?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Switch more cases to EVP crypto layer
[heimdal.git] / lib / krb5 / crypto.c
blobc22e214f063dbfe7c223c38d4d60b60222860394
1 /*
2 * Copyright (c) 1997 - 2008 Kungliga Tekniska Högskolan
3 * (Royal Institute of Technology, Stockholm, Sweden).
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 *
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 *
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 *
17 * 3. Neither the name of the Institute nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
32 */
33
34 #define KRB5_DEPRECATED
35
36 #include "krb5_locl.h"
37 #include <pkinit_asn1.h>
38
39 #define WEAK_ENCTYPES 1
40
41 #ifndef HEIMDAL_SMALLER
42 #define DES3_OLD_ENCTYPE 1
43 #endif
44
45
46 #ifdef HAVE_OPENSSL /* XXX forward decl for hcrypto glue */
47 const EVP_CIPHER * _krb5_EVP_hcrypto_aes_128_cts(void);
48 const EVP_CIPHER * _krb5_EVP_hcrypto_aes_256_cts(void);
49 #define EVP_hcrypto_aes_128_cts _krb5_EVP_hcrypto_aes_128_cts
50 #define EVP_hcrypto_aes_256_cts _krb5_EVP_hcrypto_aes_256_cts
51 #endif
52
53 struct key_data {
54 krb5_keyblock *key;
55 krb5_data *schedule;
56 };
57
58 struct key_usage {
59 unsigned usage;
60 struct key_data key;
61 };
62
63 struct krb5_crypto_data {
64 struct encryption_type *et;
65 struct key_data key;
66 int num_key_usage;
67 struct key_usage *key_usage;
68 };
69
70 #define CRYPTO_ETYPE(C) ((C)->et->type)
71
72 /* bits for `flags' below */
73 #define F_KEYED 1 /* checksum is keyed */
74 #define F_CPROOF 2 /* checksum is collision proof */
75 #define F_DERIVED 4 /* uses derived keys */
76 #define F_VARIANT 8 /* uses `variant' keys (6.4.3) */
77 #define F_PSEUDO 16 /* not a real protocol type */
78 #define F_SPECIAL 32 /* backwards */
79 #define F_DISABLED 64 /* enctype/checksum disabled */
80
81 struct salt_type {
82 krb5_salttype type;
83 const char *name;
84 krb5_error_code (*string_to_key)(krb5_context, krb5_enctype, krb5_data,
85 krb5_salt, krb5_data, krb5_keyblock*);
86 };
87
88 struct key_type {
89 krb5_keytype type; /* XXX */
90 const char *name;
91 size_t bits;
92 size_t size;
93 size_t schedule_size;
94 void (*random_key)(krb5_context, krb5_keyblock*);
95 void (*schedule)(krb5_context, struct key_type *, struct key_data *);
96 struct salt_type *string_to_key;
97 void (*random_to_key)(krb5_context, krb5_keyblock*, const void*, size_t);
98 void (*cleanup)(krb5_context, struct key_data *);
99 const EVP_CIPHER *(*evp)(void);
100 };
101
102 struct checksum_type {
103 krb5_cksumtype type;
104 const char *name;
105 size_t blocksize;
106 size_t checksumsize;
107 unsigned flags;
108 krb5_enctype (*checksum)(krb5_context context,
109 struct key_data *key,
110 const void *buf, size_t len,
111 unsigned usage,
112 Checksum *csum);
113 krb5_error_code (*verify)(krb5_context context,
114 struct key_data *key,
115 const void *buf, size_t len,
116 unsigned usage,
117 Checksum *csum);
118 };
119
120 struct encryption_type {
121 krb5_enctype type;
122 const char *name;
123 size_t blocksize;
124 size_t padsize;
125 size_t confoundersize;
126 struct key_type *keytype;
127 struct checksum_type *checksum;
128 struct checksum_type *keyed_checksum;
129 unsigned flags;
130 krb5_error_code (*encrypt)(krb5_context context,
131 struct key_data *key,
132 void *data, size_t len,
133 krb5_boolean encryptp,
134 int usage,
135 void *ivec);
136 size_t prf_length;
137 krb5_error_code (*prf)(krb5_context,
138 krb5_crypto, const krb5_data *, krb5_data *);
139 };
140
141 #define ENCRYPTION_USAGE(U) (((U) << 8) | 0xAA)
142 #define INTEGRITY_USAGE(U) (((U) << 8) | 0x55)
143 #define CHECKSUM_USAGE(U) (((U) << 8) | 0x99)
144
145 static struct checksum_type *_find_checksum(krb5_cksumtype type);
146 static struct encryption_type *_find_enctype(krb5_enctype type);
147 static krb5_error_code _get_derived_key(krb5_context, krb5_crypto,
148 unsigned, struct key_data**);
149 static struct key_data *_new_derived_key(krb5_crypto crypto, unsigned usage);
150 static krb5_error_code derive_key(krb5_context context,
151 struct encryption_type *et,
152 struct key_data *key,
153 const void *constant,
154 size_t len);
155 static krb5_error_code hmac(krb5_context context,
156 struct checksum_type *cm,
157 const void *data,
158 size_t len,
159 unsigned usage,
160 struct key_data *keyblock,
161 Checksum *result);
162 static void free_key_data(krb5_context,
163 struct key_data *,
164 struct encryption_type *);
165 static void free_key_schedule(krb5_context,
166 struct key_data *,
167 struct encryption_type *);
168 static krb5_error_code usage2arcfour (krb5_context, unsigned *);
169 static void xor (DES_cblock *, const unsigned char *);
170
171 /************************************************************
172 * *
173 ************************************************************/
174
175 struct evp_schedule {
176 EVP_CIPHER_CTX ectx;
177 EVP_CIPHER_CTX dctx;
178 };
179
180
181 static HEIMDAL_MUTEX crypto_mutex = HEIMDAL_MUTEX_INITIALIZER;
182
183 #ifdef WEAK_ENCTYPES
184 static void
185 krb5_DES_random_key(krb5_context context,
186 krb5_keyblock *key)
187 {
188 DES_cblock *k = key->keyvalue.data;
189 do {
190 krb5_generate_random_block(k, sizeof(DES_cblock));
191 DES_set_odd_parity(k);
192 } while(DES_is_weak_key(k));
193 }
194
195 static void
196 krb5_DES_schedule_old(krb5_context context,
197 struct key_type *kt,
198 struct key_data *key)
199 {
200 DES_set_key_unchecked(key->key->keyvalue.data, key->schedule->data);
201 }
202
203 #ifdef ENABLE_AFS_STRING_TO_KEY
204
205 /* This defines the Andrew string_to_key function. It accepts a password
206 * string as input and converts it via a one-way encryption algorithm to a DES
207 * encryption key. It is compatible with the original Andrew authentication
208 * service password database.
209 */
210
211 /*
212 * Short passwords, i.e 8 characters or less.
213 */
214 static void
215 krb5_DES_AFS3_CMU_string_to_key (krb5_data pw,
216 krb5_data cell,
217 DES_cblock *key)
218 {
219 char password[8+1]; /* crypt is limited to 8 chars anyway */
220 int i;
221
222 for(i = 0; i < 8; i++) {
223 char c = ((i < pw.length) ? ((char*)pw.data)[i] : 0) ^
224 ((i < cell.length) ?
225 tolower(((unsigned char*)cell.data)[i]) : 0);
226 password[i] = c ? c : 'X';
227 }
228 password[8] = '\0';
229
230 memcpy(key, crypt(password, "p1") + 2, sizeof(DES_cblock));
231
232 /* parity is inserted into the LSB so left shift each byte up one
233 bit. This allows ascii characters with a zero MSB to retain as
234 much significance as possible. */
235 for (i = 0; i < sizeof(DES_cblock); i++)
236 ((unsigned char*)key)[i] <<= 1;
237 DES_set_odd_parity (key);
238 }
239
240 /*
241 * Long passwords, i.e 9 characters or more.
242 */
243 static void
244 krb5_DES_AFS3_Transarc_string_to_key (krb5_data pw,
245 krb5_data cell,
246 DES_cblock *key)
247 {
248 DES_key_schedule schedule;
249 DES_cblock temp_key;
250 DES_cblock ivec;
251 char password[512];
252 size_t passlen;
253
254 memcpy(password, pw.data, min(pw.length, sizeof(password)));
255 if(pw.length < sizeof(password)) {
256 int len = min(cell.length, sizeof(password) - pw.length);
257 int i;
258
259 memcpy(password + pw.length, cell.data, len);
260 for (i = pw.length; i < pw.length + len; ++i)
261 password[i] = tolower((unsigned char)password[i]);
262 }
263 passlen = min(sizeof(password), pw.length + cell.length);
264 memcpy(&ivec, "kerberos", 8);
265 memcpy(&temp_key, "kerberos", 8);
266 DES_set_odd_parity (&temp_key);
267 DES_set_key_unchecked (&temp_key, &schedule);
268 DES_cbc_cksum ((void*)password, &ivec, passlen, &schedule, &ivec);
269
270 memcpy(&temp_key, &ivec, 8);
271 DES_set_odd_parity (&temp_key);
272 DES_set_key_unchecked (&temp_key, &schedule);
273 DES_cbc_cksum ((void*)password, key, passlen, &schedule, &ivec);
274 memset(&schedule, 0, sizeof(schedule));
275 memset(&temp_key, 0, sizeof(temp_key));
276 memset(&ivec, 0, sizeof(ivec));
277 memset(password, 0, sizeof(password));
278
279 DES_set_odd_parity (key);
280 }
281
282 static krb5_error_code
283 DES_AFS3_string_to_key(krb5_context context,
284 krb5_enctype enctype,
285 krb5_data password,
286 krb5_salt salt,
287 krb5_data opaque,
288 krb5_keyblock *key)
289 {
290 DES_cblock tmp;
291 if(password.length > 8)
292 krb5_DES_AFS3_Transarc_string_to_key(password, salt.saltvalue, &tmp);
293 else
294 krb5_DES_AFS3_CMU_string_to_key(password, salt.saltvalue, &tmp);
295 key->keytype = enctype;
296 krb5_data_copy(&key->keyvalue, tmp, sizeof(tmp));
297 memset(&key, 0, sizeof(key));
298 return 0;
299 }
300 #endif /* ENABLE_AFS_STRING_TO_KEY */
301
302 static void
303 DES_string_to_key_int(unsigned char *data, size_t length, DES_cblock *key)
304 {
305 DES_key_schedule schedule;
306 int i;
307 int reverse = 0;
308 unsigned char *p;
309
310 unsigned char swap[] = { 0x0, 0x8, 0x4, 0xc, 0x2, 0xa, 0x6, 0xe,
311 0x1, 0x9, 0x5, 0xd, 0x3, 0xb, 0x7, 0xf };
312 memset(key, 0, 8);
313
314 p = (unsigned char*)key;
315 for (i = 0; i < length; i++) {
316 unsigned char tmp = data[i];
317 if (!reverse)
318 *p++ ^= (tmp << 1);
319 else
320 *--p ^= (swap[tmp & 0xf] << 4) | swap[(tmp & 0xf0) >> 4];
321 if((i % 8) == 7)
322 reverse = !reverse;
323 }
324 DES_set_odd_parity(key);
325 if(DES_is_weak_key(key))
326 (*key)[7] ^= 0xF0;
327 DES_set_key_unchecked(key, &schedule);
328 DES_cbc_cksum((void*)data, key, length, &schedule, key);
329 memset(&schedule, 0, sizeof(schedule));
330 DES_set_odd_parity(key);
331 if(DES_is_weak_key(key))
332 (*key)[7] ^= 0xF0;
333 }
334
335 static krb5_error_code
336 krb5_DES_string_to_key(krb5_context context,
337 krb5_enctype enctype,
338 krb5_data password,
339 krb5_salt salt,
340 krb5_data opaque,
341 krb5_keyblock *key)
342 {
343 unsigned char *s;
344 size_t len;
345 DES_cblock tmp;
346
347 #ifdef ENABLE_AFS_STRING_TO_KEY
348 if (opaque.length == 1) {
349 unsigned long v;
350 _krb5_get_int(opaque.data, &v, 1);
351 if (v == 1)
352 return DES_AFS3_string_to_key(context, enctype, password,
353 salt, opaque, key);
354 }
355 #endif
356
357 len = password.length + salt.saltvalue.length;
358 s = malloc(len);
359 if(len > 0 && s == NULL) {
360 krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
361 return ENOMEM;
362 }
363 memcpy(s, password.data, password.length);
364 memcpy(s + password.length, salt.saltvalue.data, salt.saltvalue.length);
365 DES_string_to_key_int(s, len, &tmp);
366 key->keytype = enctype;
367 krb5_data_copy(&key->keyvalue, tmp, sizeof(tmp));
368 memset(&tmp, 0, sizeof(tmp));
369 memset(s, 0, len);
370 free(s);
371 return 0;
372 }
373
374 static void
375 krb5_DES_random_to_key(krb5_context context,
376 krb5_keyblock *key,
377 const void *data,
378 size_t size)
379 {
380 DES_cblock *k = key->keyvalue.data;
381 memcpy(k, data, key->keyvalue.length);
382 DES_set_odd_parity(k);
383 if(DES_is_weak_key(k))
384 xor(k, (const unsigned char*)"\0\0\0\0\0\0\0\xf0");
385 }
386 #endif
387
388 /*
389 *
390 */
391
392 static void
393 DES3_random_key(krb5_context context,
394 krb5_keyblock *key)
395 {
396 DES_cblock *k = key->keyvalue.data;
397 do {
398 krb5_generate_random_block(k, 3 * sizeof(DES_cblock));
399 DES_set_odd_parity(&k[0]);
400 DES_set_odd_parity(&k[1]);
401 DES_set_odd_parity(&k[2]);
402 } while(DES_is_weak_key(&k[0]) ||
403 DES_is_weak_key(&k[1]) ||
404 DES_is_weak_key(&k[2]));
405 }
406
407 /*
408 * A = A xor B. A & B are 8 bytes.
