diff options
Diffstat (limited to 'cipher.c')
-rw-r--r-- | cipher.c | 338 |
1 files changed, 6 insertions, 332 deletions
@@ -35,7 +35,7 @@ | |||
35 | */ | 35 | */ |
36 | 36 | ||
37 | #include "includes.h" | 37 | #include "includes.h" |
38 | RCSID("$OpenBSD: cipher.c,v 1.63 2003/04/12 10:13:57 markus Exp $"); | 38 | RCSID("$OpenBSD: cipher.c,v 1.64 2003/05/15 03:08:29 markus Exp $"); |
39 | 39 | ||
40 | #include "xmalloc.h" | 40 | #include "xmalloc.h" |
41 | #include "log.h" | 41 | #include "log.h" |
@@ -49,11 +49,12 @@ RCSID("$OpenBSD: cipher.c,v 1.63 2003/04/12 10:13:57 markus Exp $"); | |||
49 | #endif | 49 | #endif |
50 | 50 | ||
51 | #if OPENSSL_VERSION_NUMBER < 0x00907000L | 51 | #if OPENSSL_VERSION_NUMBER < 0x00907000L |
52 | #include "rijndael.h" | 52 | extern const EVP_CIPHER *evp_rijndael(void); |
53 | static const EVP_CIPHER *evp_rijndael(void); | 53 | extern void ssh_rijndael_iv(EVP_CIPHER_CTX *, int, u_char *, u_int); |
54 | #endif | 54 | #endif |
55 | static const EVP_CIPHER *evp_ssh1_3des(void); | 55 | extern const EVP_CIPHER *evp_ssh1_bf(void); |
56 | static const EVP_CIPHER *evp_ssh1_bf(void); | 56 | extern const EVP_CIPHER *evp_ssh1_3des(void); |
57 | extern void ssh1_3des_iv(EVP_CIPHER_CTX *, int, u_char *, int); | ||
57 | 58 | ||
58 | struct Cipher { | 59 | struct Cipher { |
59 | char *name; | 60 | char *name; |
@@ -296,333 +297,6 @@ cipher_set_key_string(CipherContext *cc, Cipher *cipher, | |||
296 | memset(&md, 0, sizeof(md)); | 297 | memset(&md, 0, sizeof(md)); |
297 | } | 298 | } |
298 | 299 | ||
299 | /* Implementations for other non-EVP ciphers */ | ||
300 | |||
301 | /* | ||
302 | * This is used by SSH1: | ||
303 | * | ||
304 | * What kind of triple DES are these 2 routines? | ||
305 | * | ||
306 | * Why is there a redundant initialization vector? | ||
307 | * | ||
308 | * If only iv3 was used, then, this would till effect have been | ||
309 | * outer-cbc. However, there is also a private iv1 == iv2 which | ||
310 | * perhaps makes differential analysis easier. On the other hand, the | ||
311 | * private iv1 probably makes the CRC-32 attack ineffective. This is a | ||
312 | * result of that there is no longer any known iv1 to use when | ||
313 | * choosing the X block. | ||
314 | */ | ||
315 | struct ssh1_3des_ctx | ||
316 | { | ||
317 | EVP_CIPHER_CTX k1, k2, k3; | ||
318 | }; | ||
319 | |||
320 | static int | ||
321 | ssh1_3des_init(EVP_CIPHER_CTX *ctx, const u_char *key, const u_char *iv, | ||
322 | int enc) | ||
323 | { | ||
324 | struct ssh1_3des_ctx *c; | ||
325 | u_char *k1, *k2, *k3; | ||
326 | |||
327 | if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) == NULL) { | ||
