions, 335 deletions
@@ -22,6 +22,9 @@ | |||
22 | - jakob@cvs.openbsd.org 2003/05/15 02:27:15 | 22 | - jakob@cvs.openbsd.org 2003/05/15 02:27:15 |
23 | [dns.c] | 23 | [dns.c] |
24 | add missing freerrset | 24 | add missing freerrset |
25 | - markus@cvs.openbsd.org 2003/05/15 03:08:29 | ||
26 | [cipher.c cipher-bf1.c cipher-aes.c cipher-3des1.c] | ||
27 | split out custom EVP ciphers | ||
25 | - (djm) Always parse UsePAM | 28 | - (djm) Always parse UsePAM |
26 | - (djm) Configure glue for DNS support (code doesn't work in portable yet) | 29 | - (djm) Configure glue for DNS support (code doesn't work in portable yet) |
27 | - (djm) Import getrrsetbyname() function from OpenBSD libc (for DNS support) | 30 | - (djm) Import getrrsetbyname() function from OpenBSD libc (for DNS support) |
@@ -1502,4 +1505,4 @@ | |||
1502 | save auth method before monitor_reset_key_state(); bugzilla bug #284; | 1505 | save auth method before monitor_reset_key_state(); bugzilla bug #284; |
1503 | ok provos@ | 1506 | ok provos@ |
1504 | 1507 | ||
1505 | $Id: ChangeLog,v 1.2710 2003/05/15 03:27:28 djm Exp $ | 1508 | $Id: ChangeLog,v 1.2711 2003/05/15 03:37:19 djm Exp $ |
diff --git a/Makefile.in b/Makefile.in index 5758d0dbe..8bdef2031 100644 --- a/Makefile.in +++ b/Makefile.in | |||
@@ -1,4 +1,4 @@ | |||
1 | # $Id: Makefile.in,v 1.234 2003/05/15 03:23:07 djm Exp $ | 1 | # $Id: Makefile.in,v 1.235 2003/05/15 03:37:20 djm Exp $ |
2 | 2 | ||
3 | # uncomment if you run a non bourne compatable shell. Ie. csh | 3 | # uncomment if you run a non bourne compatable shell. Ie. csh |
4 | #SHELL = @SH@ | 4 | #SHELL = @SH@ |
@@ -61,7 +61,8 @@ INSTALL_SSH_RAND_HELPER=@INSTALL_SSH_RAND_HELPER@ | |||
61 | TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-agent$(EXEEXT) scp$(EXEEXT) ssh-rand-helper${EXEEXT} sftp-server$(EXEEXT) sftp$(EXEEXT) | 61 | TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-agent$(EXEEXT) scp$(EXEEXT) ssh-rand-helper${EXEEXT} sftp-server$(EXEEXT) sftp$(EXEEXT) |
62 | 62 | ||
63 | LIBSSH_OBJS=authfd.o authfile.o bufaux.o buffer.o canohost.o channels.o \ | 63 | LIBSSH_OBJS=authfd.o authfile.o bufaux.o buffer.o canohost.o channels.o \ |
64 | cipher.o compat.o compress.o crc32.o deattack.o fatal.o \ | 64 | cipher.o cipher-aes.o cipher-bf1.o cipher-3des1.o \ |
65 | compat.o compress.o crc32.o deattack.o fatal.o \ | ||
65 | hostfile.o log.o match.o mpaux.o nchan.o packet.o radix.o \ | 66 | hostfile.o log.o match.o mpaux.o nchan.o packet.o radix.o \ |
66 | readpass.o rsa.o tildexpand.o ttymodes.o xmalloc.o atomicio.o \ | 67 | readpass.o rsa.o tildexpand.o ttymodes.o xmalloc.o atomicio.o \ |
67 | key.o dispatch.o kex.o mac.o uuencode.o misc.o \ | 68 | key.o dispatch.o kex.o mac.o uuencode.o misc.o \ |
diff --git a/cipher-3des1.c b/cipher-3des1.c new file mode 100644 index 000000000..f9a352397 --- /dev/null +++ b/cipher-3des1.c | |||
@@ -0,0 +1,171 @@ | |||
1 | /* | ||
2 | * Copyright (c) 2003 Markus Friedl. All rights reserved. | ||
3 | * | ||
4 | * Redistribution and use in source and binary forms, with or without | ||
5 | * modification, are permitted provided that the following conditions | ||
6 | * are met: | ||
7 | * 1. Redistributions of source code must retain the above copyright | ||
8 | * notice, this list of conditions and the following disclaimer. | ||
9 | * 2. Redistributions in binary form must reproduce the above copyright | ||
10 | * notice, this list of conditions and the following disclaimer in the | ||
11 | * documentation and/or other materials provided with the distribution. | ||
12 | * | ||
13 | * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR | ||
14 | * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES | ||
15 | * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. | ||
16 | * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, | ||
17 | * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT | ||
18 | * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, | ||
19 | * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY | ||
