summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--ChangeLog5
-rw-r--r--Makefile.in5
-rw-r--r--cipher-3des1.c171
-rw-r--r--cipher-aes.c156
-rw-r--r--cipher-bf1.c97
-rw-r--r--cipher.c338
6 files changed, 437 insertions, 335 deletions
diff --git a/ChangeLog b/ChangeLog
index 5243876e8..2e7aeb132 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -22,6 +22,9 @@
22 - jakob@cvs.openbsd.org 2003/05/15 02:27:15 22 - jakob@cvs.openbsd.org 2003/05/15 02:27:15
23 [dns.c] 23 [dns.c]
24 add missing freerrset 24 add missing freerrset
25 - markus@cvs.openbsd.org 2003/05/15 03:08:29
26 [cipher.c cipher-bf1.c cipher-aes.c cipher-3des1.c]
27 split out custom EVP ciphers
25 - (djm) Always parse UsePAM 28 - (djm) Always parse UsePAM
26 - (djm) Configure glue for DNS support (code doesn't work in portable yet) 29 - (djm) Configure glue for DNS support (code doesn't work in portable yet)
27 - (djm) Import getrrsetbyname() function from OpenBSD libc (for DNS support) 30 - (djm) Import getrrsetbyname() function from OpenBSD libc (for DNS support)
@@ -1502,4 +1505,4 @@
1502 save auth method before monitor_reset_key_state(); bugzilla bug #284; 1505 save auth method before monitor_reset_key_state(); bugzilla bug #284;
1503 ok provos@ 1506 ok provos@
1504 1507
1505$Id: ChangeLog,v 1.2710 2003/05/15 03:27:28 djm Exp $ 1508$Id: ChangeLog,v 1.2711 2003/05/15 03:37:19 djm Exp $
diff --git a/Makefile.in b/Makefile.in
index 5758d0dbe..8bdef2031 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -1,4 +1,4 @@
1# $Id: Makefile.in,v 1.234 2003/05/15 03:23:07 djm Exp $ 1# $Id: Makefile.in,v 1.235 2003/05/15 03:37:20 djm Exp $
2 2
3# uncomment if you run a non bourne compatable shell. Ie. csh 3# uncomment if you run a non bourne compatable shell. Ie. csh
4#SHELL = @SH@ 4#SHELL = @SH@
@@ -61,7 +61,8 @@ INSTALL_SSH_RAND_HELPER=@INSTALL_SSH_RAND_HELPER@
61TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-agent$(EXEEXT) scp$(EXEEXT) ssh-rand-helper${EXEEXT} sftp-server$(EXEEXT) sftp$(EXEEXT) 61TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-agent$(EXEEXT) scp$(EXEEXT) ssh-rand-helper${EXEEXT} sftp-server$(EXEEXT) sftp$(EXEEXT)
62 62
63LIBSSH_OBJS=authfd.o authfile.o bufaux.o buffer.o canohost.o channels.o \ 63LIBSSH_OBJS=authfd.o authfile.o bufaux.o buffer.o canohost.o channels.o \
64 cipher.o compat.o compress.o crc32.o deattack.o fatal.o \ 64 cipher.o cipher-aes.o cipher-bf1.o cipher-3des1.o \
65 compat.o compress.o crc32.o deattack.o fatal.o \
65 hostfile.o log.o match.o mpaux.o nchan.o packet.o radix.o \ 66 hostfile.o log.o match.o mpaux.o nchan.o packet.o radix.o \
66 readpass.o rsa.o tildexpand.o ttymodes.o xmalloc.o atomicio.o \ 67 readpass.o rsa.o tildexpand.o ttymodes.o xmalloc.o atomicio.o \
67 key.o dispatch.o kex.o mac.o uuencode.o misc.o \ 68 key.o dispatch.o kex.o mac.o uuencode.o misc.o \
diff --git a/cipher-3des1.c b/cipher-3des1.c
new file mode 100644
index 000000000..f9a352397
--- /dev/null
+++ b/cipher-3des1.c
@@ -0,0 +1,171 @@
1/*
2 * Copyright (c) 2003 Markus Friedl. All rights reserved.
3 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
6 * are met:
7 * 1. Redistributions of source code must retain the above copyright
8 * notice, this list of conditions and the following disclaimer.
9 * 2. Redistributions in binary form must reproduce the above copyright
10 * notice, this list of conditions and the following disclaimer in the
11 * documentation and/or other materials provided with the distribution.
