usr.sbin/ppp/chap_ms.c

   1 /*-
   2  * Copyright (c) 1997        Gabor Kincses <gabor@acm.org>
   3  *               1997 - 2001 Brian Somers <brian@Awfulhak.org>
   4  *          based on work by Eric Rosenquist
   5  *                           Strata Software Limited.
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  * 1. Redistributions of source code must retain the above copyright
  12  *    notice, this list of conditions and the following disclaimer.
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  27  * SUCH DAMAGE.
  28  *
  29  * $FreeBSD: src/usr.sbin/ppp/chap_ms.c,v 1.9.2.6 2002/09/01 02:12:23 brian Exp $
  30  */
  31
  32 #include <ctype.h>
  33 #include <sys/types.h>
  34 #include <stdlib.h>
  35 #ifdef __DragonFly__
  36 #include <openssl/des.h>
  37 #include <sha.h>
  38 #else
  39 #ifdef __NetBSD__
  40 #include <openssl/des.h>
  41 #else
  42 #include <des.h>
  43 #endif
  44 #include <openssl/sha.h>
  45 #endif
  46 #include <md4.h>
  47 #include <string.h>
  48
  49 #include "chap_ms.h"
  50
  51 /*
  52  * Documentation & specifications:
  53  *
  54  * MS-CHAP (CHAP80)     rfc2433
  55  * MS-CHAP-V2 (CHAP81)  rfc2759
  56  * MPPE key management  draft-ietf-pppext-mppe-keys-02.txt
  57  */
  58
  59 static char SHA1_Pad1[40] =
  60   {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  61    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  62    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  63    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
  64
  65 static char SHA1_Pad2[40] =
  66   {0xF2, 0xF2, 0xF2, 0xF2, 0xF2, 0xF2, 0xF2, 0xF2, 0xF2, 0xF2,
  67    0xF2, 0xF2, 0xF2, 0xF2, 0xF2, 0xF2, 0xF2, 0xF2, 0xF2, 0xF2,
  68    0xF2, 0xF2, 0xF2, 0xF2, 0xF2, 0xF2, 0xF2, 0xF2, 0xF2, 0xF2,
  69    0xF2, 0xF2, 0xF2, 0xF2, 0xF2, 0xF2, 0xF2, 0xF2, 0xF2, 0xF2};
  70
  71 /* unused, for documentation only */
  72 /* only NTResp is filled in for FreeBSD */
  73 struct MS_ChapResponse {
  74     u_char LANManResp[24];
  75     u_char NTResp[24];
  76     u_char UseNT;       /* If 1, ignore the LANMan response field */
  77 };
  78
  79 static u_char
  80 Get7Bits(u_char *input, int startBit)
  81 {
  82     unsigned int word;
  83
  84     word  = (unsigned)input[startBit / 8] << 8;
  85     word |= (unsigned)input[startBit / 8 + 1];
  86
  87     word >>= 15 - (startBit % 8 + 7);
  88
  89     return word & 0xFE;
  90 }
  91
  92 /* IN  56 bit DES key missing parity bits
  93    OUT 64 bit DES key with parity bits added */
  94 static void
  95 MakeKey(u_char *key, u_char *des_key)
  96 {
  97     des_key[0] = Get7Bits(key,  0);
  98     des_key[1] = Get7Bits(key,  7);
  99     des_key[2] = Get7Bits(key, 14);
 100     des_key[3] = Get7Bits(key, 21);
 101     des_key[4] = Get7Bits(key, 28);
 102     des_key[5] = Get7Bits(key, 35);
 103     des_key[6] = Get7Bits(key, 42);
 104     des_key[7] = Get7Bits(key, 49);
 105
 106     DES_set_odd_parity((DES_cblock *)des_key);
 107 }
 108
 109 static void /* IN 8 octets IN 7 octest OUT 8 octets */
 110 DesEncrypt(u_char *clear, u_char *key, u_char *cipher)
 111 {
 112     DES_cblock          des_key;
 113     DES_key_schedule    key_schedule;
 114
 115     MakeKey(key, des_key);
 116     DES_set_key(&des_key, &key_schedule);
 117     DES_ecb_encrypt((DES_cblock *)clear, (DES_cblock *)cipher, &key_schedule, 1);
 118 }
 119