20 | * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT | ||
21 | * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF | ||
22 | * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | ||
23 | */ | ||
24 | |||
25 | #include "includes.h" | ||
26 | RCSID("$OpenBSD: cipher-3des1.c,v 1.1 2003/05/15 03:08:29 markus Exp $"); | ||
27 | |||
28 | #include <openssl/evp.h> | ||
29 | #include "xmalloc.h" | ||
30 | #include "log.h" | ||
31 | |||
32 | /* | ||
33 | * This is used by SSH1: | ||
34 | * | ||
35 | * What kind of triple DES are these 2 routines? | ||
36 | * | ||
37 | * Why is there a redundant initialization vector? | ||
38 | * | ||
39 | * If only iv3 was used, then, this would till effect have been | ||
40 | * outer-cbc. However, there is also a private iv1 == iv2 which | ||
41 | * perhaps makes differential analysis easier. On the other hand, the | ||
42 | * private iv1 probably makes the CRC-32 attack ineffective. This is a | ||
43 | * result of that there is no longer any known iv1 to use when | ||
44 | * choosing the X block. | ||
45 | */ | ||
46 | struct ssh1_3des_ctx | ||
47 | { | ||
48 | EVP_CIPHER_CTX k1, k2, k3; | ||
49 | }; | ||
50 | |||
51 | const EVP_CIPHER * evp_ssh1_3des(void); | ||
52 | void ssh1_3des_iv(EVP_CIPHER_CTX *, int, u_char *, int); | ||
53 | |||
54 | static int | ||
55 | ssh1_3des_init(EVP_CIPHER_CTX *ctx, const u_char *key, const u_char *iv, | ||
56 | int enc) | ||
57 | { | ||
58 | struct ssh1_3des_ctx *c; | ||
59 | u_char *k1, *k2, *k3; | ||
60 | |||
61 | if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) == NULL) { | ||
62 | c = xmalloc(sizeof(*c)); | ||
63 | EVP_CIPHER_CTX_set_app_data(ctx, c); | ||
64 | } | ||
65 | if (key == NULL) | ||
66 | return (1); | ||
67 | if (enc == -1) | ||
68 | enc = ctx->encrypt; | ||
69 | k1 = k2 = k3 = (u_char *) key; | ||
70 | k2 += 8; | ||
71 | if (EVP_CIPHER_CTX_key_length(ctx) >= 16+8) { | ||
72 | if (enc) | ||
73 | k3 += 16; | ||
74 | else | ||
75 | k1 += 16; | ||
76 | } | ||
77 | EVP_CIPHER_CTX_init(&c->k1); | ||
78 | EVP_CIPHER_CTX_init(&c->k2); | ||
79 | EVP_CIPHER_CTX_init(&c->k3); | ||
80 | #ifdef SSH_OLD_EVP | ||
81 | EVP_CipherInit(&c->k1, EVP_des_cbc(), k1, NULL, enc); | ||
82 | EVP_CipherInit(&c->k2, EVP_des_cbc(), k2, NULL, !enc); | ||
83 | EVP_CipherInit(&c->k3, EVP_des_cbc(), k3, NULL, enc); | ||
84 | #else | ||
85 | if (EVP_CipherInit(&c->k1, EVP_des_cbc(), k1, NULL, enc) == 0 || | ||
86 | EVP_CipherInit(&c->k2, EVP_des_cbc(), k2, NULL, !enc) == 0 || | ||
87 | EVP_CipherInit(&c->k3, EVP_des_cbc(), k3, NULL, enc) == 0) { | ||
88 | memset(c, 0, sizeof(*c)); | ||
89 | xfree(c); | ||
90 | EVP_CIPHER_CTX_set_app_data(ctx, NULL); | ||
91 | return (0); | ||
92 | } | ||
93 | #endif | ||
94 | return (1); | ||
95 | } | ||
96 | |||
97 | static int | ||
98 | ssh1_3des_cbc(EVP_CIPHER_CTX *ctx, u_char *dest, const u_char *src, u_int len) | ||
99 | { | ||
100 | struct ssh1_3des_ctx *c; | ||
101 | |||
102 | if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) == NULL) { | ||
103 | error("ssh1_3des_cbc: no context"); | ||
104 | return (0); | ||
105 | } | ||
106 | #ifdef SSH_OLD_EVP | ||
107 | EVP_Cipher(&c->k1, dest, (u_char *)src, len); | ||
108 | EVP_Cipher(&c->k2, dest, dest, len); | ||
109 | EVP_Cipher(&c->k3, dest, dest, len); | ||
110 | #else | ||
111 | if (EVP_Cipher(&c->k1, dest, (u_char *)src, len) == 0 || | ||
112 | EVP_Cipher(&c->k2, dest, dest, len) == 0 || | ||
113 | EVP_Cipher(&c->k3, dest, dest, len) == 0) | ||
114 | return (0); | ||
115 | #endif | ||
116 | return (1); | ||
117 | } | ||
118 | |||
119 | static int | ||
120 | ssh1_3des_cleanup(EVP_CIPHER_CTX *ctx) | ||
121 | { | ||
122 | struct ssh1_3des_ctx *c; | ||
123 | |||
124 | if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) != NULL) { | ||
125 | memset(c, 0, sizeof(*c)); | ||
126 | xfree(c); | ||
127 | EVP_CIPHER_CTX_set_app_data(ctx, NULL); | ||
128 | } | ||
129 | return (1); | ||
130 | } | ||
131 | |||
132 | void | ||
133 | ssh1_3des_iv(EVP_CIPHER_CTX *evp, int doset, u_char *iv, int len) | ||