12 *
13 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
14 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
15 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
16 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
17 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
18 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
19 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
20 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
21 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
22 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
23 */
24
25#include "includes.h"
26RCSID("$OpenBSD: cipher-3des1.c,v 1.1 2003/05/15 03:08:29 markus Exp $");
27
28#include <openssl/evp.h>
29#include "xmalloc.h"
30#include "log.h"
31
32/*
33 * This is used by SSH1:
34 *
35 * What kind of triple DES are these 2 routines?
36 *
37 * Why is there a redundant initialization vector?
38 *
39 * If only iv3 was used, then, this would till effect have been
40 * outer-cbc. However, there is also a private iv1 == iv2 which
41 * perhaps makes differential analysis easier. On the other hand, the
42 * private iv1 probably makes the CRC-32 attack ineffective. This is a
43 * result of that there is no longer any known iv1 to use when
44 * choosing the X block.
45 */
46struct ssh1_3des_ctx
47{
48 EVP_CIPHER_CTX k1, k2, k3;
49};
50
51const EVP_CIPHER * evp_ssh1_3des(void);
52void ssh1_3des_iv(EVP_CIPHER_CTX *, int, u_char *, int);
53
54static int
55ssh1_3des_init(EVP_CIPHER_CTX *ctx, const u_char *key, const u_char *iv,
56 int enc)
57{
58 struct ssh1_3des_ctx *c;
59 u_char *k1, *k2, *k3;
60
61 if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) == NULL) {
62 c = xmalloc(sizeof(*c));
63 EVP_CIPHER_CTX_set_app_data(ctx, c);
64 }
65 if (key == NULL)
66 return (1);
67 if (enc == -1)
68 enc = ctx->encrypt;
69 k1 = k2 = k3 = (u_char *) key;
70 k2 += 8;
71 if (EVP_CIPHER_CTX_key_length(ctx) >= 16+8) {
72 if (enc)
73 k3 += 16;
74 else
75 k1 += 16;
76 }
77 EVP_CIPHER_CTX_init(&c->k1);
78 EVP_CIPHER_CTX_init(&c->k2);
79 EVP_CIPHER_CTX_init(&c->k3);
80#ifdef SSH_OLD_EVP
81 EVP_CipherInit(&c->k1, EVP_des_cbc(), k1, NULL, enc);
82 EVP_CipherInit(&c->k2, EVP_des_cbc(), k2, NULL, !enc);
83 EVP_CipherInit(&c->k3, EVP_des_cbc(), k3, NULL, enc);
84#else
85 if (EVP_CipherInit(&c->k1, EVP_des_cbc(), k1, NULL, enc) == 0 ||
86 EVP_CipherInit(&c->k2, EVP_des_cbc(), k2, NULL, !enc) == 0 ||
87 EVP_CipherInit(&c->k3, EVP_des_cbc(), k3, NULL, enc) == 0) {
88 memset(c, 0, sizeof(*c));
89 xfree(c);
90 EVP_CIPHER_CTX_set_app_data(ctx, NULL);
91 return (0);
92 }
93#endif
94 return (1);
95}
96
97static int
98ssh1_3des_cbc(EVP_CIPHER_CTX *ctx, u_char *dest, const u_char *src, u_int len)
99{
100 struct ssh1_3des_ctx *c;
101
102 if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) == NULL) {
103 error("ssh1_3des_cbc: no context");
104 return (0);
105 }
106#ifdef SSH_OLD_EVP
107 EVP_Cipher(&c->k1, dest, (u_char *)src, len);
108 EVP_Cipher(&c->k2, dest, dest, len);
109 EVP_Cipher(&c->k3, dest, dest, len);
110#else
111 if (EVP_Cipher(&c->k1, dest, (u_char *)src, len) == 0 ||
112 EVP_Cipher(&c->k2, dest, dest, len) == 0 ||
113 EVP_Cipher(&c->k3, dest, dest, len) == 0)
114 return (0);
115#endif
116 return (1);
117}
118
119static int
120ssh1_3des_cleanup(EVP_CIPHER_CTX *ctx)
121{
122 struct ssh1_3des_ctx *c;
123
124 if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) != NULL) {
125 memset(c, 0, sizeof(*c));
126 xfree(c);
127 EVP_CIPHER_CTX_set_app_data(ctx, NULL);
128 }
129 return (1);
130}
131
132void
133ssh1_3des_iv(EVP_CIPHER_CTX *evp, int doset, u_char *iv, int len)
134{
135 struct ssh1_3des_ctx *c;
136
137 if (len != 24)