 120 static void      /* IN 8 octets      IN 16 octets     OUT 24 octets */
 121 ChallengeResponse(u_char *challenge, u_char *pwHash, u_char *response)
 122 {
 123     char    ZPasswordHash[21];
 124
 125     memset(ZPasswordHash, '\0', sizeof ZPasswordHash);
 126     memcpy(ZPasswordHash, pwHash, 16);
 127
 128     DesEncrypt(challenge, ZPasswordHash +  0, response + 0);
 129     DesEncrypt(challenge, ZPasswordHash +  7, response + 8);
 130     DesEncrypt(challenge, ZPasswordHash + 14, response + 16);
 131 }
 132
 133 void
 134 NtPasswordHash(char *key, int keylen, char *hash)
 135 {
 136   MD4_CTX MD4context;
 137
 138   MD4Init(&MD4context);
 139   MD4Update(&MD4context, key, keylen);
 140   MD4Final(hash, &MD4context);
 141 }
 142
 143 void
 144 HashNtPasswordHash(char *hash, char *hashhash)
 145 {
 146   MD4_CTX MD4context;
 147
 148   MD4Init(&MD4context);
 149   MD4Update(&MD4context, hash, 16);
 150   MD4Final(hashhash, &MD4context);
 151 }
 152
 153 static void
 154 ChallengeHash(char *PeerChallenge, char *AuthenticatorChallenge,
 155               char *UserName, char *Challenge)
 156 {
 157   SHA_CTX Context;
 158   char Digest[SHA_DIGEST_LENGTH];
 159   char *Name;
 160
 161   Name = strrchr(UserName, '\\');
 162   if(NULL == Name)
 163     Name = UserName;
 164   else
 165     Name++;
 166
 167   SHA1_Init(&Context);
 168
 169   SHA1_Update(&Context, PeerChallenge, 16);
 170   SHA1_Update(&Context, AuthenticatorChallenge, 16);
 171   SHA1_Update(&Context, Name, strlen(Name));
 172
 173   SHA1_Final(Digest, &Context);
 174   memcpy(Challenge, Digest, 8);
 175 }
 176
 177 void
 178 GenerateNTResponse(char *AuthenticatorChallenge, char *PeerChallenge,
 179                    char *UserName, char *Password,
 180                    int PasswordLen, char *Response)
 181 {
 182   char Challenge[8];
 183   char PasswordHash[16];
 184
 185   ChallengeHash(PeerChallenge, AuthenticatorChallenge, UserName, Challenge);
 186   NtPasswordHash(Password, PasswordLen, PasswordHash);
 187   ChallengeResponse(Challenge, PasswordHash, Response);
 188 }
 189
 190 #define LENGTH 20
 191 static char *
 192 SHA1_End(SHA_CTX *ctx, char *buf)
 193 {
 194     int i;
 195     unsigned char digest[LENGTH];
 196     static const char hex[]="0123456789abcdef";
 197
 198     if (!buf)
 199         buf = malloc(2*LENGTH + 1);
 200     if (!buf)
 201         return 0;
 202     SHA1_Final(digest, ctx);
 203     for (i = 0; i < LENGTH; i++) {
 204         buf[i+i] = hex[digest[i] >> 4];
 205         buf[i+i+1] = hex[digest[i] & 0x0f];
 206     }
 207     buf[i+i] = '\0';
 208     return buf;
 209 }
 210
 211 void
 212 GenerateAuthenticatorResponse(char *Password, int PasswordLen,
 213                               char *NTResponse, char *PeerChallenge,
 214                               char *AuthenticatorChallenge, char *UserName,
 215                               char *AuthenticatorResponse)
 216 {
 217   SHA_CTX Context;
 218   char PasswordHash[16];
 219   char PasswordHashHash[16];
 220   char Challenge[8];
 221   u_char Digest[SHA_DIGEST_LENGTH];
 222   int i;
 223
 224       /*
 225        * "Magic" constants used in response generation
 226        */
 227   char Magic1[39] =
 228          {0x4D, 0x61, 0x67, 0x69, 0x63, 0x20, 0x73, 0x65, 0x72, 0x76,
 229           0x65, 0x72, 0x20, 0x74, 0x6F, 0x20, 0x63, 0x6C, 0x69, 0x65,