134 | { | ||
135 | struct ssh1_3des_ctx *c; | ||
136 | |||
137 | if (len != 24) | ||
138 | fatal("%s: bad 3des iv length: %d", __func__, len); | ||
139 | if ((c = EVP_CIPHER_CTX_get_app_data(evp)) == NULL) | ||
140 | fatal("%s: no 3des context", __func__); | ||
141 | if (doset) { | ||
142 | debug3("%s: Installed 3DES IV", __func__); | ||
143 | memcpy(c->k1.iv, iv, 8); | ||
144 | memcpy(c->k2.iv, iv + 8, 8); | ||
145 | memcpy(c->k3.iv, iv + 16, 8); | ||
146 | } else { | ||
147 | debug3("%s: Copying 3DES IV", __func__); | ||
148 | memcpy(iv, c->k1.iv, 8); | ||
149 | memcpy(iv + 8, c->k2.iv, 8); | ||
150 | memcpy(iv + 16, c->k3.iv, 8); | ||
151 | } | ||
152 | } | ||
153 | |||
154 | const EVP_CIPHER * | ||
155 | evp_ssh1_3des(void) | ||
156 | { | ||
157 | static EVP_CIPHER ssh1_3des; | ||
158 | |||
159 | memset(&ssh1_3des, 0, sizeof(EVP_CIPHER)); | ||
160 | ssh1_3des.nid = NID_undef; | ||
161 | ssh1_3des.block_size = 8; | ||
162 | ssh1_3des.iv_len = 0; | ||
163 | ssh1_3des.key_len = 16; | ||
164 | ssh1_3des.init = ssh1_3des_init; | ||
165 | ssh1_3des.cleanup = ssh1_3des_cleanup; | ||
166 | ssh1_3des.do_cipher = ssh1_3des_cbc; | ||
167 | #ifndef SSH_OLD_EVP | ||
168 | ssh1_3des.flags = EVP_CIPH_CBC_MODE | EVP_CIPH_VARIABLE_LENGTH; | ||
169 | #endif | ||
170 | return (&ssh1_3des); | ||
171 | } | ||
diff --git a/cipher-aes.c b/cipher-aes.c new file mode 100644 index 000000000..bbfbe7210 --- /dev/null +++ b/cipher-aes.c | |||
@@ -0,0 +1,156 @@ | |||
1 | /* | ||
2 | * Copyright (c) 2003 Markus Friedl. All rights reserved. | ||
3 | * | ||
4 | * Redistribution and use in source and binary forms, with or without | ||
5 | * modification, are permitted provided that the following conditions | ||
6 | * are met: | ||
7 | * 1. Redistributions of source code must retain the above copyright | ||
8 | * notice, this list of conditions and the following disclaimer. | ||
9 | * 2. Redistributions in binary form must reproduce the above copyright | ||
10 | * notice, this list of conditions and the following disclaimer in the | ||
11 | * documentation and/or other materials provided with the distribution. | ||
12 | * | ||
13 | * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR | ||
14 | * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES | ||
15 | * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. | ||
16 | * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, | ||
17 | * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT | ||
18 | * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, | ||
19 | * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY | ||
20 | * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT | ||
21 | * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF | ||
22 | * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | ||
23 | */ | ||
24 | |||
25 | #if OPENSSL_VERSION_NUMBER < 0x00907000L | ||
26 | #include "includes.h" | ||
27 | RCSID("$OpenBSD: cipher-aes.c,v 1.1 2003/05/15 03:08:29 markus Exp $"); | ||
28 | |||
29 | #include <openssl/evp.h> | ||
30 | #include "rijndael.h" | ||
31 | #include "xmalloc.h" | ||
32 | #include "log.h" | ||
33 | |||
34 | #define RIJNDAEL_BLOCKSIZE 16 | ||
35 | struct ssh_rijndael_ctx | ||
36 | { | ||
37 | rijndael_ctx r_ctx; | ||
38 | u_char r_iv[RIJNDAEL_BLOCKSIZE]; | ||
39 | }; | ||
40 | |||
41 | const EVP_CIPHER * evp_rijndael(void); | ||
42 | void ssh_rijndael_iv(EVP_CIPHER_CTX *, int, u_char *, u_int); | ||
43 | |||
44 | static int | ||
45 | ssh_rijndael_init(EVP_CIPHER_CTX *ctx, const u_char *key, const u_char *iv, | ||
46 | int enc) | ||
47 | { | ||
48 | struct ssh_rijndael_ctx *c; | ||
49 | |||
50 | if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) == NULL) { | ||
51 | c = xmalloc(sizeof(*c)); | ||
52 | EVP_CIPHER_CTX_set_app_data(ctx, c); | ||
53 | } | ||
54 | if (key != NULL) { | ||
55 | if (enc == -1) | ||
56 | enc = ctx->encrypt; | ||
57 | rijndael_set_key(&c->r_ctx, (u_char *)key, | ||
58 | 8*EVP_CIPHER_CTX_key_length(ctx), enc); | ||
59 | } | ||
60 | if (iv != NULL) | ||