409 */
410
411 static void
412 xor (DES_cblock *key, const unsigned char *b)
413 {
414 unsigned char *a = (unsigned char*)key;
415 a[0] ^= b[0];
416 a[1] ^= b[1];
417 a[2] ^= b[2];
418 a[3] ^= b[3];
419 a[4] ^= b[4];
420 a[5] ^= b[5];
421 a[6] ^= b[6];
422 a[7] ^= b[7];
423 }
424
425 #ifdef DES3_OLD_ENCTYPE
426 static krb5_error_code
427 DES3_string_to_key(krb5_context context,
428 krb5_enctype enctype,
429 krb5_data password,
430 krb5_salt salt,
431 krb5_data opaque,
432 krb5_keyblock *key)
433 {
434 char *str;
435 size_t len;
436 unsigned char tmp[24];
437 DES_cblock keys[3];
438 krb5_error_code ret;
439
440 len = password.length + salt.saltvalue.length;
441 str = malloc(len);
442 if(len != 0 && str == NULL) {
443 krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
444 return ENOMEM;
445 }
446 memcpy(str, password.data, password.length);
447 memcpy(str + password.length, salt.saltvalue.data, salt.saltvalue.length);
448 {
449 DES_cblock ivec;
450 DES_key_schedule s[3];
451 int i;
452
453 ret = _krb5_n_fold(str, len, tmp, 24);
454 if (ret) {
455 memset(str, 0, len);
456 free(str);
457 krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
458 return ret;
459 }
460
461 for(i = 0; i < 3; i++){
462 memcpy(keys + i, tmp + i * 8, sizeof(keys[i]));
463 DES_set_odd_parity(keys + i);
464 if(DES_is_weak_key(keys + i))
465 xor(keys + i, (const unsigned char*)"\0\0\0\0\0\0\0\xf0");
466 DES_set_key_unchecked(keys + i, &s[i]);
467 }
468 memset(&ivec, 0, sizeof(ivec));
469 DES_ede3_cbc_encrypt(tmp,
470 tmp, sizeof(tmp),
471 &s[0], &s[1], &s[2], &ivec, DES_ENCRYPT);
472 memset(s, 0, sizeof(s));
473 memset(&ivec, 0, sizeof(ivec));
474 for(i = 0; i < 3; i++){
475 memcpy(keys + i, tmp + i * 8, sizeof(keys[i]));
476 DES_set_odd_parity(keys + i);
477 if(DES_is_weak_key(keys + i))
478 xor(keys + i, (const unsigned char*)"\0\0\0\0\0\0\0\xf0");
479 }
480 memset(tmp, 0, sizeof(tmp));
481 }
482 key->keytype = enctype;
483 krb5_data_copy(&key->keyvalue, keys, sizeof(keys));
484 memset(keys, 0, sizeof(keys));
485 memset(str, 0, len);
486 free(str);
487 return 0;
488 }
489 #endif
490
491 static krb5_error_code
492 DES3_string_to_key_derived(krb5_context context,
493 krb5_enctype enctype,
494 krb5_data password,
495 krb5_salt salt,
496 krb5_data opaque,
497 krb5_keyblock *key)
498 {
499 krb5_error_code ret;
500 size_t len = password.length + salt.saltvalue.length;
501 char *s;
502
503 s = malloc(len);
504 if(len != 0 && s == NULL) {
505 krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
506 return ENOMEM;
507 }
508 memcpy(s, password.data, password.length);
509 memcpy(s + password.length, salt.saltvalue.data, salt.saltvalue.length);
510 ret = krb5_string_to_key_derived(context,
511 s,
512 len,
513 enctype,
514 key);
515 memset(s, 0, len);
516 free(s);
517 return ret;
518 }
519
520 static void
521 DES3_random_to_key(krb5_context context,
522 krb5_keyblock *key,
523 const void *data,
524 size_t size)
525 {
526 unsigned char *x = key->keyvalue.data;
527 const u_char *q = data;
528 DES_cblock *k;
529 int i, j;
530
531 memset(x, 0, sizeof(x));
532 for (i = 0; i < 3; ++i) {
533 unsigned char foo;
534 for (j = 0; j < 7; ++j) {
535 unsigned char b = q[7 * i + j];
536
537 x[8 * i + j] = b;
538 }
539 foo = 0;
540 for (j = 6; j >= 0; --j) {
541 foo |= q[7 * i + j] & 1;
542 foo <<= 1;
543 }
544 x[8 * i + 7] = foo;
545 }
546 k = key->keyvalue.data;
547 for (i = 0; i < 3; i++) {
548 DES_set_odd_parity(&k[i]);
549 if(DES_is_weak_key(&k[i]))
550 xor(&k[i], (const unsigned char*)"\0\0\0\0\0\0\0\xf0");
551 }
552 }
553
554 /*
555 * ARCFOUR
556 */
557
558 static krb5_error_code
559 ARCFOUR_string_to_key(krb5_context context,
560 krb5_enctype enctype,
561 krb5_data password,
562 krb5_salt salt,
563 krb5_data opaque,
564 krb5_keyblock *key)
565 {
566 krb5_error_code ret;
567 uint16_t *s = NULL;
568 size_t len, i;
569 EVP_MD_CTX *m;
570
571 m = EVP_MD_CTX_create();
572 if (m == NULL) {
573 ret = ENOMEM;
574 krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
575 goto out;
576 }
577
578 EVP_DigestInit_ex(m, EVP_md4(), NULL);
579
580 ret = wind_utf8ucs2_length(password.data, &len);
581 if (ret) {
582 krb5_set_error_message (context, ret,
583 N_("Password not an UCS2 string", ""));
584 goto out;
585 }
586
587 s = malloc (len * sizeof(s[0]));
588 if (len != 0 && s == NULL) {
589 krb5_set_error_message (context, ENOMEM,
590 N_("malloc: out of memory", ""));
591 ret = ENOMEM;
592 goto out;
593 }
594
595 ret = wind_utf8ucs2(password.data, s, &len);
596 if (ret) {
597 krb5_set_error_message (context, ret,
598 N_("Password not an UCS2 string", ""));
599 goto out;
600 }
601
602 /* LE encoding */
603 for (i = 0; i < len; i++) {
604 unsigned char p;
605 p = (s[i] & 0xff);
606 EVP_DigestUpdate (m, &p, 1);
607 p = (s[i] >> 8) & 0xff;
608 EVP_DigestUpdate (m, &p, 1);
609 }
610
611 key->keytype = enctype;
612 ret = krb5_data_alloc (&key->keyvalue, 16);
613 if (ret) {
614 krb5_set_error_message (context, ENOMEM, N_("malloc: out of memory", ""));
615 goto out;
616 }
617 EVP_DigestFinal_ex (m, key->keyvalue.data, NULL);
618
619 out:
620 EVP_MD_CTX_destroy(m);
621 if (s)
622 memset (s, 0, len);
623 free (s);
624 return ret;
625 }
626
627 /*
628 * AES
629 */
630
631 int _krb5_AES_string_to_default_iterator = 4096;
632
633 static krb5_error_code
634 AES_string_to_key(krb5_context context,
635 krb5_enctype enctype,
636 krb5_data password,
637 krb5_salt salt,
638 krb5_data opaque,
639 krb5_keyblock *key)
640 {
641 krb5_error_code ret;
642 uint32_t iter;
643 struct encryption_type *et;
644 struct key_data kd;
645
646 if (opaque.length == 0)
647 iter = _krb5_AES_string_to_default_iterator;
648 else if (opaque.length == 4) {
649 unsigned long v;
650 _krb5_get_int(opaque.data, &v, 4);
651 iter = ((uint32_t)v);
652 } else
653 return KRB5_PROG_KEYTYPE_NOSUPP; /* XXX */
654
655 et = _find_enctype(enctype);
656 if (et == NULL)
657 return KRB5_PROG_KEYTYPE_NOSUPP;
658
659 kd.schedule = NULL;
660 ALLOC(kd.key, 1);
661 if(kd.key == NULL) {
662 krb5_set_error_message (context, ENOMEM, N_("malloc: out of memory", ""));
663 return ENOMEM;
664 }
665 kd.key->keytype = enctype;
666 ret = krb5_data_alloc(&kd.key->keyvalue, et->keytype->size);
667 if (ret) {
668 krb5_set_error_message (context, ret, N_("malloc: out of memory", ""));
669 return ret;
670 }
671
672 ret = PKCS5_PBKDF2_HMAC_SHA1(password.data, password.length,
673 salt.saltvalue.data, salt.saltvalue.length,
674 iter,
675 et->keytype->size, kd.key->keyvalue.data);
676 if (ret != 1) {
677 free_key_data(context, &kd, et);
678 krb5_set_error_message(context, KRB5_PROG_KEYTYPE_NOSUPP,
679 "Error calculating s2k");
680 return KRB5_PROG_KEYTYPE_NOSUPP;
681 }
682
683 ret = derive_key(context, et, &kd, "kerberos", strlen("kerberos"));
684 if (ret == 0)
685 ret = krb5_copy_keyblock_contents(context, kd.key, key);
686 free_key_data(context, &kd, et);
687
688 return ret;
689 }
690
691 static void
692 evp_schedule(krb5_context context, struct key_type *kt, struct key_data *kd)
693 {
694 struct evp_schedule *key = kd->schedule->data;
695 const EVP_CIPHER *c = (*kt->evp)();
696
697 EVP_CIPHER_CTX_init(&key->ectx);
698 EVP_CIPHER_CTX_init(&key->dctx);
699
700 EVP_CipherInit_ex(&key->ectx, c, NULL, kd->key->keyvalue.data, NULL, 1);
701 EVP_CipherInit_ex(&key->dctx, c, NULL, kd->key->keyvalue.data, NULL, 0);
702 }
703
704 static void
705 evp_cleanup(krb5_context context, struct key_data *kd)
706 {
707 struct evp_schedule *key = kd->schedule->data;
708 EVP_CIPHER_CTX_cleanup(&key->ectx);
709 EVP_CIPHER_CTX_cleanup(&key->dctx);
710 }
711
712 /*
713 *
714 */
715
716 #ifdef WEAK_ENCTYPES
717 static struct salt_type des_salt[] = {
718 {
719 KRB5_PW_SALT,
720 "pw-salt",
721 krb5_DES_string_to_key
722 },
723 #ifdef ENABLE_AFS_STRING_TO_KEY
724 {
725 KRB5_AFS3_SALT,
726 "afs3-salt",
727 DES_AFS3_string_to_key
728 },
729 #endif
730 { 0 }
731 };
732 #endif
733
734 #ifdef DES3_OLD_ENCTYPE
735 static struct salt_type des3_salt[] = {
736 {
737 KRB5_PW_SALT,
738 "pw-salt",
739 DES3_string_to_key
740 },
741 { 0 }
742 };
743 #endif
744
745 static struct salt_type des3_salt_derived[] = {
746 {
747 KRB5_PW_SALT,
748 "pw-salt",
749 DES3_string_to_key_derived
750 },
751 { 0 }
752 };
753
754 static struct salt_type AES_salt[] = {
755 {
756 KRB5_PW_SALT,
757 "pw-salt",
758 AES_string_to_key
759 },
760 { 0 }
761 };
762
763 static struct salt_type arcfour_salt[] = {
764 {
765 KRB5_PW_SALT,
766 "pw-salt",
767 ARCFOUR_string_to_key
768 },
769 { 0 }
770 };
771
772 /*
773 *
774 */
775
776 static struct key_type keytype_null = {
777 KEYTYPE_NULL,
778 "null",
779 0,
780 0,
781 0,
782 NULL,
783 NULL,
784 NULL
785 };
786
787 #ifdef WEAK_ENCTYPES
788 static struct key_type keytype_des_old = {
789 KEYTYPE_DES,
790 "des-old",
791 56,
792 8,
793 sizeof(DES_key_schedule),
794 krb5_DES_random_key,
795 krb5_DES_schedule_old,
796 des_salt,
797 krb5_DES_random_to_key
798 };
799
800 static struct key_type keytype_des = {
801 KEYTYPE_DES,
802 "des",
803 56,
804 8,
805 sizeof(struct evp_schedule),
806 krb5_DES_random_key,
807 evp_schedule,
808 des_salt,
809 krb5_DES_random_to_key,
810 evp_cleanup,