138 fatal("%s: bad 3des iv length: %d", __func__, len);
139 if ((c = EVP_CIPHER_CTX_get_app_data(evp)) == NULL)
140 fatal("%s: no 3des context", __func__);
141 if (doset) {
142 debug3("%s: Installed 3DES IV", __func__);
143 memcpy(c->k1.iv, iv, 8);
144 memcpy(c->k2.iv, iv + 8, 8);
145 memcpy(c->k3.iv, iv + 16, 8);
146 } else {
147 debug3("%s: Copying 3DES IV", __func__);
148 memcpy(iv, c->k1.iv, 8);
149 memcpy(iv + 8, c->k2.iv, 8);
150 memcpy(iv + 16, c->k3.iv, 8);
151 }
152}
153
154const EVP_CIPHER *
155evp_ssh1_3des(void)
156{
157 static EVP_CIPHER ssh1_3des;
158
159 memset(&ssh1_3des, 0, sizeof(EVP_CIPHER));
160 ssh1_3des.nid = NID_undef;
161 ssh1_3des.block_size = 8;
162 ssh1_3des.iv_len = 0;
163 ssh1_3des.key_len = 16;
164 ssh1_3des.init = ssh1_3des_init;
165 ssh1_3des.cleanup = ssh1_3des_cleanup;
166 ssh1_3des.do_cipher = ssh1_3des_cbc;
167#ifndef SSH_OLD_EVP
168 ssh1_3des.flags = EVP_CIPH_CBC_MODE | EVP_CIPH_VARIABLE_LENGTH;
169#endif
170 return (&ssh1_3des);
171}
diff --git a/cipher-aes.c b/cipher-aes.c
new file mode 100644
index 000000000..bbfbe7210
--- /dev/null
+++ b/cipher-aes.c
@@ -0,0 +1,156 @@
1/*
2 * Copyright (c) 2003 Markus Friedl. All rights reserved.
3 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
6 * are met:
7 * 1. Redistributions of source code must retain the above copyright
8 * notice, this list of conditions and the following disclaimer.
9 * 2. Redistributions in binary form must reproduce the above copyright
10 * notice, this list of conditions and the following disclaimer in the
11 * documentation and/or other materials provided with the distribution.
12 *
13 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
14 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
15 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
16 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
17 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
18 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
19 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
20 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
21 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
22 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
23 */
24
25#if OPENSSL_VERSION_NUMBER < 0x00907000L
26#include "includes.h"
27RCSID("$OpenBSD: cipher-aes.c,v 1.1 2003/05/15 03:08:29 markus Exp $");
28
29#include <openssl/evp.h>
30#include "rijndael.h"
31#include "xmalloc.h"
32#include "log.h"
33
34#define RIJNDAEL_BLOCKSIZE 16
35struct ssh_rijndael_ctx
36{
37 rijndael_ctx r_ctx;
38 u_char r_iv[RIJNDAEL_BLOCKSIZE];
39};
40
41const EVP_CIPHER * evp_rijndael(void);
42void ssh_rijndael_iv(EVP_CIPHER_CTX *, int, u_char *, u_int);
43
44static int
45ssh_rijndael_init(EVP_CIPHER_CTX *ctx, const u_char *key, const u_char *iv,
46 int enc)
47{
48 struct ssh_rijndael_ctx *c;
49
50 if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) == NULL) {
51 c = xmalloc(sizeof(*c));
52 EVP_CIPHER_CTX_set_app_data(ctx, c);
53 }
54 if (key != NULL) {
55 if (enc == -1)
56 enc = ctx->encrypt;
57 rijndael_set_key(&c->r_ctx, (u_char *)key,
58 8*EVP_CIPHER_CTX_key_length(ctx), enc);
59 }
60 if (iv != NULL)
61 memcpy(c->r_iv, iv, RIJNDAEL_BLOCKSIZE);
62 return (1);
63}
64
65static int
66ssh_rijndael_cbc(EVP_CIPHER_CTX *ctx, u_char *dest, const u_char *src,
67 u_int len)
68{
69 struct ssh_rijndael_ctx *c;
70 u_char buf[RIJNDAEL_BLOCKSIZE];
71 u_char *cprev, *cnow, *plain, *ivp;
72 int i, j, blocks = len / RIJNDAEL_BLOCKSIZE;
73
74 if (len == 0)
75 return (1);
76 if (len % RIJNDAEL_BLOCKSIZE)
77 fatal("ssh_rijndael_cbc: bad len %d", len);
78 if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) == NULL) {
79 error("ssh_rijndael_cbc: no context");