61 | memcpy(c->r_iv, iv, RIJNDAEL_BLOCKSIZE); | ||
62 | return (1); | ||
63 | } | ||
64 | |||
65 | static int | ||
66 | ssh_rijndael_cbc(EVP_CIPHER_CTX *ctx, u_char *dest, const u_char *src, | ||
67 | u_int len) | ||
68 | { | ||
69 | struct ssh_rijndael_ctx *c; | ||
70 | u_char buf[RIJNDAEL_BLOCKSIZE]; | ||
71 | u_char *cprev, *cnow, *plain, *ivp; | ||
72 | int i, j, blocks = len / RIJNDAEL_BLOCKSIZE; | ||
73 | |||
74 | if (len == 0) | ||
75 | return (1); | ||
76 | if (len % RIJNDAEL_BLOCKSIZE) | ||
77 | fatal("ssh_rijndael_cbc: bad len %d", len); | ||
78 | if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) == NULL) { | ||
79 | error("ssh_rijndael_cbc: no context"); | ||
80 | return (0); | ||
81 | } | ||
82 | if (ctx->encrypt) { | ||
83 | cnow = dest; | ||
84 | plain = (u_char *)src; | ||
85 | cprev = c->r_iv; | ||
86 | for (i = 0; i < blocks; i++, plain+=RIJNDAEL_BLOCKSIZE, | ||
87 | cnow+=RIJNDAEL_BLOCKSIZE) { | ||
88 | for (j = 0; j < RIJNDAEL_BLOCKSIZE; j++) | ||
89 | buf[j] = plain[j] ^ cprev[j]; | ||
90 | rijndael_encrypt(&c->r_ctx, buf, cnow); | ||
91 | cprev = cnow; | ||
92 | } | ||
93 | memcpy(c->r_iv, cprev, RIJNDAEL_BLOCKSIZE); | ||
94 | } else { | ||
95 | cnow = (u_char *) (src+len-RIJNDAEL_BLOCKSIZE); | ||
96 | plain = dest+len-RIJNDAEL_BLOCKSIZE; | ||
97 | |||
98 | memcpy(buf, cnow, RIJNDAEL_BLOCKSIZE); | ||
99 | for (i = blocks; i > 0; i--, cnow-=RIJNDAEL_BLOCKSIZE, | ||
100 | plain-=RIJNDAEL_BLOCKSIZE) { | ||
101 | rijndael_decrypt(&c->r_ctx, cnow, plain); | ||
102 | ivp = (i == 1) ? c->r_iv : cnow-RIJNDAEL_BLOCKSIZE; | ||
103 | for (j = 0; j < RIJNDAEL_BLOCKSIZE; j++) | ||
104 | plain[j] ^= ivp[j]; | ||
105 | } | ||
106 | memcpy(c->r_iv, buf, RIJNDAEL_BLOCKSIZE); | ||
107 | } | ||
108 | return (1); | ||
109 | } | ||
110 | |||
111 | static int | ||
112 | ssh_rijndael_cleanup(EVP_CIPHER_CTX *ctx) | ||
113 | { | ||
114 | struct ssh_rijndael_ctx *c; | ||
115 | |||
116 | if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) != NULL) { | ||
117 | memset(c, 0, sizeof(*c)); | ||
118 | xfree(c); | ||
119 | EVP_CIPHER_CTX_set_app_data(ctx, NULL); | ||
120 | } | ||
121 | return (1); | ||
122 | } | ||
123 | |||
124 | void | ||
125 | ssh_rijndael_iv(EVP_CIPHER_CTX *evp, int doset, u_char * iv, u_int len) | ||
126 | { | ||
127 | struct ssh_rijndael_ctx *c; | ||
128 | |||
129 | if ((c = EVP_CIPHER_CTX_get_app_data(evp)) == NULL) | ||
130 | fatal("ssh_rijndael_iv: no context"); | ||
131 | if (doset) | ||
132 | memcpy(c->r_iv, iv, len); | ||
133 | else | ||
134 | memcpy(iv, c->r_iv, len); | ||
135 | } | ||
136 | |||
137 | const EVP_CIPHER * | ||
138 | evp_rijndael(void) | ||
139 | { | ||
140 | static EVP_CIPHER rijndal_cbc; | ||
141 | |||
142 | memset(&rijndal_cbc, 0, sizeof(EVP_CIPHER)); | ||
143 | rijndal_cbc.nid = NID_undef; | ||
144 | rijndal_cbc.block_size = RIJNDAEL_BLOCKSIZE; | ||
145 | rijndal_cbc.iv_len = RIJNDAEL_BLOCKSIZE; | ||
146 | rijndal_cbc.key_len = 16; | ||
147 | rijndal_cbc.init = ssh_rijndael_init; | ||
148 | rijndal_cbc.cleanup = ssh_rijndael_cleanup; | ||
149 | rijndal_cbc.do_cipher = ssh_rijndael_cbc; | ||
150 | #ifndef SSH_OLD_EVP | ||
151 | rijndal_cbc.flags = EVP_CIPH_CBC_MODE | EVP_CIPH_VARIABLE_LENGTH | | ||
152 | EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CUSTOM_IV; | ||
153 | #endif | ||
154 | return (&rijndal_cbc); | ||
155 | } | ||
156 | #endif | ||
diff --git a/cipher-bf1.c b/cipher-bf1.c new file mode 100644 index 000000000..64578bae8 --- /dev/null +++ b/cipher-bf1.c | |||
@@ -0,0 +1,97 @@ | |||
1 | /* | ||
2 | * Copyright (c) 2003 Markus Friedl. All rights reserved. | ||
3 | * | ||
4 | * Redistribution and use in source and binary forms, with or without | ||
5 | * modification, are permitted provided that the following conditions | ||
6 | * are met: | ||
7 | * 1. Redistributions of source code must retain the above copyright | ||
8 | * notice, this list of conditions and the following disclaimer. | ||
9 | * 2. Redistributions in binary form must reproduce the above copyright | ||