811 EVP_des_cbc
812 };
813 #endif /* WEAK_ENCTYPES */
814
815 #ifdef DES3_OLD_ENCTYPE
816 static struct key_type keytype_des3 = {
817 KEYTYPE_DES3,
818 "des3",
819 168,
820 24,
821 sizeof(struct evp_schedule),
822 DES3_random_key,
823 evp_schedule,
824 des3_salt,
825 DES3_random_to_key,
826 evp_cleanup,
827 EVP_des_ede3_cbc
828 };
829 #endif
830
831 static struct key_type keytype_des3_derived = {
832 KEYTYPE_DES3,
833 "des3",
834 168,
835 24,
836 sizeof(struct evp_schedule),
837 DES3_random_key,
838 evp_schedule,
839 des3_salt_derived,
840 DES3_random_to_key,
841 evp_cleanup,
842 EVP_des_ede3_cbc
843 };
844
845 static struct key_type keytype_aes128 = {
846 KEYTYPE_AES128,
847 "aes-128",
848 128,
849 16,
850 sizeof(struct evp_schedule),
851 NULL,
852 evp_schedule,
853 AES_salt,
854 NULL,
855 evp_cleanup,
856 EVP_hcrypto_aes_128_cts
857 };
858
859 static struct key_type keytype_aes256 = {
860 KEYTYPE_AES256,
861 "aes-256",
862 256,
863 32,
864 sizeof(struct evp_schedule),
865 NULL,
866 evp_schedule,
867 AES_salt,
868 NULL,
869 evp_cleanup,
870 EVP_hcrypto_aes_256_cts
871 };
872
873 static struct key_type keytype_arcfour = {
874 KEYTYPE_ARCFOUR,
875 "arcfour",
876 128,
877 16,
878 sizeof(struct evp_schedule),
879 NULL,
880 evp_schedule,
881 arcfour_salt,
882 NULL,
883 evp_cleanup,
884 EVP_rc4
885 };
886
887 krb5_error_code KRB5_LIB_FUNCTION
888 krb5_salttype_to_string (krb5_context context,
889 krb5_enctype etype,
890 krb5_salttype stype,
891 char **string)
892 {
893 struct encryption_type *e;
894 struct salt_type *st;
895
896 e = _find_enctype (etype);
897 if (e == NULL) {
898 krb5_set_error_message(context, KRB5_PROG_ETYPE_NOSUPP,
899 "encryption type %d not supported",
900 etype);
901 return KRB5_PROG_ETYPE_NOSUPP;
902 }
903 for (st = e->keytype->string_to_key; st && st->type; st++) {
904 if (st->type == stype) {
905 *string = strdup (st->name);
906 if (*string == NULL) {
907 krb5_set_error_message (context, ENOMEM,
908 N_("malloc: out of memory", ""));
909 return ENOMEM;
910 }
911 return 0;
912 }
913 }
914 krb5_set_error_message (context, HEIM_ERR_SALTTYPE_NOSUPP,
915 "salttype %d not supported", stype);
916 return HEIM_ERR_SALTTYPE_NOSUPP;
917 }
918
919 krb5_error_code KRB5_LIB_FUNCTION
920 krb5_string_to_salttype (krb5_context context,
921 krb5_enctype etype,
922 const char *string,
923 krb5_salttype *salttype)
924 {
925 struct encryption_type *e;
926 struct salt_type *st;
927
928 e = _find_enctype (etype);
929 if (e == NULL) {
930 krb5_set_error_message(context, KRB5_PROG_ETYPE_NOSUPP,
931 N_("encryption type %d not supported", ""),
932 etype);
933 return KRB5_PROG_ETYPE_NOSUPP;
934 }
935 for (st = e->keytype->string_to_key; st && st->type; st++) {
936 if (strcasecmp (st->name, string) == 0) {
937 *salttype = st->type;
938 return 0;
939 }
940 }
941 krb5_set_error_message(context, HEIM_ERR_SALTTYPE_NOSUPP,
942 N_("salttype %s not supported", ""), string);
943 return HEIM_ERR_SALTTYPE_NOSUPP;
944 }
945
946 krb5_error_code KRB5_LIB_FUNCTION
947 krb5_get_pw_salt(krb5_context context,
948 krb5_const_principal principal,
949 krb5_salt *salt)
950 {
951 size_t len;
952 int i;
953 krb5_error_code ret;
954 char *p;
955
956 salt->salttype = KRB5_PW_SALT;
957 len = strlen(principal->realm);
958 for (i = 0; i < principal->name.name_string.len; ++i)
959 len += strlen(principal->name.name_string.val[i]);
960 ret = krb5_data_alloc (&salt->saltvalue, len);
961 if (ret)
962 return ret;
963 p = salt->saltvalue.data;
964 memcpy (p, principal->realm, strlen(principal->realm));
965 p += strlen(principal->realm);
966 for (i = 0; i < principal->name.name_string.len; ++i) {
967 memcpy (p,
968 principal->name.name_string.val[i],
969 strlen(principal->name.name_string.val[i]));
970 p += strlen(principal->name.name_string.val[i]);
971 }
972 return 0;
973 }
974
975 krb5_error_code KRB5_LIB_FUNCTION
976 krb5_free_salt(krb5_context context,
977 krb5_salt salt)
978 {
979 krb5_data_free(&salt.saltvalue);
980 return 0;
981 }
982
983 krb5_error_code KRB5_LIB_FUNCTION
984 krb5_string_to_key_data (krb5_context context,
985 krb5_enctype enctype,
986 krb5_data password,
987 krb5_principal principal,
988 krb5_keyblock *key)
989 {
990 krb5_error_code ret;
991 krb5_salt salt;
992
993 ret = krb5_get_pw_salt(context, principal, &salt);
994 if(ret)
995 return ret;
996 ret = krb5_string_to_key_data_salt(context, enctype, password, salt, key);
997 krb5_free_salt(context, salt);
998 return ret;
999 }
1000
1001 krb5_error_code KRB5_LIB_FUNCTION
1002 krb5_string_to_key (krb5_context context,
1003 krb5_enctype enctype,
1004 const char *password,
1005 krb5_principal principal,
1006 krb5_keyblock *key)
1007 {
1008 krb5_data pw;
1009 pw.data = rk_UNCONST(password);
1010 pw.length = strlen(password);
1011 return krb5_string_to_key_data(context, enctype, pw, principal, key);
1012 }
1013
1014 krb5_error_code KRB5_LIB_FUNCTION
1015 krb5_string_to_key_data_salt (krb5_context context,
1016 krb5_enctype enctype,
1017 krb5_data password,
1018 krb5_salt salt,
1019 krb5_keyblock *key)
1020 {
1021 krb5_data opaque;
1022 krb5_data_zero(&opaque);
1023 return krb5_string_to_key_data_salt_opaque(context, enctype, password,
1024 salt, opaque, key);
1025 }
1026
1027 /*
1028 * Do a string -> key for encryption type `enctype' operation on
1029 * `password' (with salt `salt' and the enctype specific data string
1030 * `opaque'), returning the resulting key in `key'
1031 */
1032
1033 krb5_error_code KRB5_LIB_FUNCTION
1034 krb5_string_to_key_data_salt_opaque (krb5_context context,
1035 krb5_enctype enctype,
1036 krb5_data password,
1037 krb5_salt salt,
1038 krb5_data opaque,
1039 krb5_keyblock *key)
1040 {
1041 struct encryption_type *et =_find_enctype(enctype);
1042 struct salt_type *st;
1043 if(et == NULL) {
1044 krb5_set_error_message(context, KRB5_PROG_ETYPE_NOSUPP,
1045 N_("encryption type %d not supported", ""),
1046 enctype);
1047 return KRB5_PROG_ETYPE_NOSUPP;
1048 }
1049 for(st = et->keytype->string_to_key; st && st->type; st++)
1050 if(st->type == salt.salttype)
1051 return (*st->string_to_key)(context, enctype, password,
1052 salt, opaque, key);
1053 krb5_set_error_message(context, HEIM_ERR_SALTTYPE_NOSUPP,
1054 N_("salt type %d not supported", ""),
1055 salt.salttype);
1056 return HEIM_ERR_SALTTYPE_NOSUPP;
1057 }
1058
1059 /*
1060 * Do a string -> key for encryption type `enctype' operation on the
1061 * string `password' (with salt `salt'), returning the resulting key
1062 * in `key'
1063 */
1064
1065 krb5_error_code KRB5_LIB_FUNCTION
1066 krb5_string_to_key_salt (krb5_context context,
1067 krb5_enctype enctype,
1068 const char *password,
1069 krb5_salt salt,
1070 krb5_keyblock *key)
1071 {
1072 krb5_data pw;
1073 pw.data = rk_UNCONST(password);
1074 pw.length = strlen(password);
1075 return krb5_string_to_key_data_salt(context, enctype, pw, salt, key);
1076 }
1077
1078 krb5_error_code KRB5_LIB_FUNCTION
1079 krb5_string_to_key_salt_opaque (krb5_context context,
1080 krb5_enctype enctype,
1081 const char *password,
1082 krb5_salt salt,
1083 krb5_data opaque,
1084 krb5_keyblock *key)
1085 {
1086 krb5_data pw;
1087 pw.data = rk_UNCONST(password);
1088 pw.length = strlen(password);
1089 return krb5_string_to_key_data_salt_opaque(context, enctype,
1090 pw, salt, opaque, key);
1091 }
1092
1093 krb5_error_code KRB5_LIB_FUNCTION
1094 krb5_enctype_keysize(krb5_context context,
1095 krb5_enctype type,
1096 size_t *keysize)
1097 {
1098 struct encryption_type *et = _find_enctype(type);
1099 if(et == NULL) {
1100 krb5_set_error_message(context, KRB5_PROG_ETYPE_NOSUPP,
1101 N_("encryption type %d not supported", ""),
1102 type);
1103 return KRB5_PROG_ETYPE_NOSUPP;
1104 }
1105 *keysize = et->keytype->size;
1106 return 0;
1107 }
1108
1109 krb5_error_code KRB5_LIB_FUNCTION
1110 krb5_enctype_keybits(krb5_context context,
1111 krb5_enctype type,
1112 size_t *keybits)
1113 {
1114 struct encryption_type *et = _find_enctype(type);
1115 if(et == NULL) {
1116 krb5_set_error_message(context, KRB5_PROG_ETYPE_NOSUPP,
1117 "encryption type %d not supported",
1118 type);
1119 return KRB5_PROG_ETYPE_NOSUPP;
1120 }
1121 *keybits = et->keytype->bits;
1122 return 0;
1123 }
1124
1125 krb5_error_code KRB5_LIB_FUNCTION
1126 krb5_generate_random_keyblock(krb5_context context,
1127 krb5_enctype type,
1128 krb5_keyblock *key)
1129 {
1130 krb5_error_code ret;
1131 struct encryption_type *et = _find_enctype(type);
1132 if(et == NULL) {
1133 krb5_set_error_message(context, KRB5_PROG_ETYPE_NOSUPP,
1134 N_("encryption type %d not supported", ""),
1135 type);
1136 return KRB5_PROG_ETYPE_NOSUPP;
1137 }
1138 ret = krb5_data_alloc(&key->keyvalue, et->keytype->size);
1139 if(ret)
1140 return ret;
1141 key->keytype = type;
1142 if(et->keytype->random_key)
1143 (*et->keytype->random_key)(context, key);
1144 else
1145 krb5_generate_random_block(key->keyvalue.data,
1146 key->keyvalue.length);
1147 return 0;
1148 }
1149
1150 static krb5_error_code
1151 _key_schedule(krb5_context context,
1152 struct key_data *key)
1153 {
1154 krb5_error_code ret;
1155 struct encryption_type *et = _find_enctype(key->key->keytype);
1156 struct key_type *kt;