80 return (0);
81 }
82 if (ctx->encrypt) {
83 cnow = dest;
84 plain = (u_char *)src;
85 cprev = c->r_iv;
86 for (i = 0; i < blocks; i++, plain+=RIJNDAEL_BLOCKSIZE,
87 cnow+=RIJNDAEL_BLOCKSIZE) {
88 for (j = 0; j < RIJNDAEL_BLOCKSIZE; j++)
89 buf[j] = plain[j] ^ cprev[j];
90 rijndael_encrypt(&c->r_ctx, buf, cnow);
91 cprev = cnow;
92 }
93 memcpy(c->r_iv, cprev, RIJNDAEL_BLOCKSIZE);
94 } else {
95 cnow = (u_char *) (src+len-RIJNDAEL_BLOCKSIZE);
96 plain = dest+len-RIJNDAEL_BLOCKSIZE;
97
98 memcpy(buf, cnow, RIJNDAEL_BLOCKSIZE);
99 for (i = blocks; i > 0; i--, cnow-=RIJNDAEL_BLOCKSIZE,
100 plain-=RIJNDAEL_BLOCKSIZE) {
101 rijndael_decrypt(&c->r_ctx, cnow, plain);
102 ivp = (i == 1) ? c->r_iv : cnow-RIJNDAEL_BLOCKSIZE;
103 for (j = 0; j < RIJNDAEL_BLOCKSIZE; j++)
104 plain[j] ^= ivp[j];
105 }
106 memcpy(c->r_iv, buf, RIJNDAEL_BLOCKSIZE);
107 }
108 return (1);
109}
110
111static int
112ssh_rijndael_cleanup(EVP_CIPHER_CTX *ctx)
113{
114 struct ssh_rijndael_ctx *c;
115
116 if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) != NULL) {
117 memset(c, 0, sizeof(*c));
118 xfree(c);
119 EVP_CIPHER_CTX_set_app_data(ctx, NULL);
120 }
121 return (1);
122}
123
124void
125ssh_rijndael_iv(EVP_CIPHER_CTX *evp, int doset, u_char * iv, u_int len)
126{
127 struct ssh_rijndael_ctx *c;
128
129 if ((c = EVP_CIPHER_CTX_get_app_data(evp)) == NULL)
130 fatal("ssh_rijndael_iv: no context");
131 if (doset)
132 memcpy(c->r_iv, iv, len);
133 else
134 memcpy(iv, c->r_iv, len);
135}
136
137const EVP_CIPHER *
138evp_rijndael(void)
139{
140 static EVP_CIPHER rijndal_cbc;
141
142 memset(&rijndal_cbc, 0, sizeof(EVP_CIPHER));
143 rijndal_cbc.nid = NID_undef;
144 rijndal_cbc.block_size = RIJNDAEL_BLOCKSIZE;
145 rijndal_cbc.iv_len = RIJNDAEL_BLOCKSIZE;
146 rijndal_cbc.key_len = 16;
147 rijndal_cbc.init = ssh_rijndael_init;
148 rijndal_cbc.cleanup = ssh_rijndael_cleanup;
149 rijndal_cbc.do_cipher = ssh_rijndael_cbc;
150#ifndef SSH_OLD_EVP
151 rijndal_cbc.flags = EVP_CIPH_CBC_MODE | EVP_CIPH_VARIABLE_LENGTH |
152 EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CUSTOM_IV;
153#endif
154 return (&rijndal_cbc);
155}
156#endif
diff --git a/cipher-bf1.c b/cipher-bf1.c
new file mode 100644
index 000000000..64578bae8
--- /dev/null
+++ b/cipher-bf1.c
@@ -0,0 +1,97 @@
1/*
2 * Copyright (c) 2003 Markus Friedl. All rights reserved.
3 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
6 * are met:
7 * 1. Redistributions of source code must retain the above copyright
8 * notice, this list of conditions and the following disclaimer.
9 * 2. Redistributions in binary form must reproduce the above copyright
10 * notice, this list of conditions and the following disclaimer in the
11 * documentation and/or other materials provided with the distribution.
12 *
13 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
14 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
15 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
16 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
17 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
18 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
19 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
20 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
21 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
22 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
23 */
24
25#include "includes.h"
26RCSID("$OpenBSD: cipher-bf1.c,v 1.1 2003/05/15 03:08:29 markus Exp $");
27
28#include <openssl/evp.h>
29#include "xmalloc.h"
30#include "log.h"
31/*
32 * SSH1 uses a variation on Blowfish, all bytes must be swapped before
33 * and after encryption/decryption. Thus the swap_bytes stuff (yuk).