10 | * notice, this list of conditions and the following disclaimer in the | ||
11 | * documentation and/or other materials provided with the distribution. | ||
12 | * | ||
13 | * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR | ||
14 | * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES | ||
15 | * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. | ||
16 | * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, | ||
17 | * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT | ||
18 | * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, | ||
19 | * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY | ||
20 | * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT | ||
21 | * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF | ||
22 | * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | ||
23 | */ | ||
24 | |||
25 | #include "includes.h" | ||
26 | RCSID("$OpenBSD: cipher-bf1.c,v 1.1 2003/05/15 03:08:29 markus Exp $"); | ||
27 | |||
28 | #include <openssl/evp.h> | ||
29 | #include "xmalloc.h" | ||
30 | #include "log.h" | ||
31 | /* | ||
32 | * SSH1 uses a variation on Blowfish, all bytes must be swapped before | ||
33 | * and after encryption/decryption. Thus the swap_bytes stuff (yuk). | ||
34 | */ | ||
35 | |||
36 | const EVP_CIPHER * evp_ssh1_bf(void); | ||
37 | |||
38 | static void | ||
39 | swap_bytes(const u_char *src, u_char *dst, int n) | ||
40 | { | ||
41 | u_char c[4]; | ||
42 | |||
43 | /* Process 4 bytes every lap. */ | ||
44 | for (n = n / 4; n > 0; n--) { | ||
45 | c[3] = *src++; | ||
46 | c[2] = *src++; | ||
47 | c[1] = *src++; | ||
48 | c[0] = *src++; | ||
49 | |||
50 | *dst++ = c[0]; | ||
51 | *dst++ = c[1]; | ||
52 | *dst++ = c[2]; | ||
53 | *dst++ = c[3]; | ||
54 | } | ||
55 | } | ||
56 | |||
57 | #ifdef SSH_OLD_EVP | ||
58 | static void bf_ssh1_init (EVP_CIPHER_CTX * ctx, const unsigned char *key, | ||
59 | const unsigned char *iv, int enc) | ||
60 | { | ||
61 | if (iv != NULL) | ||
62 | memcpy (&(ctx->oiv[0]), iv, 8); | ||
63 | memcpy (&(ctx->iv[0]), &(ctx->oiv[0]), 8); | ||
64 | if (key != NULL) | ||
65 | BF_set_key (&(ctx->c.bf_ks), EVP_CIPHER_CTX_key_length (ctx), | ||
66 | key); | ||
67 | } | ||
68 | #endif | ||
69 | |||
70 | static int (*orig_bf)(EVP_CIPHER_CTX *, u_char *, const u_char *, u_int) = NULL; | ||
71 | |||
72 | static int | ||
73 | bf_ssh1_cipher(EVP_CIPHER_CTX *ctx, u_char *out, const u_char *in, u_int len) | ||
74 | { | ||
75 | int ret; | ||
76 | |||
77 | swap_bytes(in, out, len); | ||
78 | ret = (*orig_bf)(ctx, out, out, len); | ||
79 | swap_bytes(out, out, len); | ||
80 | return (ret); | ||
81 | } | ||
82 | |||
83 | const EVP_CIPHER * | ||
84 | evp_ssh1_bf(void) | ||
85 | { | ||
86 | static EVP_CIPHER ssh1_bf; | ||
87 | |||
88 | memcpy(&ssh1_bf, EVP_bf_cbc(), sizeof(EVP_CIPHER)); | ||
89 | orig_bf = ssh1_bf.do_cipher; | ||
90 | ssh1_bf.nid = NID_undef; | ||
91 | #ifdef SSH_OLD_EVP | ||
92 | ssh1_bf.init = bf_ssh1_init; | ||
93 | #endif | ||
94 | ssh1_bf.do_cipher = bf_ssh1_cipher; | ||
95 | ssh1_bf.key_len = 32; | ||
96 | return (&ssh1_bf); | ||
97 | } | ||
@@ -35,7 +35,7 @@ | |||
35 | */ | 35 | */ |
36 | 36 | ||
37 | #include "includes.h" | 37 | #include "includes.h" |
38 | RCSID("$OpenBSD: cipher.c,v 1.63 2003/04/12 10:13:57 markus Exp $"); | 38 | RCSID("$OpenBSD: cipher.c,v 1.64 2003/05/15 03:08:29 markus Exp $"); |
39 | 39 | ||
40 | #include "xmalloc.h" | 40 | #include "xmalloc.h" |
41 | #include "log.h" | 41 | #include "log.h" |
@@ -49,11 +49,12 @@ RCSID("$OpenBSD: cipher.c,v 1.63 2003/04/12 10:13:57 markus Exp $"); | |||
49 | #endif | 49 | #endif |
50 | 50 | ||
51 | #if OPENSSL_VERSION_NUMBER < 0x00907000L | 51 | #if OPENSSL_VERSION_NUMBER < 0x00907000L |
52 | #include "rijndael.h" | 52 | extern const EVP_CIPHER *evp_rijndael(void); |
53 | static const EVP_CIPHER *evp_rijndael(void); | 53 | extern void ssh_rijndael_iv(EVP_CIPHER_CTX *, int, u_char *, u_int); |
54 | #endif | 54 | #endif |
55 | static const EVP_CIPHER *evp_ssh1_3des(void); | 55 | extern const EVP_CIPHER *evp_ssh1_bf(void); |