1157
1158 if (et == NULL) {
1159 krb5_set_error_message (context, KRB5_PROG_ETYPE_NOSUPP,
1160 N_("encryption type %d not supported", ""),
1161 key->key->keytype);
1162 return KRB5_PROG_ETYPE_NOSUPP;
1163 }
1164
1165 kt = et->keytype;
1166
1167 if(kt->schedule == NULL)
1168 return 0;
1169 if (key->schedule != NULL)
1170 return 0;
1171 ALLOC(key->schedule, 1);
1172 if(key->schedule == NULL) {
1173 krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
1174 return ENOMEM;
1175 }
1176 ret = krb5_data_alloc(key->schedule, kt->schedule_size);
1177 if(ret) {
1178 free(key->schedule);
1179 key->schedule = NULL;
1180 return ret;
1181 }
1182 (*kt->schedule)(context, kt, key);
1183 return 0;
1184 }
1185
1186 /************************************************************
1187 * *
1188 ************************************************************/
1189
1190 static krb5_error_code
1191 NONE_checksum(krb5_context context,
1192 struct key_data *key,
1193 const void *data,
1194 size_t len,
1195 unsigned usage,
1196 Checksum *C)
1197 {
1198 return 0;
1199 }
1200
1201 static krb5_error_code
1202 CRC32_checksum(krb5_context context,
1203 struct key_data *key,
1204 const void *data,
1205 size_t len,
1206 unsigned usage,
1207 Checksum *C)
1208 {
1209 uint32_t crc;
1210 unsigned char *r = C->checksum.data;
1211 _krb5_crc_init_table ();
1212 crc = _krb5_crc_update (data, len, 0);
1213 r[0] = crc & 0xff;
1214 r[1] = (crc >> 8) & 0xff;
1215 r[2] = (crc >> 16) & 0xff;
1216 r[3] = (crc >> 24) & 0xff;
1217 return 0;
1218 }
1219
1220 static krb5_error_code
1221 RSA_MD4_checksum(krb5_context context,
1222 struct key_data *key,
1223 const void *data,
1224 size_t len,
1225 unsigned usage,
1226 Checksum *C)
1227 {
1228 if (EVP_Digest(data, len, C->checksum.data, NULL, EVP_md4(), NULL) != 1)
1229 krb5_abortx(context, "md4 checksum failed");
1230 return 0;
1231 }
1232
1233 static krb5_error_code
1234 des_checksum(krb5_context context,
1235 const EVP_MD *evp_md,
1236 struct key_data *key,
1237 const void *data,
1238 size_t len,
1239 Checksum *cksum)
1240 {
1241 struct evp_schedule *ctx = key->schedule->data;
1242 EVP_MD_CTX *m;
1243 DES_cblock ivec;
1244 unsigned char *p = cksum->checksum.data;
1245
1246 krb5_generate_random_block(p, 8);
1247
1248 m = EVP_MD_CTX_create();
1249 if (m == NULL) {
1250 krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
1251 return ENOMEM;
1252 }
1253
1254 EVP_DigestInit_ex(m, evp_md, NULL);
1255 EVP_DigestUpdate(m, p, 8);
1256 EVP_DigestUpdate(m, data, len);
1257 EVP_DigestFinal_ex (m, p + 8, NULL);
1258 EVP_MD_CTX_destroy(m);
1259 memset (&ivec, 0, sizeof(ivec));
1260 EVP_CipherInit_ex(&ctx->ectx, NULL, NULL, NULL, (void *)&ivec, -1);
1261 EVP_Cipher(&ctx->ectx, p, p, 24);
1262
1263 return 0;
1264 }
1265
1266 static krb5_error_code
1267 des_verify(krb5_context context,
1268 const EVP_MD *evp_md,
1269 struct key_data *key,
1270 const void *data,
1271 size_t len,
1272 Checksum *C)
1273 {
1274 struct evp_schedule *ctx = key->schedule->data;
1275 EVP_MD_CTX *m;
1276 unsigned char tmp[24];
1277 unsigned char res[16];
1278 DES_cblock ivec;
1279 krb5_error_code ret = 0;
1280
1281 m = EVP_MD_CTX_create();
1282 if (m == NULL) {
1283 krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
1284 return ENOMEM;
1285 }
1286
1287 memset(&ivec, 0, sizeof(ivec));
1288 EVP_CipherInit_ex(&ctx->dctx, NULL, NULL, NULL, (void *)&ivec, -1);
1289 EVP_Cipher(&ctx->dctx, tmp, C->checksum.data, 24);
1290
1291 EVP_DigestInit_ex(m, evp_md, NULL);
1292 EVP_DigestUpdate(m, tmp, 8); /* confounder */
1293 EVP_DigestUpdate(m, data, len);
1294 EVP_DigestFinal_ex (m, res, NULL);
1295 EVP_MD_CTX_destroy(m);
1296 if(memcmp(res, tmp + 8, sizeof(res)) != 0) {
1297 krb5_clear_error_message (context);
1298 ret = KRB5KRB_AP_ERR_BAD_INTEGRITY;
1299 }
1300 memset(tmp, 0, sizeof(tmp));
1301 memset(res, 0, sizeof(res));
1302 return ret;
1303 }
1304
1305 static krb5_error_code
1306 RSA_MD4_DES_checksum(krb5_context context,
1307 struct key_data *key,
1308 const void *data,
1309 size_t len,
1310 unsigned usage,
1311 Checksum *cksum)
1312 {
1313 return des_checksum(context, EVP_md4(), key, data, len, cksum);
1314 }
1315
1316 static krb5_error_code
1317 RSA_MD4_DES_verify(krb5_context context,
1318 struct key_data *key,
1319 const void *data,
1320 size_t len,
1321 unsigned usage,
1322 Checksum *C)
1323 {
1324 return des_verify(context, EVP_md5(), key, data, len, C);
1325 }
1326
1327 static krb5_error_code
1328 RSA_MD5_checksum(krb5_context context,
1329 struct key_data *key,
1330 const void *data,
1331 size_t len,
1332 unsigned usage,
1333 Checksum *C)
1334 {
1335 if (EVP_Digest(data, len, C->checksum.data, NULL, EVP_md5(), NULL) != 1)
1336 krb5_abortx(context, "md5 checksum failed");
1337 return 0;
1338 }
1339
1340 static krb5_error_code
1341 RSA_MD5_DES_checksum(krb5_context context,
1342 struct key_data *key,
1343 const void *data,
1344 size_t len,
1345 unsigned usage,
1346 Checksum *C)
1347 {
1348 return des_checksum(context, EVP_md5(), key, data, len, C);
1349 }
1350
1351 static krb5_error_code
1352 RSA_MD5_DES_verify(krb5_context context,
1353 struct key_data *key,
1354 const void *data,
1355 size_t len,
1356 unsigned usage,
1357 Checksum *C)
1358 {
1359 return des_verify(context, EVP_md5(), key, data, len, C);
1360 }
1361
1362 #ifdef DES3_OLD_ENCTYPE
1363 static krb5_error_code
1364 RSA_MD5_DES3_checksum(krb5_context context,
1365 struct key_data *key,
1366 const void *data,
1367 size_t len,
1368 unsigned usage,
1369 Checksum *C)
1370 {
1371 return des_checksum(context, EVP_md5(), key, data, len, C);
1372 }
1373
1374 static krb5_error_code
1375 RSA_MD5_DES3_verify(krb5_context context,
1376 struct key_data *key,
1377 const void *data,
1378 size_t len,
1379 unsigned usage,
1380 Checksum *C)
1381 {
1382 return des_verify(context, EVP_md5(), key, data, len, C);
1383 }
1384 #endif
1385
1386 static krb5_error_code
1387 SHA1_checksum(krb5_context context,
1388 struct key_data *key,
1389 const void *data,
1390 size_t len,
1391 unsigned usage,
1392 Checksum *C)
1393 {
1394 if (EVP_Digest(data, len, C->checksum.data, NULL, EVP_sha1(), NULL) != 1)
1395 krb5_abortx(context, "sha1 checksum failed");
1396 return 0;
1397 }
1398
1399 /* HMAC according to RFC2104 */
1400 static krb5_error_code
1401 hmac(krb5_context context,
1402 struct checksum_type *cm,
1403 const void *data,
1404 size_t len,
1405 unsigned usage,
1406 struct key_data *keyblock,
1407 Checksum *result)
1408 {
1409 unsigned char *ipad, *opad;
1410 unsigned char *key;
1411 size_t key_len;
1412 int i;
1413
1414 ipad = malloc(cm->blocksize + len);
1415 if (ipad == NULL)
1416 return ENOMEM;
1417 opad = malloc(cm->blocksize + cm->checksumsize);
1418 if (opad == NULL) {
1419 free(ipad);
1420 return ENOMEM;
1421 }
1422 memset(ipad, 0x36, cm->blocksize);
1423 memset(opad, 0x5c, cm->blocksize);
1424
1425 if(keyblock->key->keyvalue.length > cm->blocksize){
1426 (*cm->checksum)(context,
1427 keyblock,
1428 keyblock->key->keyvalue.data,
1429 keyblock->key->keyvalue.length,
1430 usage,
1431 result);
1432 key = result->checksum.data;
1433 key_len = result->checksum.length;
1434 } else {
1435 key = keyblock->key->keyvalue.data;
1436 key_len = keyblock->key->keyvalue.length;
1437 }
1438 for(i = 0; i < key_len; i++){
1439 ipad[i] ^= key[i];
1440 opad[i] ^= key[i];
1441 }
1442 memcpy(ipad + cm->blocksize, data, len);
1443 (*cm->checksum)(context, keyblock, ipad, cm->blocksize + len,
1444 usage, result);
1445 memcpy(opad + cm->blocksize, result->checksum.data,
1446 result->checksum.length);
1447 (*cm->checksum)(context, keyblock, opad,
1448 cm->blocksize + cm->checksumsize, usage, result);
1449 memset(ipad, 0, cm->blocksize + len);
1450 free(ipad);
1451 memset(opad, 0, cm->blocksize + cm->checksumsize);
1452 free(opad);
1453
1454 return 0;
1455 }
1456
1457 krb5_error_code KRB5_LIB_FUNCTION
1458 krb5_hmac(krb5_context context,
1459 krb5_cksumtype cktype,
1460 const void *data,
1461 size_t len,
1462 unsigned usage,
1463 krb5_keyblock *key,
1464 Checksum *result)
1465 {
1466 struct checksum_type *c = _find_checksum(cktype);
1467 struct key_data kd;
1468 krb5_error_code ret;
1469
1470 if (c == NULL) {
1471 krb5_set_error_message (context, KRB5_PROG_SUMTYPE_NOSUPP,
1472 N_("checksum type %d not supported", ""),
1473 cktype);
1474 return KRB5_PROG_SUMTYPE_NOSUPP;
1475 }
1476
1477 kd.key = key;
1478 kd.schedule = NULL;
1479
1480 ret = hmac(context, c, data, len, usage, &kd, result);
1481
1482 if (kd.schedule)
1483 krb5_free_data(context, kd.schedule);
1484
1485 return ret;
1486 }
1487
1488 static krb5_error_code
1489 SP_HMAC_SHA1_checksum(krb5_context context,
1490 struct key_data *key,
1491 const void *data,
1492 size_t len,
1493 unsigned usage,
1494 Checksum *result)
1495 {
1496 struct checksum_type *c = _find_checksum(CKSUMTYPE_SHA1);
1497 Checksum res;
1498 char sha1_data[20];
1499 krb5_error_code ret;
1500
1501 res.checksum.data = sha1_data;
1502 res.checksum.length = sizeof(sha1_data);
1503
1504 ret = hmac(context, c, data, len, usage, key, &res);
1505 if (ret)
1506 krb5_abortx(context, "hmac failed");