 230           0x6E, 0x74, 0x20, 0x73, 0x69, 0x67, 0x6E, 0x69, 0x6E, 0x67,
 231           0x20, 0x63, 0x6F, 0x6E, 0x73, 0x74, 0x61, 0x6E, 0x74};
 232
 233
 234   char Magic2[41] =
 235          {0x50, 0x61, 0x64, 0x20, 0x74, 0x6F, 0x20, 0x6D, 0x61, 0x6B,
 236           0x65, 0x20, 0x69, 0x74, 0x20, 0x64, 0x6F, 0x20, 0x6D, 0x6F,
 237           0x72, 0x65, 0x20, 0x74, 0x68, 0x61, 0x6E, 0x20, 0x6F, 0x6E,
 238           0x65, 0x20, 0x69, 0x74, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6F,
 239           0x6E};
 240       /*
 241        * Hash the password with MD4
 242        */
 243   NtPasswordHash(Password, PasswordLen, PasswordHash);
 244       /*
 245        * Now hash the hash
 246        */
 247   HashNtPasswordHash(PasswordHash, PasswordHashHash);
 248
 249   SHA1_Init(&Context);
 250   SHA1_Update(&Context, PasswordHashHash, 16);
 251   SHA1_Update(&Context, NTResponse, 24);
 252   SHA1_Update(&Context, Magic1, 39);
 253   SHA1_Final(Digest, &Context);
 254   ChallengeHash(PeerChallenge, AuthenticatorChallenge, UserName, Challenge);
 255   SHA1_Init(&Context);
 256   SHA1_Update(&Context, Digest, 20);
 257   SHA1_Update(&Context, Challenge, 8);
 258   SHA1_Update(&Context, Magic2, 41);
 259
 260       /*
 261        * Encode the value of 'Digest' as "S=" followed by
 262        * 40 ASCII hexadecimal digits and return it in
 263        * AuthenticatorResponse.
 264        * For example,
 265        *   "S=0123456789ABCDEF0123456789ABCDEF01234567"
 266        */
 267   AuthenticatorResponse[0] = 'S';
 268   AuthenticatorResponse[1] = '=';
 269   SHA1_End(&Context, AuthenticatorResponse + 2);
 270   for (i=2; i<42; i++)
 271     AuthenticatorResponse[i] = toupper(AuthenticatorResponse[i]);
 272
 273 }
 274
 275 void
 276 GetMasterKey(char *PasswordHashHash, char *NTResponse, char *MasterKey)
 277 {
 278   char Digest[SHA_DIGEST_LENGTH];
 279   SHA_CTX Context;
 280   static char Magic1[27] =
 281       {0x54, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74,
 282        0x68, 0x65, 0x20, 0x4d, 0x50, 0x50, 0x45, 0x20, 0x4d,
 283        0x61, 0x73, 0x74, 0x65, 0x72, 0x20, 0x4b, 0x65, 0x79};
 284
 285   SHA1_Init(&Context);
 286   SHA1_Update(&Context, PasswordHashHash, 16);
 287   SHA1_Update(&Context, NTResponse, 24);
 288   SHA1_Update(&Context, Magic1, 27);
 289   SHA1_Final(Digest, &Context);
 290   memcpy(MasterKey, Digest, 16);
 291 }
 292
 293 void
 294 GetAsymetricStartKey(char *MasterKey, char *SessionKey, int SessionKeyLength,
 295                      int IsSend, int IsServer)
 296 {
 297   char Digest[SHA_DIGEST_LENGTH];
 298   SHA_CTX Context;
 299   char *s;
 300
 301   static char Magic2[84] =
 302       {0x4f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x63, 0x6c, 0x69,
 303        0x65, 0x6e, 0x74, 0x20, 0x73, 0x69, 0x64, 0x65, 0x2c, 0x20,
 304        0x74, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68,
 305        0x65, 0x20, 0x73, 0x65, 0x6e, 0x64, 0x20, 0x6b, 0x65, 0x79,
 306        0x3b, 0x20, 0x6f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x73,
 307        0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x73, 0x69, 0x64, 0x65,
 308        0x2c, 0x20, 0x69, 0x74, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68,
 309        0x65, 0x20, 0x72, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x20,
 310        0x6b, 0x65, 0x79, 0x2e};
 311
 312   static char Magic3[84] =