328 | c = xmalloc(sizeof(*c)); | ||
329 | EVP_CIPHER_CTX_set_app_data(ctx, c); | ||
330 | } | ||
331 | if (key == NULL) | ||
332 | return (1); | ||
333 | if (enc == -1) | ||
334 | enc = ctx->encrypt; | ||
335 | k1 = k2 = k3 = (u_char *) key; | ||
336 | k2 += 8; | ||
337 | if (EVP_CIPHER_CTX_key_length(ctx) >= 16+8) { | ||
338 | if (enc) | ||
339 | k3 += 16; | ||
340 | else | ||
341 | k1 += 16; | ||
342 | } | ||
343 | EVP_CIPHER_CTX_init(&c->k1); | ||
344 | EVP_CIPHER_CTX_init(&c->k2); | ||
345 | EVP_CIPHER_CTX_init(&c->k3); | ||
346 | #ifdef SSH_OLD_EVP | ||
347 | EVP_CipherInit(&c->k1, EVP_des_cbc(), k1, NULL, enc); | ||
348 | EVP_CipherInit(&c->k2, EVP_des_cbc(), k2, NULL, !enc); | ||
349 | EVP_CipherInit(&c->k3, EVP_des_cbc(), k3, NULL, enc); | ||
350 | #else | ||
351 | if (EVP_CipherInit(&c->k1, EVP_des_cbc(), k1, NULL, enc) == 0 || | ||
352 | EVP_CipherInit(&c->k2, EVP_des_cbc(), k2, NULL, !enc) == 0 || | ||
353 | EVP_CipherInit(&c->k3, EVP_des_cbc(), k3, NULL, enc) == 0) { | ||
354 | memset(c, 0, sizeof(*c)); | ||
355 | xfree(c); | ||
356 | EVP_CIPHER_CTX_set_app_data(ctx, NULL); | ||
357 | return (0); | ||
358 | } | ||
359 | #endif | ||
360 | return (1); | ||
361 | } | ||
362 | |||
363 | static int | ||
364 | ssh1_3des_cbc(EVP_CIPHER_CTX *ctx, u_char *dest, const u_char *src, u_int len) | ||
365 | { | ||
366 | struct ssh1_3des_ctx *c; | ||
367 | |||
368 | if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) == NULL) { | ||
369 | error("ssh1_3des_cbc: no context"); | ||
370 | return (0); | ||
371 | } | ||
372 | #ifdef SSH_OLD_EVP | ||
373 | EVP_Cipher(&c->k1, dest, (u_char *)src, len); | ||
374 | EVP_Cipher(&c->k2, dest, dest, len); | ||
375 | EVP_Cipher(&c->k3, dest, dest, len); | ||
376 | #else | ||
377 | if (EVP_Cipher(&c->k1, dest, (u_char *)src, len) == 0 || | ||
378 | EVP_Cipher(&c->k2, dest, dest, len) == 0 || | ||
379 | EVP_Cipher(&c->k3, dest, dest, len) == 0) | ||
380 | return (0); | ||
381 | #endif | ||
382 | return (1); | ||
383 | } | ||
384 | |||
385 | static int | ||
386 | ssh1_3des_cleanup(EVP_CIPHER_CTX *ctx) | ||
387 | { | ||
388 | struct ssh1_3des_ctx *c; | ||
389 | |||
390 | if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) != NULL) { | ||
391 | memset(c, 0, sizeof(*c)); | ||
392 | xfree(c); | ||
393 | EVP_CIPHER_CTX_set_app_data(ctx, NULL); | ||
394 | } | ||
395 | return (1); | ||
396 | } | ||
397 | |||
398 | static void | ||
399 | ssh1_3des_iv(EVP_CIPHER_CTX *evp, int doset, u_char *iv, int len) | ||
400 | { | ||
401 | struct ssh1_3des_ctx *c; | ||
402 | |||
403 | if (len != 24) | ||