1507 memcpy(result->checksum.data, res.checksum.data, result->checksum.length);
1508 return 0;
1509 }
1510
1511 /*
1512 * checksum according to section 5. of draft-brezak-win2k-krb-rc4-hmac-03.txt
1513 */
1514
1515 static krb5_error_code
1516 HMAC_MD5_checksum(krb5_context context,
1517 struct key_data *key,
1518 const void *data,
1519 size_t len,
1520 unsigned usage,
1521 Checksum *result)
1522 {
1523 EVP_MD_CTX *m;
1524 struct checksum_type *c = _find_checksum (CKSUMTYPE_RSA_MD5);
1525 const char signature[] = "signaturekey";
1526 Checksum ksign_c;
1527 struct key_data ksign;
1528 krb5_keyblock kb;
1529 unsigned char t[4];
1530 unsigned char tmp[16];
1531 unsigned char ksign_c_data[16];
1532 krb5_error_code ret;
1533
1534 m = EVP_MD_CTX_create();
1535 if (m == NULL) {
1536 krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
1537 return ENOMEM;
1538 }
1539 ksign_c.checksum.length = sizeof(ksign_c_data);
1540 ksign_c.checksum.data = ksign_c_data;
1541 ret = hmac(context, c, signature, sizeof(signature), 0, key, &ksign_c);
1542 if (ret) {
1543 EVP_MD_CTX_destroy(m);
1544 return ret;
1545 }
1546 ksign.key = &kb;
1547 kb.keyvalue = ksign_c.checksum;
1548 EVP_DigestInit_ex(m, EVP_md5(), NULL);
1549 t[0] = (usage >> 0) & 0xFF;
1550 t[1] = (usage >> 8) & 0xFF;
1551 t[2] = (usage >> 16) & 0xFF;
1552 t[3] = (usage >> 24) & 0xFF;
1553 EVP_DigestUpdate(m, t, 4);
1554 EVP_DigestUpdate(m, data, len);
1555 EVP_DigestFinal_ex (m, tmp, NULL);
1556 EVP_MD_CTX_destroy(m);
1557
1558 ret = hmac(context, c, tmp, sizeof(tmp), 0, &ksign, result);
1559 if (ret)
1560 return ret;
1561 return 0;
1562 }
1563
1564 static struct checksum_type checksum_none = {
1565 CKSUMTYPE_NONE,
1566 "none",
1567 1,
1568 0,
1569 0,
1570 NONE_checksum,
1571 NULL
1572 };
1573 static struct checksum_type checksum_crc32 = {
1574 CKSUMTYPE_CRC32,
1575 "crc32",
1576 1,
1577 4,
1578 0,
1579 CRC32_checksum,
1580 NULL
1581 };
1582 static struct checksum_type checksum_rsa_md4 = {
1583 CKSUMTYPE_RSA_MD4,
1584 "rsa-md4",
1585 64,
1586 16,
1587 F_CPROOF,
1588 RSA_MD4_checksum,
1589 NULL
1590 };
1591 static struct checksum_type checksum_rsa_md4_des = {
1592 CKSUMTYPE_RSA_MD4_DES,
1593 "rsa-md4-des",
1594 64,
1595 24,
1596 F_KEYED | F_CPROOF | F_VARIANT,
1597 RSA_MD4_DES_checksum,
1598 RSA_MD4_DES_verify
1599 };
1600 static struct checksum_type checksum_rsa_md5 = {
1601 CKSUMTYPE_RSA_MD5,
1602 "rsa-md5",
1603 64,
1604 16,
1605 F_CPROOF,
1606 RSA_MD5_checksum,
1607 NULL
1608 };
1609 static struct checksum_type checksum_rsa_md5_des = {
1610 CKSUMTYPE_RSA_MD5_DES,
1611 "rsa-md5-des",
1612 64,
1613 24,
1614 F_KEYED | F_CPROOF | F_VARIANT,
1615 RSA_MD5_DES_checksum,
1616 RSA_MD5_DES_verify
1617 };
1618 #ifdef DES3_OLD_ENCTYPE
1619 static struct checksum_type checksum_rsa_md5_des3 = {
1620 CKSUMTYPE_RSA_MD5_DES3,
1621 "rsa-md5-des3",
1622 64,
1623 24,
1624 F_KEYED | F_CPROOF | F_VARIANT,
1625 RSA_MD5_DES3_checksum,
1626 RSA_MD5_DES3_verify
1627 };
1628 #endif
1629 static struct checksum_type checksum_sha1 = {
1630 CKSUMTYPE_SHA1,
1631 "sha1",
1632 64,
1633 20,
1634 F_CPROOF,
1635 SHA1_checksum,
1636 NULL
1637 };
1638 static struct checksum_type checksum_hmac_sha1_des3 = {
1639 CKSUMTYPE_HMAC_SHA1_DES3,
1640 "hmac-sha1-des3",
1641 64,
1642 20,
1643 F_KEYED | F_CPROOF | F_DERIVED,
1644 SP_HMAC_SHA1_checksum,
1645 NULL
1646 };
1647
1648 static struct checksum_type checksum_hmac_sha1_aes128 = {
1649 CKSUMTYPE_HMAC_SHA1_96_AES_128,
1650 "hmac-sha1-96-aes128",
1651 64,
1652 12,
1653 F_KEYED | F_CPROOF | F_DERIVED,
1654 SP_HMAC_SHA1_checksum,
1655 NULL
1656 };
1657
1658 static struct checksum_type checksum_hmac_sha1_aes256 = {
1659 CKSUMTYPE_HMAC_SHA1_96_AES_256,
1660 "hmac-sha1-96-aes256",
1661 64,
1662 12,
1663 F_KEYED | F_CPROOF | F_DERIVED,
1664 SP_HMAC_SHA1_checksum,
1665 NULL
1666 };
1667
1668 static struct checksum_type checksum_hmac_md5 = {
1669 CKSUMTYPE_HMAC_MD5,
1670 "hmac-md5",
1671 64,
1672 16,
1673 F_KEYED | F_CPROOF,
1674 HMAC_MD5_checksum,
1675 NULL
1676 };
1677
1678 static struct checksum_type *checksum_types[] = {
1679 &checksum_none,
1680 &checksum_crc32,
1681 &checksum_rsa_md4,
1682 &checksum_rsa_md4_des,
1683 &checksum_rsa_md5,
1684 &checksum_rsa_md5_des,
1685 #ifdef DES3_OLD_ENCTYPE
1686 &checksum_rsa_md5_des3,
1687 #endif
1688 &checksum_sha1,
1689 &checksum_hmac_sha1_des3,
1690 &checksum_hmac_sha1_aes128,
1691 &checksum_hmac_sha1_aes256,
1692 &checksum_hmac_md5
1693 };
1694
1695 static int num_checksums = sizeof(checksum_types) / sizeof(checksum_types[0]);
1696
1697 static struct checksum_type *
1698 _find_checksum(krb5_cksumtype type)
1699 {
1700 int i;
1701 for(i = 0; i < num_checksums; i++)
1702 if(checksum_types[i]->type == type)
1703 return checksum_types[i];
1704 return NULL;
1705 }
1706
1707 static krb5_error_code
1708 get_checksum_key(krb5_context context,
1709 krb5_crypto crypto,
1710 unsigned usage, /* not krb5_key_usage */
1711 struct checksum_type *ct,
1712 struct key_data **key)
1713 {
1714 krb5_error_code ret = 0;
1715
1716 if(ct->flags & F_DERIVED)
1717 ret = _get_derived_key(context, crypto, usage, key);
1718 else if(ct->flags & F_VARIANT) {
1719 int i;
1720
1721 *key = _new_derived_key(crypto, 0xff/* KRB5_KU_RFC1510_VARIANT */);
1722 if(*key == NULL) {
1723 krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
1724 return ENOMEM;
1725 }
1726 ret = krb5_copy_keyblock(context, crypto->key.key, &(*key)->key);
1727 if(ret)
1728 return ret;
1729 for(i = 0; i < (*key)->key->keyvalue.length; i++)
1730 ((unsigned char*)(*key)->key->keyvalue.data)[i] ^= 0xF0;
1731 } else {
1732 *key = &crypto->key;
1733 }
1734 if(ret == 0)
1735 ret = _key_schedule(context, *key);
1736 return ret;
1737 }
1738
1739 static krb5_error_code
1740 create_checksum (krb5_context context,
1741 struct checksum_type *ct,
1742 krb5_crypto crypto,
1743 unsigned usage,
1744 void *data,
1745 size_t len,
1746 Checksum *result)
1747 {
1748 krb5_error_code ret;
1749 struct key_data *dkey;
1750 int keyed_checksum;
1751
1752 if (ct->flags & F_DISABLED) {
1753 krb5_clear_error_message (context);
1754 return KRB5_PROG_SUMTYPE_NOSUPP;
1755 }
1756 keyed_checksum = (ct->flags & F_KEYED) != 0;
1757 if(keyed_checksum && crypto == NULL) {
1758 krb5_set_error_message (context, KRB5_PROG_SUMTYPE_NOSUPP,
1759 N_("Checksum type %s is keyed but no "
1760 "crypto context (key) was passed in", ""),
1761 ct->name);
1762 return KRB5_PROG_SUMTYPE_NOSUPP; /* XXX */
1763 }
1764 if(keyed_checksum) {
1765 ret = get_checksum_key(context, crypto, usage, ct, &dkey);
1766 if (ret)
1767 return ret;
1768 } else
1769 dkey = NULL;
1770 result->cksumtype = ct->type;
1771 ret = krb5_data_alloc(&result->checksum, ct->checksumsize);
1772 if (ret)
1773 return (ret);
1774 return (*ct->checksum)(context, dkey, data, len, usage, result);
1775 }
1776
1777 static int
1778 arcfour_checksum_p(struct checksum_type *ct, krb5_crypto crypto)
1779 {
1780 return (ct->type == CKSUMTYPE_HMAC_MD5) &&
1781 (crypto->key.key->keytype == KEYTYPE_ARCFOUR);
1782 }
1783
1784 krb5_error_code KRB5_LIB_FUNCTION
1785 krb5_create_checksum(krb5_context context,
1786 krb5_crypto crypto,
1787 krb5_key_usage usage,
1788 int type,
1789 void *data,
1790 size_t len,
1791 Checksum *result)
1792 {
1793 struct checksum_type *ct = NULL;
1794 unsigned keyusage;
1795
1796 /* type 0 -> pick from crypto */
1797 if (type) {
1798 ct = _find_checksum(type);
1799 } else if (crypto) {
1800 ct = crypto->et->keyed_checksum;
1801 if (ct == NULL)
1802 ct = crypto->et->checksum;
1803 }
1804
1805 if(ct == NULL) {
1806 krb5_set_error_message (context, KRB5_PROG_SUMTYPE_NOSUPP,
1807 N_("checksum type %d not supported", ""),
1808 type);
1809 return KRB5_PROG_SUMTYPE_NOSUPP;
1810 }
1811
1812 if (arcfour_checksum_p(ct, crypto)) {
1813 keyusage = usage;
1814 usage2arcfour(context, &keyusage);
1815 } else
1816 keyusage = CHECKSUM_USAGE(usage);
1817
1818 return create_checksum(context, ct, crypto, keyusage,
1819 data, len, result);
1820 }
1821
1822 static krb5_error_code
1823 verify_checksum(krb5_context context,
1824 krb5_crypto crypto,
1825 unsigned usage, /* not krb5_key_usage */
1826 void *data,
1827 size_t len,
1828 Checksum *cksum)
1829 {
1830 krb5_error_code ret;
1831 struct key_data *dkey;
1832 int keyed_checksum;
1833 Checksum c;
1834 struct checksum_type *ct;
1835
1836 ct = _find_checksum(cksum->cksumtype);
1837 if (ct == NULL || (ct->flags & F_DISABLED)) {
1838 krb5_set_error_message (context, KRB5_PROG_SUMTYPE_NOSUPP,
1839 N_("checksum type %d not supported", ""),
1840 cksum->cksumtype);
1841 return KRB5_PROG_SUMTYPE_NOSUPP;
1842 }
1843 if(ct->checksumsize != cksum->checksum.length) {
1844 krb5_clear_error_message (context);
1845 return KRB5KRB_AP_ERR_BAD_INTEGRITY; /* XXX */
1846 }
1847 keyed_checksum = (ct->flags & F_KEYED) != 0;
1848 if(keyed_checksum) {
1849 struct checksum_type *kct;
1850 if (crypto == NULL) {
1851 krb5_set_error_message (context, KRB5_PROG_SUMTYPE_NOSUPP,
1852 N_("Checksum type %s is keyed but no "
1853 "crypto context (key) was passed in", ""),
1854 ct->name);
1855 return KRB5_PROG_SUMTYPE_NOSUPP; /* XXX */
1856 }
1857 kct = crypto->et->keyed_checksum;
1858 if (kct != NULL && kct->type != ct->type) {