56 | static const EVP_CIPHER *evp_ssh1_bf(void); | 56 | extern const EVP_CIPHER *evp_ssh1_3des(void); |
57 | extern void ssh1_3des_iv(EVP_CIPHER_CTX *, int, u_char *, int); | ||
57 | 58 | ||
58 | struct Cipher { | 59 | struct Cipher { |
59 | char *name; | 60 | char *name; |
@@ -296,333 +297,6 @@ cipher_set_key_string(CipherContext *cc, Cipher *cipher, | |||
296 | memset(&md, 0, sizeof(md)); | 297 | memset(&md, 0, sizeof(md)); |
297 | } | 298 | } |
298 | 299 | ||
299 | /* Implementations for other non-EVP ciphers */ | ||
300 | |||
301 | /* | ||
302 | * This is used by SSH1: | ||
303 | * | ||
304 | * What kind of triple DES are these 2 routines? | ||
305 | * | ||
306 | * Why is there a redundant initialization vector? | ||
307 | * | ||
308 | * If only iv3 was used, then, this would till effect have been | ||
309 | * outer-cbc. However, there is also a private iv1 == iv2 which | ||
310 | * perhaps makes differential analysis easier. On the other hand, the | ||
311 | * private iv1 probably makes the CRC-32 attack ineffective. This is a | ||
312 | * result of that there is no longer any known iv1 to use when | ||
313 | * choosing the X block. | ||
314 | */ | ||
315 | struct ssh1_3des_ctx | ||
316 | { | ||
317 | EVP_CIPHER_CTX k1, k2, k3; | ||
318 | }; | ||
319 | |||
320 | static int | ||
321 | ssh1_3des_init(EVP_CIPHER_CTX *ctx, const u_char *key, const u_char *iv, | ||
322 | int enc) | ||
323 | { | ||
324 | struct ssh1_3des_ctx *c; | ||
325 | u_char *k1, *k2, *k3; | ||
326 | |||
327 | if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) == NULL) { | ||
328 | c = xmalloc(sizeof(*c)); | ||
329 | EVP_CIPHER_CTX_set_app_data(ctx, c); | ||
330 | } | ||
331 | if (key == NULL) | ||
332 | return (1); | ||
333 | if (enc == -1) | ||
334 | enc = ctx->encrypt; | ||
335 | k1 = k2 = k3 = (u_char *) key; | ||
336 | k2 += 8; | ||
337 | if (EVP_CIPHER_CTX_key_length(ctx) >= 16+8) { | ||
338 | if (enc) | ||
339 | k3 += 16; | ||
340 | else | ||
341 | k1 += 16; | ||
342 | } | ||
343 | EVP_CIPHER_CTX_init(&c->k1); | ||
344 | EVP_CIPHER_CTX_init(&c->k2); | ||
345 | EVP_CIPHER_CTX_init(&c->k3); | ||
346 | #ifdef SSH_OLD_EVP | ||
347 | EVP_CipherInit(&c->k1, EVP_des_cbc(), k1, NULL, enc); | ||
348 | EVP_CipherInit(&c->k2, EVP_des_cbc(), k2, NULL, !enc); | ||
349 | EVP_CipherInit(&c->k3, EVP_des_cbc(), k3, NULL, enc); | ||
350 | #else | ||
351 | if (EVP_CipherInit(&c->k1, EVP_des_cbc(), k1, NULL, enc) == 0 || | ||
352 | EVP_CipherInit(&c->k2, EVP_des_cbc(), k2, NULL, !enc) == 0 || | ||
353 | EVP_CipherInit(&c->k3, EVP_des_cbc(), k3, NULL, enc) == 0) { | ||
354 | memset(c, 0, sizeof(*c)); | ||
355 | xfree(c); | ||
356 | EVP_CIPHER_CTX_set_app_data(ctx, NULL); | ||
357 | return (0); | ||
358 | } | ||
359 | #endif | ||
360 | return (1); | ||
361 | } | ||
362 | |||
363 | static int | ||
364 | ssh1_3des_cbc(EVP_CIPHER_CTX *ctx, u_char *dest, const u_char *src, u_int len) | ||
365 | { | ||
366 | struct ssh1_3des_ctx *c; | ||
367 | |||
368 | if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) == NULL) { | ||
369 | error("ssh1_3des_cbc: no context"); | ||
370 | return (0); | ||
371 | } | ||
372 | #ifdef SSH_OLD_EVP | ||
373 | EVP_Cipher(&c->k1, dest, (u_char *)src, len); | ||
374 | EVP_Cipher(&c->k2, dest, dest, len); | ||
375 | EVP_Cipher(&c->k3, dest, dest, len); | ||
376 | #else | ||
377 | if (EVP_Cipher(&c->k1, dest, (u_char *)src, len) == 0 || | ||
378 | EVP_Cipher(&c->k2, dest, dest, len) == 0 || | ||
379 | EVP_Cipher(&c->k3, dest, dest, len) == 0) | ||
380 | return (0); | ||
381 | #endif | ||
382 | return (1); | ||
383 | } | ||
384 | |||
385 | static int | ||
386 | ssh1_3des_cleanup(EVP_CIPHER_CTX *ctx) | ||
387 | { | ||
388 | struct ssh1_3des_ctx *c; | ||
389 | |||
390 | if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) != NULL) { | ||
391 | memset(c, 0, sizeof(*c)); | ||
392 | xfree(c); | ||
393 | EVP_CIPHER_CTX_set_app_data(ctx, NULL); | ||
394 | } | ||
395 | return (1); | ||
396 | } | ||
397 | |||
398 | static void | ||