404 | fatal("%s: bad 3des iv length: %d", __func__, len); | ||
405 | if ((c = EVP_CIPHER_CTX_get_app_data(evp)) == NULL) | ||
406 | fatal("%s: no 3des context", __func__); | ||
407 | if (doset) { | ||
408 | debug3("%s: Installed 3DES IV", __func__); | ||
409 | memcpy(c->k1.iv, iv, 8); | ||
410 | memcpy(c->k2.iv, iv + 8, 8); | ||
411 | memcpy(c->k3.iv, iv + 16, 8); | ||
412 | } else { | ||
413 | debug3("%s: Copying 3DES IV", __func__); | ||
414 | memcpy(iv, c->k1.iv, 8); | ||
415 | memcpy(iv + 8, c->k2.iv, 8); | ||
416 | memcpy(iv + 16, c->k3.iv, 8); | ||
417 | } | ||
418 | } | ||
419 | |||
420 | static const EVP_CIPHER * | ||
421 | evp_ssh1_3des(void) | ||
422 | { | ||
423 | static EVP_CIPHER ssh1_3des; | ||
424 | |||
425 | memset(&ssh1_3des, 0, sizeof(EVP_CIPHER)); | ||
426 | ssh1_3des.nid = NID_undef; | ||
427 | ssh1_3des.block_size = 8; | ||
428 | ssh1_3des.iv_len = 0; | ||
429 | ssh1_3des.key_len = 16; | ||
430 | ssh1_3des.init = ssh1_3des_init; | ||
431 | ssh1_3des.cleanup = ssh1_3des_cleanup; | ||
432 | ssh1_3des.do_cipher = ssh1_3des_cbc; | ||
433 | #ifndef SSH_OLD_EVP | ||
434 | ssh1_3des.flags = EVP_CIPH_CBC_MODE | EVP_CIPH_VARIABLE_LENGTH; | ||
435 | #endif | ||
436 | return (&ssh1_3des); | ||
437 | } | ||
438 | |||
439 | /* | ||
440 | * SSH1 uses a variation on Blowfish, all bytes must be swapped before | ||
441 | * and after encryption/decryption. Thus the swap_bytes stuff (yuk). | ||
442 | */ | ||
443 | static void | ||
444 | swap_bytes(const u_char *src, u_char *dst, int n) | ||
445 | { | ||
446 | u_char c[4]; | ||
447 | |||
448 | /* Process 4 bytes every lap. */ | ||
449 | for (n = n / 4; n > 0; n--) { | ||
450 | c[3] = *src++; | ||
451 | c[2] = *src++; | ||
452 | c[1] = *src++; | ||
453 | c[0] = *src++; | ||
454 | |||
455 | *dst++ = c[0]; | ||
456 | *dst++ = c[1]; | ||
457 | *dst++ = c[2]; | ||
458 | *dst++ = c[3]; | ||
459 | } | ||
460 | } | ||
461 | |||
462 | #ifdef SSH_OLD_EVP | ||
463 | static void bf_ssh1_init (EVP_CIPHER_CTX * ctx, const unsigned char *key, | ||
464 | const unsigned char *iv, int enc) | ||
465 | { | ||
466 | if (iv != NULL) | ||
467 | memcpy (&(ctx->oiv[0]), iv, 8); | ||
468 | memcpy (&(ctx->iv[0]), &(ctx->oiv[0]), 8); | ||
469 | if (key != NULL) | ||
470 | BF_set_key (&(ctx->c.bf_ks), EVP_CIPHER_CTX_key_length (ctx), | ||
471 | key); | ||
472 | } | ||
473 | #endif | ||
474 | static int (*orig_bf)(EVP_CIPHER_CTX *, u_char *, const u_char *, u_int) = NULL; | ||
475 | |||
476 | static int | ||
477 | bf_ssh1_cipher(EVP_CIPHER_CTX *ctx, u_char *out, const u_char *in, u_int len) | ||
478 | { | ||
479 | int ret; | ||
480 | |||
481 | swap_bytes(in, out, len); | ||