1859 krb5_set_error_message (context, KRB5_PROG_SUMTYPE_NOSUPP,
1860 N_("Checksum type %s is keyed, but "
1861 "the key type %s passed didnt have that checksum "
1862 "type as the keyed type", ""),
1863 ct->name, crypto->et->name);
1864 return KRB5_PROG_SUMTYPE_NOSUPP; /* XXX */
1865 }
1866
1867 ret = get_checksum_key(context, crypto, usage, ct, &dkey);
1868 if (ret)
1869 return ret;
1870 } else
1871 dkey = NULL;
1872 if(ct->verify)
1873 return (*ct->verify)(context, dkey, data, len, usage, cksum);
1874
1875 ret = krb5_data_alloc (&c.checksum, ct->checksumsize);
1876 if (ret)
1877 return ret;
1878
1879 ret = (*ct->checksum)(context, dkey, data, len, usage, &c);
1880 if (ret) {
1881 krb5_data_free(&c.checksum);
1882 return ret;
1883 }
1884
1885 if(c.checksum.length != cksum->checksum.length ||
1886 memcmp(c.checksum.data, cksum->checksum.data, c.checksum.length)) {
1887 krb5_clear_error_message (context);
1888 ret = KRB5KRB_AP_ERR_BAD_INTEGRITY;
1889 } else {
1890 ret = 0;
1891 }
1892 krb5_data_free (&c.checksum);
1893 return ret;
1894 }
1895
1896 krb5_error_code KRB5_LIB_FUNCTION
1897 krb5_verify_checksum(krb5_context context,
1898 krb5_crypto crypto,
1899 krb5_key_usage usage,
1900 void *data,
1901 size_t len,
1902 Checksum *cksum)
1903 {
1904 struct checksum_type *ct;
1905 unsigned keyusage;
1906
1907 ct = _find_checksum(cksum->cksumtype);
1908 if(ct == NULL) {
1909 krb5_set_error_message (context, KRB5_PROG_SUMTYPE_NOSUPP,
1910 N_("checksum type %d not supported", ""),
1911 cksum->cksumtype);
1912 return KRB5_PROG_SUMTYPE_NOSUPP;
1913 }
1914
1915 if (arcfour_checksum_p(ct, crypto)) {
1916 keyusage = usage;
1917 usage2arcfour(context, &keyusage);
1918 } else
1919 keyusage = CHECKSUM_USAGE(usage);
1920
1921 return verify_checksum(context, crypto, keyusage,
1922 data, len, cksum);
1923 }
1924
1925 krb5_error_code KRB5_LIB_FUNCTION
1926 krb5_crypto_get_checksum_type(krb5_context context,
1927 krb5_crypto crypto,
1928 krb5_cksumtype *type)
1929 {
1930 struct checksum_type *ct = NULL;
1931
1932 if (crypto != NULL) {
1933 ct = crypto->et->keyed_checksum;
1934 if (ct == NULL)
1935 ct = crypto->et->checksum;
1936 }
1937
1938 if (ct == NULL) {
1939 krb5_set_error_message (context, KRB5_PROG_SUMTYPE_NOSUPP,
1940 N_("checksum type not found", ""));
1941 return KRB5_PROG_SUMTYPE_NOSUPP;
1942 }
1943
1944 *type = ct->type;
1945
1946 return 0;
1947 }
1948
1949
1950 krb5_error_code KRB5_LIB_FUNCTION
1951 krb5_checksumsize(krb5_context context,
1952 krb5_cksumtype type,
1953 size_t *size)
1954 {
1955 struct checksum_type *ct = _find_checksum(type);
1956 if(ct == NULL) {
1957 krb5_set_error_message (context, KRB5_PROG_SUMTYPE_NOSUPP,
1958 N_("checksum type %d not supported", ""),
1959 type);
1960 return KRB5_PROG_SUMTYPE_NOSUPP;
1961 }
1962 *size = ct->checksumsize;
1963 return 0;
1964 }
1965
1966 krb5_boolean KRB5_LIB_FUNCTION
1967 krb5_checksum_is_keyed(krb5_context context,
1968 krb5_cksumtype type)
1969 {
1970 struct checksum_type *ct = _find_checksum(type);
1971 if(ct == NULL) {
1972 if (context)
1973 krb5_set_error_message (context, KRB5_PROG_SUMTYPE_NOSUPP,
1974 N_("checksum type %d not supported", ""),
1975 type);
1976 return KRB5_PROG_SUMTYPE_NOSUPP;
1977 }
1978 return ct->flags & F_KEYED;
1979 }
1980
1981 krb5_boolean KRB5_LIB_FUNCTION
1982 krb5_checksum_is_collision_proof(krb5_context context,
1983 krb5_cksumtype type)
1984 {
1985 struct checksum_type *ct = _find_checksum(type);
1986 if(ct == NULL) {
1987 if (context)
1988 krb5_set_error_message (context, KRB5_PROG_SUMTYPE_NOSUPP,
1989 N_("checksum type %d not supported", ""),
1990 type);
1991 return KRB5_PROG_SUMTYPE_NOSUPP;
1992 }
1993 return ct->flags & F_CPROOF;
1994 }
1995
1996 krb5_error_code KRB5_LIB_FUNCTION
1997 krb5_checksum_disable(krb5_context context,
1998 krb5_cksumtype type)
1999 {
2000 struct checksum_type *ct = _find_checksum(type);
2001 if(ct == NULL) {
2002 if (context)
2003 krb5_set_error_message (context, KRB5_PROG_SUMTYPE_NOSUPP,
2004 N_("checksum type %d not supported", ""),
2005 type);
2006 return KRB5_PROG_SUMTYPE_NOSUPP;
2007 }
2008 ct->flags |= F_DISABLED;
2009 return 0;
2010 }
2011
2012 /************************************************************
2013 * *
2014 ************************************************************/
2015
2016 static krb5_error_code
2017 NULL_encrypt(krb5_context context,
2018 struct key_data *key,
2019 void *data,
2020 size_t len,
2021 krb5_boolean encryptp,
2022 int usage,
2023 void *ivec)
2024 {
2025 return 0;
2026 }
2027
2028 static krb5_error_code
2029 evp_encrypt(krb5_context context,
2030 struct key_data *key,
2031 void *data,
2032 size_t len,
2033 krb5_boolean encryptp,
2034 int usage,
2035 void *ivec)
2036 {
2037 struct evp_schedule *ctx = key->schedule->data;
2038 EVP_CIPHER_CTX *c;
2039 c = encryptp ? &ctx->ectx : &ctx->dctx;
2040 if (ivec == NULL) {
2041 /* alloca ? */
2042 size_t len = EVP_CIPHER_CTX_iv_length(c);
2043 void *loiv = malloc(len);
2044 if (loiv == NULL) {
2045 krb5_clear_error_message(context);
2046 return ENOMEM;
2047 }
2048 memset(loiv, 0, len);
2049 EVP_CipherInit_ex(c, NULL, NULL, NULL, loiv, -1);
2050 free(loiv);
2051 } else
2052 EVP_CipherInit_ex(c, NULL, NULL, NULL, ivec, -1);
2053 EVP_Cipher(c, data, data, len);
2054 return 0;
2055 }
2056
2057 #ifdef WEAK_ENCTYPES
2058 static krb5_error_code
2059 evp_des_encrypt_null_ivec(krb5_context context,
2060 struct key_data *key,
2061 void *data,
2062 size_t len,
2063 krb5_boolean encryptp,
2064 int usage,
2065 void *ignore_ivec)
2066 {
2067 struct evp_schedule *ctx = key->schedule->data;
2068 EVP_CIPHER_CTX *c;
2069 DES_cblock ivec;
2070 memset(&ivec, 0, sizeof(ivec));
2071 c = encryptp ? &ctx->ectx : &ctx->dctx;
2072 EVP_CipherInit_ex(c, NULL, NULL, NULL, (void *)&ivec, -1);
2073 EVP_Cipher(c, data, data, len);
2074 return 0;
2075 }
2076
2077 static krb5_error_code
2078 evp_des_encrypt_key_ivec(krb5_context context,
2079 struct key_data *key,
2080 void *data,
2081 size_t len,
2082 krb5_boolean encryptp,
2083 int usage,
2084 void *ignore_ivec)
2085 {
2086 struct evp_schedule *ctx = key->schedule->data;
2087 EVP_CIPHER_CTX *c;
2088 DES_cblock ivec;
2089 memcpy(&ivec, key->key->keyvalue.data, sizeof(ivec));
2090 c = encryptp ? &ctx->ectx : &ctx->dctx;
2091 EVP_CipherInit_ex(c, NULL, NULL, NULL, (void *)&ivec, -1);
2092 EVP_Cipher(c, data, data, len);
2093 return 0;
2094 }
2095
2096 static krb5_error_code
2097 DES_CFB64_encrypt_null_ivec(krb5_context context,
2098 struct key_data *key,
2099 void *data,
2100 size_t len,
2101 krb5_boolean encryptp,
2102 int usage,
2103 void *ignore_ivec)
2104 {
2105 DES_cblock ivec;
2106 int num = 0;
2107 DES_key_schedule *s = key->schedule->data;
2108 memset(&ivec, 0, sizeof(ivec));
2109
2110 DES_cfb64_encrypt(data, data, len, s, &ivec, &num, encryptp);
2111 return 0;
2112 }
2113
2114 static krb5_error_code
2115 DES_PCBC_encrypt_key_ivec(krb5_context context,
2116 struct key_data *key,
2117 void *data,
2118 size_t len,
2119 krb5_boolean encryptp,
2120 int usage,
2121 void *ignore_ivec)
2122 {
2123 DES_cblock ivec;
2124 DES_key_schedule *s = key->schedule->data;
2125 memcpy(&ivec, key->key->keyvalue.data, sizeof(ivec));
2126
2127 DES_pcbc_encrypt(data, data, len, s, &ivec, encryptp);
2128 return 0;
2129 }
2130 #endif
2131
2132 /*
2133 * section 6 of draft-brezak-win2k-krb-rc4-hmac-03
2134 *
2135 * warning: not for small children
2136 */
2137
2138 static krb5_error_code
2139 ARCFOUR_subencrypt(krb5_context context,
2140 struct key_data *key,
2141 void *data,
2142 size_t len,
2143 unsigned usage,
2144 void *ivec)
2145 {
2146 EVP_CIPHER_CTX ctx;
2147 struct checksum_type *c = _find_checksum (CKSUMTYPE_RSA_MD5);
2148 Checksum k1_c, k2_c, k3_c, cksum;
2149 struct key_data ke;
2150 krb5_keyblock kb;
2151 unsigned char t[4];
2152 unsigned char *cdata = data;
2153 unsigned char k1_c_data[16], k2_c_data[16], k3_c_data[16];
2154 krb5_error_code ret;
2155
2156 t[0] = (usage >> 0) & 0xFF;
2157 t[1] = (usage >> 8) & 0xFF;
2158 t[2] = (usage >> 16) & 0xFF;
2159 t[3] = (usage >> 24) & 0xFF;
2160
2161 k1_c.checksum.length = sizeof(k1_c_data);
2162 k1_c.checksum.data = k1_c_data;
2163
2164 ret = hmac(NULL, c, t, sizeof(t), 0, key, &k1_c);
2165 if (ret)
2166 krb5_abortx(context, "hmac failed");
2167
2168 memcpy (k2_c_data, k1_c_data, sizeof(k1_c_data));
2169
2170 k2_c.checksum.length = sizeof(k2_c_data);
2171 k2_c.checksum.data = k2_c_data;
2172
2173 ke.key = &kb;
2174 kb.keyvalue = k2_c.checksum;
2175
2176 cksum.checksum.length = 16;
2177 cksum.checksum.data = data;
2178
2179 ret = hmac(NULL, c, cdata + 16, len - 16, 0, &ke, &cksum);
2180 if (ret)
2181 krb5_abortx(context, "hmac failed");
2182
2183 ke.key = &kb;
2184 kb.keyvalue = k1_c.checksum;
2185
2186 k3_c.checksum.length = sizeof(k3_c_data);
2187 k3_c.checksum.data = k3_c_data;
2188
2189 ret = hmac(NULL, c, data, 16, 0, &ke, &k3_c);
2190 if (ret)
2191 krb5_abortx(context, "hmac failed");
2192
2193 EVP_CIPHER_CTX_init(&ctx);
2194
2195 EVP_CipherInit_ex(&ctx, EVP_rc4(), NULL, k3_c.checksum.data, NULL, 1);
2196 EVP_Cipher(&ctx, cdata + 16, cdata + 16, len - 16);