34 */
35
36const EVP_CIPHER * evp_ssh1_bf(void);
37
38static void
39swap_bytes(const u_char *src, u_char *dst, int n)
40{
41 u_char c[4];
42
43 /* Process 4 bytes every lap. */
44 for (n = n / 4; n > 0; n--) {
45 c[3] = *src++;
46 c[2] = *src++;
47 c[1] = *src++;
48 c[0] = *src++;
49
50 *dst++ = c[0];
51 *dst++ = c[1];
52 *dst++ = c[2];
53 *dst++ = c[3];
54 }
55}
56
57#ifdef SSH_OLD_EVP
58static void bf_ssh1_init (EVP_CIPHER_CTX * ctx, const unsigned char *key,
59 const unsigned char *iv, int enc)
60{
61 if (iv != NULL)
62 memcpy (&(ctx->oiv[0]), iv, 8);
63 memcpy (&(ctx->iv[0]), &(ctx->oiv[0]), 8);
64 if (key != NULL)
65 BF_set_key (&(ctx->c.bf_ks), EVP_CIPHER_CTX_key_length (ctx),
66 key);
67}
68#endif
69
70static int (*orig_bf)(EVP_CIPHER_CTX *, u_char *, const u_char *, u_int) = NULL;
71
72static int
73bf_ssh1_cipher(EVP_CIPHER_CTX *ctx, u_char *out, const u_char *in, u_int len)
74{
75 int ret;
76
77 swap_bytes(in, out, len);
78 ret = (*orig_bf)(ctx, out, out, len);
79 swap_bytes(out, out, len);
80 return (ret);
81}
82
83const EVP_CIPHER *
84evp_ssh1_bf(void)
85{
86 static EVP_CIPHER ssh1_bf;
87
88 memcpy(&ssh1_bf, EVP_bf_cbc(), sizeof(EVP_CIPHER));
89 orig_bf = ssh1_bf.do_cipher;
90 ssh1_bf.nid = NID_undef;
91#ifdef SSH_OLD_EVP
92 ssh1_bf.init = bf_ssh1_init;
93#endif
94 ssh1_bf.do_cipher = bf_ssh1_cipher;
95 ssh1_bf.key_len = 32;
96 return (&ssh1_bf);
97}
diff --git a/cipher.c b/cipher.c
index b6637b645..acb436c8a 100644
--- a/cipher.c
+++ b/cipher.c
@@ -35,7 +35,7 @@
35 */ 35 */
36 36
37#include "includes.h" 37#include "includes.h"
38RCSID("$OpenBSD: cipher.c,v 1.63 2003/04/12 10:13:57 markus Exp $"); 38RCSID("$OpenBSD: cipher.c,v 1.64 2003/05/15 03:08:29 markus Exp $");
39 39
40#include "xmalloc.h" 40#include "xmalloc.h"
41#include "log.h" 41#include "log.h"
@@ -49,11 +49,12 @@ RCSID("$OpenBSD: cipher.c,v 1.63 2003/04/12 10:13:57 markus Exp $");
49#endif 49#endif
50 50
51#if OPENSSL_VERSION_NUMBER < 0x00907000L 51#if OPENSSL_VERSION_NUMBER < 0x00907000L
52#include "rijndael.h" 52extern const EVP_CIPHER *evp_rijndael(void);
53static const EVP_CIPHER *evp_rijndael(void); 53extern void ssh_rijndael_iv(EVP_CIPHER_CTX *, int, u_char *, u_int);
54#endif 54#endif
55static const EVP_CIPHER *evp_ssh1_3des(void); 55extern const EVP_CIPHER *evp_ssh1_bf(void);
56static const EVP_CIPHER *evp_ssh1_bf(void); 56extern const EVP_CIPHER *evp_ssh1_3des(void);
57extern void ssh1_3des_iv(EVP_CIPHER_CTX *, int, u_char *, int);
57 58
58struct Cipher { 59struct Cipher {
59 char *name; 60 char *name;
@@ -296,333 +297,6 @@ cipher_set_key_string(CipherContext *cc, Cipher *cipher,
296 memset(&md, 0, sizeof(md)); 297 memset(&md, 0, sizeof(md));
297} 298}
298 299
299/* Implementations for other non-EVP ciphers */
300
301/*
302 * This is used by SSH1:
303 *
304 * What kind of triple DES are these 2 routines?