482 | ret = (*orig_bf)(ctx, out, out, len); | ||
483 | swap_bytes(out, out, len); | ||
484 | return (ret); | ||
485 | } | ||
486 | |||
487 | static const EVP_CIPHER * | ||
488 | evp_ssh1_bf(void) | ||
489 | { | ||
490 | static EVP_CIPHER ssh1_bf; | ||
491 | |||
492 | memcpy(&ssh1_bf, EVP_bf_cbc(), sizeof(EVP_CIPHER)); | ||
493 | orig_bf = ssh1_bf.do_cipher; | ||
494 | ssh1_bf.nid = NID_undef; | ||
495 | #ifdef SSH_OLD_EVP | ||
496 | ssh1_bf.init = bf_ssh1_init; | ||
497 | #endif | ||
498 | ssh1_bf.do_cipher = bf_ssh1_cipher; | ||
499 | ssh1_bf.key_len = 32; | ||
500 | return (&ssh1_bf); | ||
501 | } | ||
502 | |||
503 | #if OPENSSL_VERSION_NUMBER < 0x00907000L | ||
504 | /* RIJNDAEL */ | ||
505 | #define RIJNDAEL_BLOCKSIZE 16 | ||
506 | struct ssh_rijndael_ctx | ||
507 | { | ||
508 | rijndael_ctx r_ctx; | ||
509 | u_char r_iv[RIJNDAEL_BLOCKSIZE]; | ||
510 | }; | ||
511 | |||
512 | static int | ||
513 | ssh_rijndael_init(EVP_CIPHER_CTX *ctx, const u_char *key, const u_char *iv, | ||
514 | int enc) | ||
515 | { | ||
516 | struct ssh_rijndael_ctx *c; | ||
517 | |||
518 | if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) == NULL) { | ||
519 | c = xmalloc(sizeof(*c)); | ||
520 | EVP_CIPHER_CTX_set_app_data(ctx, c); | ||
521 | } | ||
522 | if (key != NULL) { | ||
523 | if (enc == -1) | ||
524 | enc = ctx->encrypt; | ||
525 | rijndael_set_key(&c->r_ctx, (u_char *)key, | ||
526 | 8*EVP_CIPHER_CTX_key_length(ctx), enc); | ||
527 | } | ||
528 | if (iv != NULL) | ||
529 | memcpy(c->r_iv, iv, RIJNDAEL_BLOCKSIZE); | ||
530 | return (1); | ||
531 | } | ||
532 | |||
533 | static int | ||
534 | ssh_rijndael_cbc(EVP_CIPHER_CTX *ctx, u_char *dest, const u_char *src, | ||
535 | u_int len) | ||
536 | { | ||
537 | struct ssh_rijndael_ctx *c; | ||
538 | u_char buf[RIJNDAEL_BLOCKSIZE]; | ||
539 | u_char *cprev, *cnow, *plain, *ivp; | ||
540 | int i, j, blocks = len / RIJNDAEL_BLOCKSIZE; | ||
541 | |||
542 | if (len == 0) | ||
543 | return (1); | ||
544 | if (len % RIJNDAEL_BLOCKSIZE) | ||
545 | fatal("ssh_rijndael_cbc: bad len %d", len); | ||
546 | if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) == NULL) { | ||
547 | error("ssh_rijndael_cbc: no context"); | ||
548 | return (0); | ||
549 | } | ||
550 | if (ctx->encrypt) { | ||
551 | cnow = dest; | ||
552 | plain = (u_char *)src; | ||
553 | cprev = c->r_iv; | ||
554 | for (i = 0; i < blocks; i++, plain+=RIJNDAEL_BLOCKSIZE, | ||
555 | cnow+=RIJNDAEL_BLOCKSIZE) { | ||
556 | for (j = 0; j < RIJNDAEL_BLOCKSIZE; j++) | ||
557 | buf[j] = plain[j] ^ cprev[j]; | ||
558 | rijndael_encrypt(&c->r_ctx, buf, cnow); | ||
559 | cprev = cnow; | ||