2197 EVP_CIPHER_CTX_cleanup(&ctx);
2198
2199 memset (k1_c_data, 0, sizeof(k1_c_data));
2200 memset (k2_c_data, 0, sizeof(k2_c_data));
2201 memset (k3_c_data, 0, sizeof(k3_c_data));
2202 return 0;
2203 }
2204
2205 static krb5_error_code
2206 ARCFOUR_subdecrypt(krb5_context context,
2207 struct key_data *key,
2208 void *data,
2209 size_t len,
2210 unsigned usage,
2211 void *ivec)
2212 {
2213 EVP_CIPHER_CTX ctx;
2214 struct checksum_type *c = _find_checksum (CKSUMTYPE_RSA_MD5);
2215 Checksum k1_c, k2_c, k3_c, cksum;
2216 struct key_data ke;
2217 krb5_keyblock kb;
2218 unsigned char t[4];
2219 unsigned char *cdata = data;
2220 unsigned char k1_c_data[16], k2_c_data[16], k3_c_data[16];
2221 unsigned char cksum_data[16];
2222 krb5_error_code ret;
2223
2224 t[0] = (usage >> 0) & 0xFF;
2225 t[1] = (usage >> 8) & 0xFF;
2226 t[2] = (usage >> 16) & 0xFF;
2227 t[3] = (usage >> 24) & 0xFF;
2228
2229 k1_c.checksum.length = sizeof(k1_c_data);
2230 k1_c.checksum.data = k1_c_data;
2231
2232 ret = hmac(NULL, c, t, sizeof(t), 0, key, &k1_c);
2233 if (ret)
2234 krb5_abortx(context, "hmac failed");
2235
2236 memcpy (k2_c_data, k1_c_data, sizeof(k1_c_data));
2237
2238 k2_c.checksum.length = sizeof(k2_c_data);
2239 k2_c.checksum.data = k2_c_data;
2240
2241 ke.key = &kb;
2242 kb.keyvalue = k1_c.checksum;
2243
2244 k3_c.checksum.length = sizeof(k3_c_data);
2245 k3_c.checksum.data = k3_c_data;
2246
2247 ret = hmac(NULL, c, cdata, 16, 0, &ke, &k3_c);
2248 if (ret)
2249 krb5_abortx(context, "hmac failed");
2250
2251 EVP_CIPHER_CTX_init(&ctx);
2252 EVP_CipherInit_ex(&ctx, EVP_rc4(), NULL, k3_c.checksum.data, NULL, 0);
2253 EVP_Cipher(&ctx, cdata + 16, cdata + 16, len - 16);
2254 EVP_CIPHER_CTX_cleanup(&ctx);
2255
2256 ke.key = &kb;
2257 kb.keyvalue = k2_c.checksum;
2258
2259 cksum.checksum.length = 16;
2260 cksum.checksum.data = cksum_data;
2261
2262 ret = hmac(NULL, c, cdata + 16, len - 16, 0, &ke, &cksum);
2263 if (ret)
2264 krb5_abortx(context, "hmac failed");
2265
2266 memset (k1_c_data, 0, sizeof(k1_c_data));
2267 memset (k2_c_data, 0, sizeof(k2_c_data));
2268 memset (k3_c_data, 0, sizeof(k3_c_data));
2269
2270 if (memcmp (cksum.checksum.data, data, 16) != 0) {
2271 krb5_clear_error_message (context);
2272 return KRB5KRB_AP_ERR_BAD_INTEGRITY;
2273 } else {
2274 return 0;
2275 }
2276 }
2277
2278 /*
2279 * convert the usage numbers used in
2280 * draft-ietf-cat-kerb-key-derivation-00.txt to the ones in
2281 * draft-brezak-win2k-krb-rc4-hmac-04.txt
2282 */
2283
2284 static krb5_error_code
2285 usage2arcfour (krb5_context context, unsigned *usage)
2286 {
2287 switch (*usage) {
2288 case KRB5_KU_AS_REP_ENC_PART : /* 3 */
2289 case KRB5_KU_TGS_REP_ENC_PART_SUB_KEY : /* 9 */
2290 *usage = 8;
2291 return 0;
2292 case KRB5_KU_USAGE_SEAL : /* 22 */
2293 *usage = 13;
2294 return 0;
2295 case KRB5_KU_USAGE_SIGN : /* 23 */
2296 *usage = 15;
2297 return 0;
2298 case KRB5_KU_USAGE_SEQ: /* 24 */
2299 *usage = 0;
2300 return 0;
2301 default :
2302 return 0;
2303 }
2304 }
2305
2306 static krb5_error_code
2307 ARCFOUR_encrypt(krb5_context context,
2308 struct key_data *key,
2309 void *data,
2310 size_t len,
2311 krb5_boolean encryptp,
2312 int usage,
2313 void *ivec)
2314 {
2315 krb5_error_code ret;
2316 unsigned keyusage = usage;
2317
2318 if((ret = usage2arcfour (context, &keyusage)) != 0)
2319 return ret;
2320
2321 if (encryptp)
2322 return ARCFOUR_subencrypt (context, key, data, len, keyusage, ivec);
2323 else
2324 return ARCFOUR_subdecrypt (context, key, data, len, keyusage, ivec);
2325 }
2326
2327
2328 /*
2329 *
2330 */
2331
2332 static krb5_error_code
2333 AES_PRF(krb5_context context,
2334 krb5_crypto crypto,
2335 const krb5_data *in,
2336 krb5_data *out)
2337 {
2338 struct checksum_type *ct = crypto->et->checksum;
2339 krb5_error_code ret;
2340 Checksum result;
2341 krb5_keyblock *derived;
2342
2343 result.cksumtype = ct->type;
2344 ret = krb5_data_alloc(&result.checksum, ct->checksumsize);
2345 if (ret) {
2346 krb5_set_error_message(context, ret, N_("malloc: out memory", ""));
2347 return ret;
2348 }
2349
2350 ret = (*ct->checksum)(context, NULL, in->data, in->length, 0, &result);
2351 if (ret) {
2352 krb5_data_free(&result.checksum);
2353 return ret;
2354 }
2355
2356 if (result.checksum.length < crypto->et->blocksize)
2357 krb5_abortx(context, "internal prf error");
2358
2359 derived = NULL;
2360 ret = krb5_derive_key(context, crypto->key.key,
2361 crypto->et->type, "prf", 3, &derived);
2362 if (ret)
2363 krb5_abortx(context, "krb5_derive_key");
2364
2365 ret = krb5_data_alloc(out, crypto->et->blocksize);
2366 if (ret)
2367 krb5_abortx(context, "malloc failed");
2368
2369 {
2370 const EVP_CIPHER *c = (*crypto->et->keytype->evp)();
2371 EVP_CIPHER_CTX ctx;
2372
2373 EVP_CIPHER_CTX_init(&ctx); /* ivec all zero */
2374 EVP_CipherInit_ex(&ctx, c, NULL, derived->keyvalue.data, NULL, 1);
2375 EVP_Cipher(&ctx, out->data, result.checksum.data,
2376 crypto->et->blocksize);
2377 EVP_CIPHER_CTX_cleanup(&ctx);
2378 }
2379
2380 krb5_data_free(&result.checksum);
2381 krb5_free_keyblock(context, derived);
2382
2383 return ret;
2384 }
2385
2386 /*
2387 * these should currently be in reverse preference order.
2388 * (only relevant for !F_PSEUDO) */
2389
2390 static struct encryption_type enctype_null = {
2391 ETYPE_NULL,
2392 "null",
2393 1,
2394 1,
2395 0,
2396 &keytype_null,
2397 &checksum_none,
2398 NULL,
2399 F_DISABLED,
2400 NULL_encrypt,
2401 0,
2402 NULL
2403 };
2404 static struct encryption_type enctype_arcfour_hmac_md5 = {
2405 ETYPE_ARCFOUR_HMAC_MD5,
2406 "arcfour-hmac-md5",
2407 1,
2408 1,
2409 8,
2410 &keytype_arcfour,
2411 &checksum_hmac_md5,
2412 NULL,
2413 F_SPECIAL,
2414 ARCFOUR_encrypt,
2415 0,
2416 NULL
2417 };
2418 #ifdef DES3_OLD_ENCTYPE
2419 static struct encryption_type enctype_des3_cbc_md5 = {
2420 ETYPE_DES3_CBC_MD5,
2421 "des3-cbc-md5",
2422 8,
2423 8,
2424 8,
2425 &keytype_des3,
2426 &checksum_rsa_md5,
2427 &checksum_rsa_md5_des3,
2428 0,
2429 evp_encrypt,
2430 0,
2431 NULL
2432 };
2433 #endif
2434 static struct encryption_type enctype_des3_cbc_sha1 = {
2435 ETYPE_DES3_CBC_SHA1,
2436 "des3-cbc-sha1",
2437 8,
2438 8,
2439 8,
2440 &keytype_des3_derived,
2441 &checksum_sha1,
2442 &checksum_hmac_sha1_des3,
2443 F_DERIVED,
2444 evp_encrypt,
2445 0,
2446 NULL
2447 };
2448 #ifdef DES3_OLD_ENCTYPE
2449 static struct encryption_type enctype_old_des3_cbc_sha1 = {
2450 ETYPE_OLD_DES3_CBC_SHA1,
2451 "old-des3-cbc-sha1",
2452 8,
2453 8,
2454 8,
2455 &keytype_des3,
2456 &checksum_sha1,
2457 &checksum_hmac_sha1_des3,
2458 0,
2459 evp_encrypt,
2460 0,
2461 NULL
2462 };
2463 #endif
2464 static struct encryption_type enctype_aes128_cts_hmac_sha1 = {
2465 ETYPE_AES128_CTS_HMAC_SHA1_96,
2466 "aes128-cts-hmac-sha1-96",
2467 16,
2468 1,
2469 16,
2470 &keytype_aes128,
2471 &checksum_sha1,
2472 &checksum_hmac_sha1_aes128,
2473 F_DERIVED,
2474 evp_encrypt,
2475 16,
2476 AES_PRF
2477 };
2478 static struct encryption_type enctype_aes256_cts_hmac_sha1 = {
2479 ETYPE_AES256_CTS_HMAC_SHA1_96,
2480 "aes256-cts-hmac-sha1-96",
2481 16,
2482 1,
2483 16,
2484 &keytype_aes256,
2485 &checksum_sha1,
2486 &checksum_hmac_sha1_aes256,
2487 F_DERIVED,
2488 evp_encrypt,
2489 16,
2490 AES_PRF
2491 };
2492 static struct encryption_type enctype_des3_cbc_none = {
2493 ETYPE_DES3_CBC_NONE,
2494 "des3-cbc-none",
2495 8,
2496 8,
2497 0,
2498 &keytype_des3_derived,
2499 &checksum_none,
2500 NULL,
2501 F_PSEUDO,
2502 evp_encrypt,
2503 0,
2504 NULL
2505 };
2506 #ifdef WEAK_ENCTYPES
2507 static struct encryption_type enctype_des_cbc_crc = {
2508 ETYPE_DES_CBC_CRC,
2509 "des-cbc-crc",
2510 8,
2511 8,
2512 8,
2513 &keytype_des,
2514 &checksum_crc32,
2515 NULL,
2516 F_DISABLED,
2517 evp_des_encrypt_key_ivec,
2518 0,
2519 NULL
2520 };
2521 static struct encryption_type enctype_des_cbc_md4 = {
2522 ETYPE_DES_CBC_MD4,
2523 "des-cbc-md4",
2524 8,
2525 8,
2526 8,
2527 &keytype_des,
2528 &checksum_rsa_md4,
2529 &checksum_rsa_md4_des,
2530 F_DISABLED,
2531 evp_des_encrypt_null_ivec,
2532 0,
2533 NULL
2534 };
2535 static struct encryption_type enctype_des_cbc_md5 = {
2536 ETYPE_DES_CBC_MD5,
2537 "des-cbc-md5",
2538 8,
2539 8,
2540 8,
2541 &keytype_des,
2542 &checksum_rsa_md5,
2543 &checksum_rsa_md5_des,
2544 F_DISABLED,
2545 evp_des_encrypt_null_ivec,
2546 0,
2547 NULL
2548 };
2549 static struct encryption_type enctype_des_cbc_none = {
2550 ETYPE_DES_CBC_NONE,
2551 "des-cbc-none",
2552 8,
2553 8,
2554 0,
2555 &keytype_des,
2556 &checksum_none,
2557 NULL,
2558 F_PSEUDO|F_DISABLED,
2559 evp_des_encrypt_null_ivec,
2560 0,
2561 NULL
2562 };
2563 static struct encryption_type enctype_des_cfb64_none = {
2564 ETYPE_DES_CFB64_NONE,
2565 "des-cfb64-none",
2566 1,
2567 1,
2568 0,
2569 &keytype_des_old,
2570 &checksum_none,
2571 NULL,
2572 F_PSEUDO|F_DISABLED,
2573 DES_CFB64_encrypt_null_ivec,
2574 0,
2575 NULL
2576 };
2577 static struct encryption_type enctype_des_pcbc_none = {
2578 ETYPE_DES_PCBC_NONE,
2579 "des-pcbc-none",
2580 8,
2581 8,
2582 0,
2583 &keytype_des_old,
2584 &checksum_none,
2585 NULL,
2586 F_PSEUDO|F_DISABLED,
2587 DES_PCBC_encrypt_key_ivec,
2588 0,
2589 NULL
2590 };
2591 #endif /* WEAK_ENCTYPES */
2592