305 *
306 * Why is there a redundant initialization vector?
307 *
308 * If only iv3 was used, then, this would till effect have been
309 * outer-cbc. However, there is also a private iv1 == iv2 which
310 * perhaps makes differential analysis easier. On the other hand, the
311 * private iv1 probably makes the CRC-32 attack ineffective. This is a
312 * result of that there is no longer any known iv1 to use when
313 * choosing the X block.
314 */
315struct ssh1_3des_ctx
316{
317 EVP_CIPHER_CTX k1, k2, k3;
318};
319
320static int
321ssh1_3des_init(EVP_CIPHER_CTX *ctx, const u_char *key, const u_char *iv,
322 int enc)
323{
324 struct ssh1_3des_ctx *c;
325 u_char *k1, *k2, *k3;
326
327 if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) == NULL) {
328 c = xmalloc(sizeof(*c));
329 EVP_CIPHER_CTX_set_app_data(ctx, c);
330 }
331 if (key == NULL)
332 return (1);
333 if (enc == -1)
334 enc = ctx->encrypt;
335 k1 = k2 = k3 = (u_char *) key;
336 k2 += 8;
337 if (EVP_CIPHER_CTX_key_length(ctx) >= 16+8) {
338 if (enc)
339 k3 += 16;
340 else
341 k1 += 16;
342 }
343 EVP_CIPHER_CTX_init(&c->k1);
344 EVP_CIPHER_CTX_init(&c->k2);
345 EVP_CIPHER_CTX_init(&c->k3);
346#ifdef SSH_OLD_EVP
347 EVP_CipherInit(&c->k1, EVP_des_cbc(), k1, NULL, enc);
348 EVP_CipherInit(&c->k2, EVP_des_cbc(), k2, NULL, !enc);
349 EVP_CipherInit(&c->k3, EVP_des_cbc(), k3, NULL, enc);
350#else
351 if (EVP_CipherInit(&c->k1, EVP_des_cbc(), k1, NULL, enc) == 0 ||
352 EVP_CipherInit(&c->k2, EVP_des_cbc(), k2, NULL, !enc) == 0 ||
353 EVP_CipherInit(&c->k3, EVP_des_cbc(), k3, NULL, enc) == 0) {
354 memset(c, 0, sizeof(*c));
355 xfree(c);
356 EVP_CIPHER_CTX_set_app_data(ctx, NULL);
357 return (0);
358 }
359#endif
360 return (1);
361}
362
363static int
364ssh1_3des_cbc(EVP_CIPHER_CTX *ctx, u_char *dest, const u_char *src, u_int len)
365{
366 struct ssh1_3des_ctx *c;
367
368 if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) == NULL) {
369 error("ssh1_3des_cbc: no context");
370 return (0);
371 }
372#ifdef SSH_OLD_EVP
373 EVP_Cipher(&c->k1, dest, (u_char *)src, len);
374 EVP_Cipher(&c->k2, dest, dest, len);
375 EVP_Cipher(&c->k3, dest, dest, len);
376#else
377 if (EVP_Cipher(&c->k1, dest, (u_char *)src, len) == 0 ||
378 EVP_Cipher(&c->k2, dest, dest, len) == 0 ||
379 EVP_Cipher(&c->k3, dest, dest, len) == 0)
380 return (0);
381#endif
382 return (1);
383}
384
385static int
386ssh1_3des_cleanup(EVP_CIPHER_CTX *ctx)
387{
388 struct ssh1_3des_ctx *c;
389
390 if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) != NULL) {
391 memset(c, 0, sizeof(*c));
392 xfree(c);
393 EVP_CIPHER_CTX_set_app_data(ctx, NULL);
394 }
395 return (1);
396}
397
398static void
399ssh1_3des_iv(EVP_CIPHER_CTX *evp, int doset, u_char *iv, int len)
400{
401 struct ssh1_3des_ctx *c;
402
403 if (len != 24)
404 fatal("%s: bad 3des iv length: %d", __func__, len);
405 if ((c = EVP_CIPHER_CTX_get_app_data(evp)) == NULL)
406 fatal("%s: no 3des context", __func__);
407 if (doset) {
408 debug3("%s: Installed 3DES IV", __func__);
409 memcpy(c->k1.iv, iv, 8);
410 memcpy(c->k2.iv, iv + 8, 8);
411 memcpy(c->k3.iv, iv + 16, 8);
412 } else {
413 debug3("%s: Copying 3DES IV", __func__);
414 memcpy(iv, c->k1.iv, 8);
415 memcpy(iv + 8, c->k2.iv, 8);
416 memcpy(iv + 16, c->k3.iv, 8);
417 }
418}
419
420static const EVP_CIPHER *
421evp_ssh1_3des(void)
422{
423 static EVP_CIPHER ssh1_3des;
424
425 memset(&ssh1_3des, 0, sizeof(EVP_CIPHER));
426 ssh1_3des.nid = NID_undef;
427 ssh1_3des.block_size = 8;
428 ssh1_3des.iv_len = 0;
429 ssh1_3des.key_len = 16;
430 ssh1_3des.init = ssh1_3des_init;
431 ssh1_3des.cleanup = ssh1_3des_cleanup;
432 ssh1_3des.do_cipher = ssh1_3des_cbc;
433#ifndef SSH_OLD_EVP
434 ssh1_3des.flags = EVP_CIPH_CBC_MODE | EVP_CIPH_VARIABLE_LENGTH;
435#endif
436 return (&ssh1_3des);
437}
438
439/*
440 * SSH1 uses a variation on Blowfish, all bytes must be swapped before
441 * and after encryption/decryption. Thus the swap_bytes stuff (yuk).