 313       {0x4f, 0x6e, 0x20, 0x74, 0x68, 0x65, 0x20, 0x63, 0x6c, 0x69,
 314        0x65, 0x6e, 0x74, 0x20, 0x73, 0x69, 0x64, 0x65, 0x2c, 0x20,
 315        0x74, 0x68, 0x69, 0x73, 0x20, 0x69, 0x73, 0x20, 0x74, 0x68,
 316        0x65, 0x20, 0x72, 0x65, 0x63, 0x65, 0x69, 0x76, 0x65, 0x20,
 317        0x6b, 0x65, 0x79, 0x3b, 0x20, 0x6f, 0x6e, 0x20, 0x74, 0x68,
 318        0x65, 0x20, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x20, 0x73,
 319        0x69, 0x64, 0x65, 0x2c, 0x20, 0x69, 0x74, 0x20, 0x69, 0x73,
 320        0x20, 0x74, 0x68, 0x65, 0x20, 0x73, 0x65, 0x6e, 0x64, 0x20,
 321        0x6b, 0x65, 0x79, 0x2e};
 322
 323   if (IsSend) {
 324      if (IsServer) {
 325         s = Magic3;
 326      } else {
 327         s = Magic2;
 328      }
 329   } else {
 330      if (IsServer) {
 331         s = Magic2;
 332      } else {
 333         s = Magic3;
 334      }
 335   }
 336
 337   SHA1_Init(&Context);
 338   SHA1_Update(&Context, MasterKey, 16);
 339   SHA1_Update(&Context, SHA1_Pad1, 40);
 340   SHA1_Update(&Context, s, 84);
 341   SHA1_Update(&Context, SHA1_Pad2, 40);
 342   SHA1_Final(Digest, &Context);
 343
 344   memcpy(SessionKey, Digest, SessionKeyLength);
 345 }
 346
 347 void
 348 GetNewKeyFromSHA(char *StartKey, char *SessionKey, long SessionKeyLength,
 349                  char *InterimKey)
 350 {
 351   SHA_CTX Context;
 352   char Digest[SHA_DIGEST_LENGTH];
 353
 354   SHA1_Init(&Context);
 355   SHA1_Update(&Context, StartKey, SessionKeyLength);
 356   SHA1_Update(&Context, SHA1_Pad1, 40);
 357   SHA1_Update(&Context, SessionKey, SessionKeyLength);
 358   SHA1_Update(&Context, SHA1_Pad2, 40);
 359   SHA1_Final(Digest, &Context);
 360
 361   memcpy(InterimKey, Digest, SessionKeyLength);
 362 }
 363
 364 #if 0
 365 static void
 366 Get_Key(char *InitialSessionKey, char *CurrentSessionKey,
 367         int LengthOfDesiredKey)
 368 {
 369   SHA_CTX Context;
 370   char Digest[SHA_DIGEST_LENGTH];
 371
 372   SHA1_Init(&Context);
 373   SHA1_Update(&Context, InitialSessionKey, LengthOfDesiredKey);
 374   SHA1_Update(&Context, SHA1_Pad1, 40);
 375   SHA1_Update(&Context, CurrentSessionKey, LengthOfDesiredKey);
 376   SHA1_Update(&Context, SHA1_Pad2, 40);
 377   SHA1_Final(Digest, &Context);
 378
 379   memcpy(CurrentSessionKey, Digest, LengthOfDesiredKey);
 380 }
 381 #endif
 382
 383 /* passwordHash 16-bytes MD4 hashed password
 384    challenge    8-bytes peer CHAP challenge
 385    since passwordHash is in a 24-byte buffer, response is written in there */
 386 void
 387 mschap_NT(char *passwordHash, char *challenge)
 388 {
 389     u_char response[24];
 390
 391     ChallengeResponse(challenge, passwordHash, response);
 392     memcpy(passwordHash, response, 24);
 393     passwordHash[24] = 1;               /* NT-style response */
 394 }
 395
 396 void
 397 mschap_LANMan(char *digest, char *challenge, char *secret)
 398 {
 399   static u_char salt[] = "KGS!@#$%";    /* RASAPI32.dll */
 400   char SECRET[14], *ptr, *end;
 401   u_char hash[16];
 402
 403   end = SECRET + sizeof SECRET;
 404   for (ptr = SECRET; *secret && ptr < end; ptr++, secret++)
 405     *ptr = toupper(*secret);
 406   if (ptr < end)
 407     memset(ptr, '\0', end - ptr);
 408
 409   DesEncrypt(salt, SECRET, hash);
 410   DesEncrypt(salt, SECRET + 7, hash + 8);
 411
 412   ChallengeResponse(challenge, hash, digest);
 413 }