560 | } | ||
561 | memcpy(c->r_iv, cprev, RIJNDAEL_BLOCKSIZE); | ||
562 | } else { | ||
563 | cnow = (u_char *) (src+len-RIJNDAEL_BLOCKSIZE); | ||
564 | plain = dest+len-RIJNDAEL_BLOCKSIZE; | ||
565 | |||
566 | memcpy(buf, cnow, RIJNDAEL_BLOCKSIZE); | ||
567 | for (i = blocks; i > 0; i--, cnow-=RIJNDAEL_BLOCKSIZE, | ||
568 | plain-=RIJNDAEL_BLOCKSIZE) { | ||
569 | rijndael_decrypt(&c->r_ctx, cnow, plain); | ||
570 | ivp = (i == 1) ? c->r_iv : cnow-RIJNDAEL_BLOCKSIZE; | ||
571 | for (j = 0; j < RIJNDAEL_BLOCKSIZE; j++) | ||
572 | plain[j] ^= ivp[j]; | ||
573 | } | ||
574 | memcpy(c->r_iv, buf, RIJNDAEL_BLOCKSIZE); | ||
575 | } | ||
576 | return (1); | ||
577 | } | ||
578 | |||
579 | static int | ||
580 | ssh_rijndael_cleanup(EVP_CIPHER_CTX *ctx) | ||
581 | { | ||
582 | struct ssh_rijndael_ctx *c; | ||
583 | |||
584 | if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) != NULL) { | ||
585 | memset(c, 0, sizeof(*c)); | ||
586 | xfree(c); | ||
587 | EVP_CIPHER_CTX_set_app_data(ctx, NULL); | ||
588 | } | ||
589 | return (1); | ||
590 | } | ||
591 | |||
592 | static void | ||
593 | ssh_rijndael_iv(EVP_CIPHER_CTX *evp, int doset, u_char * iv, u_int len) | ||
594 | { | ||
595 | struct ssh_rijndael_ctx *c; | ||
596 | |||
597 | if ((c = EVP_CIPHER_CTX_get_app_data(evp)) == NULL) | ||
598 | fatal("ssh_rijndael_iv: no context"); | ||
599 | if (doset) | ||
600 | memcpy(c->r_iv, iv, len); | ||
601 | else | ||
602 | memcpy(iv, c->r_iv, len); | ||
603 | } | ||
604 | |||
605 | static const EVP_CIPHER * | ||
606 | evp_rijndael(void) | ||
607 | { | ||
608 | static EVP_CIPHER rijndal_cbc; | ||
609 | |||
610 | memset(&rijndal_cbc, 0, sizeof(EVP_CIPHER)); | ||
611 | rijndal_cbc.nid = NID_undef; | ||
612 | rijndal_cbc.block_size = RIJNDAEL_BLOCKSIZE; | ||
613 | rijndal_cbc.iv_len = RIJNDAEL_BLOCKSIZE; | ||
614 | rijndal_cbc.key_len = 16; | ||
615 | rijndal_cbc.init = ssh_rijndael_init; | ||
616 | rijndal_cbc.cleanup = ssh_rijndael_cleanup; | ||
617 | rijndal_cbc.do_cipher = ssh_rijndael_cbc; | ||
618 | #ifndef SSH_OLD_EVP | ||
619 | rijndal_cbc.flags = EVP_CIPH_CBC_MODE | EVP_CIPH_VARIABLE_LENGTH | | ||
620 | EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CUSTOM_IV; | ||
621 | #endif | ||
622 | return (&rijndal_cbc); | ||
623 | } | ||
624 | #endif | ||
625 | |||
626 | /* | 300 | /* |
627 | * Exports an IV from the CipherContext required to export the key | 301 | * Exports an IV from the CipherContext required to export the key |
628 | * state back from the unprivileged child to the privileged parent | 302 | * state back from the unprivileged child to the privileged parent |