442 */
443static void
444swap_bytes(const u_char *src, u_char *dst, int n)
445{
446 u_char c[4];
447
448 /* Process 4 bytes every lap. */
449 for (n = n / 4; n > 0; n--) {
450 c[3] = *src++;
451 c[2] = *src++;
452 c[1] = *src++;
453 c[0] = *src++;
454
455 *dst++ = c[0];
456 *dst++ = c[1];
457 *dst++ = c[2];
458 *dst++ = c[3];
459 }
460}
461
462#ifdef SSH_OLD_EVP
463static void bf_ssh1_init (EVP_CIPHER_CTX * ctx, const unsigned char *key,
464 const unsigned char *iv, int enc)
465{
466 if (iv != NULL)
467 memcpy (&(ctx->oiv[0]), iv, 8);
468 memcpy (&(ctx->iv[0]), &(ctx->oiv[0]), 8);
469 if (key != NULL)
470 BF_set_key (&(ctx->c.bf_ks), EVP_CIPHER_CTX_key_length (ctx),
471 key);
472}
473#endif
474static int (*orig_bf)(EVP_CIPHER_CTX *, u_char *, const u_char *, u_int) = NULL;
475
476static int
477bf_ssh1_cipher(EVP_CIPHER_CTX *ctx, u_char *out, const u_char *in, u_int len)
478{
479 int ret;
480
481 swap_bytes(in, out, len);
482 ret = (*orig_bf)(ctx, out, out, len);
483 swap_bytes(out, out, len);
484 return (ret);
485}
486
487static const EVP_CIPHER *
488evp_ssh1_bf(void)
489{
490 static EVP_CIPHER ssh1_bf;
491
492 memcpy(&ssh1_bf, EVP_bf_cbc(), sizeof(EVP_CIPHER));
493 orig_bf = ssh1_bf.do_cipher;
494 ssh1_bf.nid = NID_undef;
495#ifdef SSH_OLD_EVP
496 ssh1_bf.init = bf_ssh1_init;
497#endif
498 ssh1_bf.do_cipher = bf_ssh1_cipher;
499 ssh1_bf.key_len = 32;
500 return (&ssh1_bf);
501}
502
503#if OPENSSL_VERSION_NUMBER < 0x00907000L
504/* RIJNDAEL */
505#define RIJNDAEL_BLOCKSIZE 16
506struct ssh_rijndael_ctx
507{
508 rijndael_ctx r_ctx;
509 u_char r_iv[RIJNDAEL_BLOCKSIZE];
510};
511
512static int
513ssh_rijndael_init(EVP_CIPHER_CTX *ctx, const u_char *key, const u_char *iv,
514 int enc)
515{
516 struct ssh_rijndael_ctx *c;
517
518 if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) == NULL) {
519 c = xmalloc(sizeof(*c));
520 EVP_CIPHER_CTX_set_app_data(ctx, c);
521 }
522 if (key != NULL) {
523 if (enc == -1)
524 enc = ctx->encrypt;
525 rijndael_set_key(&c->r_ctx, (u_char *)key,
526 8*EVP_CIPHER_CTX_key_length(ctx), enc);
527 }
528 if (iv != NULL)
529 memcpy(c->r_iv, iv, RIJNDAEL_BLOCKSIZE);
530 return (1);
531}
532
533static int
534ssh_rijndael_cbc(EVP_CIPHER_CTX *ctx, u_char *dest, const u_char *src,
535 u_int len)
536{
537 struct ssh_rijndael_ctx *c;
538 u_char buf[RIJNDAEL_BLOCKSIZE];
539 u_char *cprev, *cnow, *plain, *ivp;
540 int i, j, blocks = len / RIJNDAEL_BLOCKSIZE;
541
542 if (len == 0)
543 return (1);
544 if (len % RIJNDAEL_BLOCKSIZE)
545 fatal("ssh_rijndael_cbc: bad len %d", len);
546 if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) == NULL) {