399 | ssh1_3des_iv(EVP_CIPHER_CTX *evp, int doset, u_char *iv, int len) | ||
400 | { | ||
401 | struct ssh1_3des_ctx *c; | ||
402 | |||
403 | if (len != 24) | ||
404 | fatal("%s: bad 3des iv length: %d", __func__, len); | ||
405 | if ((c = EVP_CIPHER_CTX_get_app_data(evp)) == NULL) | ||
406 | fatal("%s: no 3des context", __func__); | ||
407 | if (doset) { | ||
408 | debug3("%s: Installed 3DES IV", __func__); | ||
409 | memcpy(c->k1.iv, iv, 8); | ||
410 | memcpy(c->k2.iv, iv + 8, 8); | ||
411 | memcpy(c->k3.iv, iv + 16, 8); | ||
412 | } else { | ||
413 | debug3("%s: Copying 3DES IV", __func__); | ||
414 | memcpy(iv, c->k1.iv, 8); | ||
415 | memcpy(iv + 8, c->k2.iv, 8); | ||
416 | memcpy(iv + 16, c->k3.iv, 8); | ||
417 | } | ||
418 | } | ||
419 | |||
420 | static const EVP_CIPHER * | ||
421 | evp_ssh1_3des(void) | ||
422 | { | ||
423 | static EVP_CIPHER ssh1_3des; | ||
424 | |||
425 | memset(&ssh1_3des, 0, sizeof(EVP_CIPHER)); | ||
426 | ssh1_3des.nid = NID_undef; | ||
427 | ssh1_3des.block_size = 8; | ||
428 | ssh1_3des.iv_len = 0; | ||
429 | ssh1_3des.key_len = 16; | ||
430 | ssh1_3des.init = ssh1_3des_init; | ||
431 | ssh1_3des.cleanup = ssh1_3des_cleanup; | ||
432 | ssh1_3des.do_cipher = ssh1_3des_cbc; | ||
433 | #ifndef SSH_OLD_EVP | ||
434 | ssh1_3des.flags = EVP_CIPH_CBC_MODE | EVP_CIPH_VARIABLE_LENGTH; | ||
435 | #endif | ||
436 | return (&ssh1_3des); | ||
437 | } | ||
438 | |||
439 | /* | ||
440 | * SSH1 uses a variation on Blowfish, all bytes must be swapped before | ||
441 | * and after encryption/decryption. Thus the swap_bytes stuff (yuk). | ||
442 | */ | ||
443 | static void | ||
444 | swap_bytes(const u_char *src, u_char *dst, int n) | ||
445 | { | ||
446 | u_char c[4]; | ||
447 | |||
448 | /* Process 4 bytes every lap. */ | ||
449 | for (n = n / 4; n > 0; n--) { | ||
450 | c[3] = *src++; | ||
451 | c[2] = *src++; | ||
452 | c[1] = *src++; | ||
453 | c[0] = *src++; | ||
454 | |||
455 | *dst++ = c[0]; | ||
456 | *dst++ = c[1]; | ||
457 | *dst++ = c[2]; | ||
458 | *dst++ = c[3]; | ||
459 | } | ||
460 | } | ||
461 | |||
462 | #ifdef SSH_OLD_EVP | ||
463 | static void bf_ssh1_init (EVP_CIPHER_CTX * ctx, const unsigned char *key, | ||
464 | const unsigned char *iv, int enc) | ||
465 | { | ||
466 | if (iv != NULL) | ||
467 | memcpy (&(ctx->oiv[0]), iv, 8); | ||
468 | memcpy (&(ctx->iv[0]), &(ctx->oiv[0]), 8); | ||
469 | if (key != NULL) | ||
470 | BF_set_key (&(ctx->c.bf_ks), EVP_CIPHER_CTX_key_length (ctx), | ||
471 | key); | ||
472 | } | ||
473 | #endif | ||
474 | static int (*orig_bf)(EVP_CIPHER_CTX *, u_char *, const u_char *, u_int) = NULL; | ||
475 | |||
476 | static int | ||
477 | bf_ssh1_cipher(EVP_CIPHER_CTX *ctx, u_char *out, const u_char *in, u_int len) | ||
478 | { | ||
479 | int ret; | ||
480 | |||
481 | swap_bytes(in, out, len); | ||
482 | ret = (*orig_bf)(ctx, out, out, len); | ||
483 | swap_bytes(out, out, len); | ||
484 | return (ret); | ||
485 | } | ||
486 | |||
487 | static const EVP_CIPHER * | ||
488 | evp_ssh1_bf(void) | ||
489 | { | ||
490 | static EVP_CIPHER ssh1_bf; | ||
491 | |||
492 | memcpy(&ssh1_bf, EVP_bf_cbc(), sizeof(EVP_CIPHER)); | ||
493 | orig_bf = ssh1_bf.do_cipher; | ||
494 | ssh1_bf.nid = NID_undef; | ||
495 | #ifdef SSH_OLD_EVP | ||
496 | ssh1_bf.init = bf_ssh1_init; | ||
497 | #endif | ||
498 | ssh1_bf.do_cipher = bf_ssh1_cipher; | ||
499 | ssh1_bf.key_len = 32; | ||
500 | return (&ssh1_bf); | ||
501 | } | ||
502 | |||
503 | #if OPENSSL_VERSION_NUMBER < 0x00907000L | ||
504 | /* RIJNDAEL */ | ||
505 | #define RIJNDAEL_BLOCKSIZE 16 | ||
506 | struct ssh_rijndael_ctx | ||
507 | { | ||
508 | rijndael_ctx r_ctx; | ||
509 | u_char r_iv[RIJNDAEL_BLOCKSIZE]; | ||
510 | }; | ||
511 | |||
512 | static int | ||
513 | ssh_rijndael_init(EVP_CIPHER_CTX *ctx, const u_char *key, const u_char *iv, | ||
514 | int enc) | ||
515 | { | ||
516 | struct ssh_rijndael_ctx *c; | ||
517 | |||
518 | if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) == NULL) { | ||
519 | c = xmalloc(sizeof(*c)); | ||