547 error("ssh_rijndael_cbc: no context");
548 return (0);
549 }
550 if (ctx->encrypt) {
551 cnow = dest;
552 plain = (u_char *)src;
553 cprev = c->r_iv;
554 for (i = 0; i < blocks; i++, plain+=RIJNDAEL_BLOCKSIZE,
555 cnow+=RIJNDAEL_BLOCKSIZE) {
556 for (j = 0; j < RIJNDAEL_BLOCKSIZE; j++)
557 buf[j] = plain[j] ^ cprev[j];
558 rijndael_encrypt(&c->r_ctx, buf, cnow);
559 cprev = cnow;
560 }
561 memcpy(c->r_iv, cprev, RIJNDAEL_BLOCKSIZE);
562 } else {
563 cnow = (u_char *) (src+len-RIJNDAEL_BLOCKSIZE);
564 plain = dest+len-RIJNDAEL_BLOCKSIZE;
565
566 memcpy(buf, cnow, RIJNDAEL_BLOCKSIZE);
567 for (i = blocks; i > 0; i--, cnow-=RIJNDAEL_BLOCKSIZE,
568 plain-=RIJNDAEL_BLOCKSIZE) {
569 rijndael_decrypt(&c->r_ctx, cnow, plain);
570 ivp = (i == 1) ? c->r_iv : cnow-RIJNDAEL_BLOCKSIZE;
571 for (j = 0; j < RIJNDAEL_BLOCKSIZE; j++)
572 plain[j] ^= ivp[j];
573 }
574 memcpy(c->r_iv, buf, RIJNDAEL_BLOCKSIZE);
575 }
576 return (1);
577}
578
579static int
580ssh_rijndael_cleanup(EVP_CIPHER_CTX *ctx)
581{
582 struct ssh_rijndael_ctx *c;
583
584 if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) != NULL) {
585 memset(c, 0, sizeof(*c));
586 xfree(c);
587 EVP_CIPHER_CTX_set_app_data(ctx, NULL);
588 }
589 return (1);
590}
591
592static void
593ssh_rijndael_iv(EVP_CIPHER_CTX *evp, int doset, u_char * iv, u_int len)
594{
595 struct ssh_rijndael_ctx *c;
596
597 if ((c = EVP_CIPHER_CTX_get_app_data(evp)) == NULL)
598 fatal("ssh_rijndael_iv: no context");
599 if (doset)
600 memcpy(c->r_iv, iv, len);
601 else
602 memcpy(iv, c->r_iv, len);
603}
604
605static const EVP_CIPHER *
606evp_rijndael(void)
607{
608 static EVP_CIPHER rijndal_cbc;
609
610 memset(&rijndal_cbc, 0, sizeof(EVP_CIPHER));
611 rijndal_cbc.nid = NID_undef;
612 rijndal_cbc.block_size = RIJNDAEL_BLOCKSIZE;
613 rijndal_cbc.iv_len = RIJNDAEL_BLOCKSIZE;
614 rijndal_cbc.key_len = 16;
615 rijndal_cbc.init = ssh_rijndael_init;
616 rijndal_cbc.cleanup = ssh_rijndael_cleanup;
617 rijndal_cbc.do_cipher = ssh_rijndael_cbc;
618#ifndef SSH_OLD_EVP
619 rijndal_cbc.flags = EVP_CIPH_CBC_MODE | EVP_CIPH_VARIABLE_LENGTH |
620 EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CUSTOM_IV;
621#endif
622 return (&rijndal_cbc);
623}
624#endif
625
626/* 300/*
627 * Exports an IV from the CipherContext required to export the key 301 * Exports an IV from the CipherContext required to export the key
628 * state back from the unprivileged child to the privileged parent 302 * state back from the unprivileged child to the privileged parent
generated by cgit v1.2.3 (git 2.39.1) at 2024-07-08 08:22:23 +0000