520 | EVP_CIPHER_CTX_set_app_data(ctx, c); | ||
521 | } | ||
522 | if (key != NULL) { | ||
523 | if (enc == -1) | ||
524 | enc = ctx->encrypt; | ||
525 | rijndael_set_key(&c->r_ctx, (u_char *)key, | ||
526 | 8*EVP_CIPHER_CTX_key_length(ctx), enc); | ||
527 | } | ||
528 | if (iv != NULL) | ||
529 | memcpy(c->r_iv, iv, RIJNDAEL_BLOCKSIZE); | ||
530 | return (1); | ||
531 | } | ||
532 | |||
533 | static int | ||
534 | ssh_rijndael_cbc(EVP_CIPHER_CTX *ctx, u_char *dest, const u_char *src, | ||
535 | u_int len) | ||
536 | { | ||
537 | struct ssh_rijndael_ctx *c; | ||
538 | u_char buf[RIJNDAEL_BLOCKSIZE]; | ||
539 | u_char *cprev, *cnow, *plain, *ivp; | ||
540 | int i, j, blocks = len / RIJNDAEL_BLOCKSIZE; | ||
541 | |||
542 | if (len == 0) | ||
543 | return (1); | ||
544 | if (len % RIJNDAEL_BLOCKSIZE) | ||
545 | fatal("ssh_rijndael_cbc: bad len %d", len); | ||
546 | if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) == NULL) { | ||
547 | error("ssh_rijndael_cbc: no context"); | ||
548 | return (0); | ||
549 | } | ||
550 | if (ctx->encrypt) { | ||
551 | cnow = dest; | ||
552 | plain = (u_char *)src; | ||
553 | cprev = c->r_iv; | ||
554 | for (i = 0; i < blocks; i++, plain+=RIJNDAEL_BLOCKSIZE, | ||
555 | cnow+=RIJNDAEL_BLOCKSIZE) { | ||
556 | for (j = 0; j < RIJNDAEL_BLOCKSIZE; j++) | ||
557 | buf[j] = plain[j] ^ cprev[j]; | ||
558 | rijndael_encrypt(&c->r_ctx, buf, cnow); | ||
559 | cprev = cnow; | ||
560 | } | ||
561 | memcpy(c->r_iv, cprev, RIJNDAEL_BLOCKSIZE); | ||
562 | } else { | ||
563 | cnow = (u_char *) (src+len-RIJNDAEL_BLOCKSIZE); | ||
564 | plain = dest+len-RIJNDAEL_BLOCKSIZE; | ||
565 | |||
566 | memcpy(buf, cnow, RIJNDAEL_BLOCKSIZE); | ||
567 | for (i = blocks; i > 0; i--, cnow-=RIJNDAEL_BLOCKSIZE, | ||
568 | plain-=RIJNDAEL_BLOCKSIZE) { | ||
569 | rijndael_decrypt(&c->r_ctx, cnow, plain); | ||
570 | ivp = (i == 1) ? c->r_iv : cnow-RIJNDAEL_BLOCKSIZE; | ||
571 | for (j = 0; j < RIJNDAEL_BLOCKSIZE; j++) | ||
572 | plain[j] ^= ivp[j]; | ||
573 | } | ||
574 | memcpy(c->r_iv, buf, RIJNDAEL_BLOCKSIZE); | ||
575 | } | ||
576 | return (1); | ||
577 | } | ||
578 | |||
579 | static int | ||
580 | ssh_rijndael_cleanup(EVP_CIPHER_CTX *ctx) | ||
581 | { | ||
582 | struct ssh_rijndael_ctx *c; | ||
583 | |||
584 | if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) != NULL) { | ||
585 | memset(c, 0, sizeof(*c)); | ||
586 | xfree(c); | ||
587 | EVP_CIPHER_CTX_set_app_data(ctx, NULL); | ||
588 | } | ||
589 | return (1); | ||
590 | } | ||
591 | |||
592 | static void | ||
593 | ssh_rijndael_iv(EVP_CIPHER_CTX *evp, int doset, u_char * iv, u_int len) | ||
594 | { | ||
595 | struct ssh_rijndael_ctx *c; | ||
596 | |||
597 | if ((c = EVP_CIPHER_CTX_get_app_data(evp)) == NULL) | ||
598 | fatal("ssh_rijndael_iv: no context"); | ||
599 | if (doset) | ||
600 | memcpy(c->r_iv, iv, len); | ||
601 | else | ||
602 | memcpy(iv, c->r_iv, len); | ||
603 | } | ||
604 | |||
605 | static const EVP_CIPHER * | ||
606 | evp_rijndael(void) | ||
607 | { | ||
608 | static EVP_CIPHER rijndal_cbc; | ||
609 | |||
610 | memset(&rijndal_cbc, 0, sizeof(EVP_CIPHER)); | ||
611 | rijndal_cbc.nid = NID_undef; | ||
612 | rijndal_cbc.block_size = RIJNDAEL_BLOCKSIZE; | ||
613 | rijndal_cbc.iv_len = RIJNDAEL_BLOCKSIZE; | ||
614 | rijndal_cbc.key_len = 16; | ||
615 | rijndal_cbc.init = ssh_rijndael_init; | ||
616 | rijndal_cbc.cleanup = ssh_rijndael_cleanup; | ||
617 | rijndal_cbc.do_cipher = ssh_rijndael_cbc; | ||
618 | #ifndef SSH_OLD_EVP | ||
619 | rijndal_cbc.flags = EVP_CIPH_CBC_MODE | EVP_CIPH_VARIABLE_LENGTH | | ||
620 | EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CUSTOM_IV; | ||
621 | #endif | ||
622 | return (&rijndal_cbc); | ||
623 | } | ||
624 | #endif | ||
625 | |||
626 | /* | 300 | /* |
627 | * Exports an IV from the CipherContext required to export the key | 301 | * Exports an IV from the CipherContext required to export the key |
628 | * state back from the unprivileged child to the privileged parent | 302 | * state back from the unprivileged child to the privileged parent |