2593 static struct encryption_type *etypes[] = {
2594 &enctype_aes256_cts_hmac_sha1,
2595 &enctype_aes128_cts_hmac_sha1,
2596 &enctype_des3_cbc_sha1,
2597 &enctype_des3_cbc_none, /* used by the gss-api mech */
2598 &enctype_arcfour_hmac_md5,
2599 #ifdef DES3_OLD_ENCTYPE
2600 &enctype_des3_cbc_md5,
2601 &enctype_old_des3_cbc_sha1,
2602 #endif
2603 #ifdef WEAK_ENCTYPES
2604 &enctype_des_cbc_crc,
2605 &enctype_des_cbc_md4,
2606 &enctype_des_cbc_md5,
2607 &enctype_des_cbc_none,
2608 &enctype_des_cfb64_none,
2609 &enctype_des_pcbc_none,
2610 #endif
2611 &enctype_null
2612 };
2613
2614 static unsigned num_etypes = sizeof(etypes) / sizeof(etypes[0]);
2615
2616
2617 static struct encryption_type *
2618 _find_enctype(krb5_enctype type)
2619 {
2620 int i;
2621 for(i = 0; i < num_etypes; i++)
2622 if(etypes[i]->type == type)
2623 return etypes[i];
2624 return NULL;
2625 }
2626
2627
2628 krb5_error_code KRB5_LIB_FUNCTION
2629 krb5_enctype_to_string(krb5_context context,
2630 krb5_enctype etype,
2631 char **string)
2632 {
2633 struct encryption_type *e;
2634 e = _find_enctype(etype);
2635 if(e == NULL) {
2636 krb5_set_error_message (context, KRB5_PROG_ETYPE_NOSUPP,
2637 N_("encryption type %d not supported", ""),
2638 etype);
2639 *string = NULL;
2640 return KRB5_PROG_ETYPE_NOSUPP;
2641 }
2642 *string = strdup(e->name);
2643 if(*string == NULL) {
2644 krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
2645 return ENOMEM;
2646 }
2647 return 0;
2648 }
2649
2650 krb5_error_code KRB5_LIB_FUNCTION
2651 krb5_string_to_enctype(krb5_context context,
2652 const char *string,
2653 krb5_enctype *etype)
2654 {
2655 int i;
2656 for(i = 0; i < num_etypes; i++)
2657 if(strcasecmp(etypes[i]->name, string) == 0){
2658 *etype = etypes[i]->type;
2659 return 0;
2660 }
2661 krb5_set_error_message (context, KRB5_PROG_ETYPE_NOSUPP,
2662 N_("encryption type %s not supported", ""),
2663 string);
2664 return KRB5_PROG_ETYPE_NOSUPP;
2665 }
2666
2667 krb5_error_code KRB5_LIB_FUNCTION
2668 krb5_enctype_to_keytype(krb5_context context,
2669 krb5_enctype etype,
2670 krb5_keytype *keytype)
2671 {
2672 struct encryption_type *e = _find_enctype(etype);
2673 if(e == NULL) {
2674 krb5_set_error_message (context, KRB5_PROG_ETYPE_NOSUPP,
2675 N_("encryption type %d not supported", ""),
2676 etype);
2677 return KRB5_PROG_ETYPE_NOSUPP;
2678 }
2679 *keytype = e->keytype->type; /* XXX */
2680 return 0;
2681 }
2682
2683 krb5_error_code KRB5_LIB_FUNCTION
2684 krb5_enctype_valid(krb5_context context,
2685 krb5_enctype etype)
2686 {
2687 struct encryption_type *e = _find_enctype(etype);
2688 if(e == NULL) {
2689 krb5_set_error_message (context, KRB5_PROG_ETYPE_NOSUPP,
2690 N_("encryption type %d not supported", ""),
2691 etype);
2692 return KRB5_PROG_ETYPE_NOSUPP;
2693 }
2694 if (e->flags & F_DISABLED) {
2695 krb5_set_error_message (context, KRB5_PROG_ETYPE_NOSUPP,
2696 N_("encryption type %s is disabled", ""),
2697 e->name);
2698 return KRB5_PROG_ETYPE_NOSUPP;
2699 }
2700 return 0;
2701 }
2702
2703 /**
2704 * Return the coresponding encryption type for a checksum type.
2705 *
2706 * @param context Kerberos context
2707 * @param ctype The checksum type to get the result enctype for
2708 * @param etype The returned encryption, when the matching etype is
2709 * not found, etype is set to ETYPE_NULL.
2710 *
2711 * @return Return an error code for an failure or 0 on success.
2712 * @ingroup krb5_crypto
2713 */
2714
2715
2716 krb5_error_code KRB5_LIB_FUNCTION
2717 krb5_cksumtype_to_enctype(krb5_context context,
2718 krb5_cksumtype ctype,
2719 krb5_enctype *etype)
2720 {
2721 int i;
2722
2723 *etype = ETYPE_NULL;
2724
2725 for(i = 0; i < num_etypes; i++) {
2726 if(etypes[i]->keyed_checksum &&
2727 etypes[i]->keyed_checksum->type == ctype)
2728 {
2729 *etype = etypes[i]->type;
2730 return 0;
2731 }
2732 }
2733
2734 krb5_set_error_message (context, KRB5_PROG_SUMTYPE_NOSUPP,
2735 N_("checksum type %d not supported", ""),
2736 (int)ctype);
2737 return KRB5_PROG_SUMTYPE_NOSUPP;
2738 }
2739
2740
2741 krb5_error_code KRB5_LIB_FUNCTION
2742 krb5_cksumtype_valid(krb5_context context,
2743 krb5_cksumtype ctype)
2744 {
2745 struct checksum_type *c = _find_checksum(ctype);
2746 if (c == NULL) {
2747 krb5_set_error_message (context, KRB5_PROG_SUMTYPE_NOSUPP,
2748 N_("checksum type %d not supported", ""),
2749 ctype);
2750 return KRB5_PROG_SUMTYPE_NOSUPP;
2751 }
2752 if (c->flags & F_DISABLED) {
2753 krb5_set_error_message (context, KRB5_PROG_SUMTYPE_NOSUPP,
2754 N_("checksum type %s is disabled", ""),
2755 c->name);
2756 return KRB5_PROG_SUMTYPE_NOSUPP;
2757 }
2758 return 0;
2759 }
2760
2761
2762 static krb5_boolean
2763 derived_crypto(krb5_context context,
2764 krb5_crypto crypto)
2765 {
2766 return (crypto->et->flags & F_DERIVED) != 0;
2767 }
2768
2769 static krb5_boolean
2770 special_crypto(krb5_context context,
2771 krb5_crypto crypto)
2772 {
2773 return (crypto->et->flags & F_SPECIAL) != 0;
2774 }
2775
2776 #define CHECKSUMSIZE(C) ((C)->checksumsize)
2777 #define CHECKSUMTYPE(C) ((C)->type)
2778
2779 static krb5_error_code
2780 encrypt_internal_derived(krb5_context context,
2781 krb5_crypto crypto,
2782 unsigned usage,
2783 const void *data,
2784 size_t len,
2785 krb5_data *result,
2786 void *ivec)
2787 {
2788 size_t sz, block_sz, checksum_sz, total_sz;
2789 Checksum cksum;
2790 unsigned char *p, *q;
2791 krb5_error_code ret;
2792 struct key_data *dkey;
2793 const struct encryption_type *et = crypto->et;
2794
2795 checksum_sz = CHECKSUMSIZE(et->keyed_checksum);
2796
2797 sz = et->confoundersize + len;
2798 block_sz = (sz + et->padsize - 1) &~ (et->padsize - 1); /* pad */
2799 total_sz = block_sz + checksum_sz;
2800 p = calloc(1, total_sz);
2801 if(p == NULL) {
2802 krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
2803 return ENOMEM;
2804 }
2805
2806 q = p;
2807 krb5_generate_random_block(q, et->confoundersize); /* XXX */
2808 q += et->confoundersize;
2809 memcpy(q, data, len);
2810
2811 ret = create_checksum(context,
2812 et->keyed_checksum,
2813 crypto,
2814 INTEGRITY_USAGE(usage),
2815 p,
2816 block_sz,
2817 &cksum);
2818 if(ret == 0 && cksum.checksum.length != checksum_sz) {
2819 free_Checksum (&cksum);
2820 krb5_clear_error_message (context);
2821 ret = KRB5_CRYPTO_INTERNAL;
2822 }
2823 if(ret)
2824 goto fail;
2825 memcpy(p + block_sz, cksum.checksum.data, cksum.checksum.length);
2826 free_Checksum (&cksum);
2827 ret = _get_derived_key(context, crypto, ENCRYPTION_USAGE(usage), &dkey);
2828 if(ret)
2829 goto fail;
2830 ret = _key_schedule(context, dkey);
2831 if(ret)
2832 goto fail;
2833 ret = (*et->encrypt)(context, dkey, p, block_sz, 1, usage, ivec);
2834 if (ret)
2835 goto fail;
2836 result->data = p;
2837 result->length = total_sz;
2838 return 0;
2839 fail:
2840 memset(p, 0, total_sz);
2841 free(p);
2842 return ret;
2843 }
2844
2845
2846 static krb5_error_code
2847 encrypt_internal(krb5_context context,
2848 krb5_crypto crypto,
2849 const void *data,
2850 size_t len,
2851 krb5_data *result,
2852 void *ivec)
2853 {
2854 size_t sz, block_sz, checksum_sz;
2855 Checksum cksum;
2856 unsigned char *p, *q;
2857 krb5_error_code ret;
2858 const struct encryption_type *et = crypto->et;
2859
2860 checksum_sz = CHECKSUMSIZE(et->checksum);
2861
2862 sz = et->confoundersize + checksum_sz + len;
2863 block_sz = (sz + et->padsize - 1) &~ (et->padsize - 1); /* pad */
2864 p = calloc(1, block_sz);
2865 if(p == NULL) {
2866 krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
2867 return ENOMEM;
2868 }
2869
2870 q = p;
2871 krb5_generate_random_block(q, et->confoundersize); /* XXX */
2872 q += et->confoundersize;
2873 memset(q, 0, checksum_sz);
2874 q += checksum_sz;
2875 memcpy(q, data, len);
2876
2877 ret = create_checksum(context,
2878 et->checksum,
2879 crypto,
2880 0,
2881 p,
2882 block_sz,
2883 &cksum);
2884 if(ret == 0 && cksum.checksum.length != checksum_sz) {
2885 krb5_clear_error_message (context);
2886 free_Checksum(&cksum);
2887 ret = KRB5_CRYPTO_INTERNAL;
2888 }
2889 if(ret)
2890 goto fail;
2891 memcpy(p + et->confoundersize, cksum.checksum.data, cksum.checksum.length);
2892 free_Checksum(&cksum);
2893 ret = _key_schedule(context, &crypto->key);
2894 if(ret)
2895 goto fail;
2896 ret = (*et->encrypt)(context, &crypto->key, p, block_sz, 1, 0, ivec);
2897 if (ret) {
2898 memset(p, 0, block_sz);
2899 free(p);
2900 return ret;
2901 }
2902 result->data = p;
2903 result->length = block_sz;
2904 return 0;
2905 fail:
2906 memset(p, 0, block_sz);
2907 free(p);
2908 return ret;
2909 }
2910
2911 static krb5_error_code
2912 encrypt_internal_special(krb5_context context,
2913 krb5_crypto crypto,
2914 int usage,
2915 const void *data,
2916 size_t len,
2917 krb5_data *result,
2918 void *ivec)
2919 {
2920 struct encryption_type *et = crypto->et;
2921 size_t cksum_sz = CHECKSUMSIZE(et->checksum);
2922 size_t sz = len + cksum_sz + et->confoundersize;
2923 char *tmp, *p;
2924 krb5_error_code ret;
2925
2926 tmp = malloc (sz);
2927 if (tmp == NULL) {
2928 krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
2929 return ENOMEM;
2930 }
2931 p = tmp;
2932 memset (p, 0, cksum_sz);
2933 p += cksum_sz;
2934 krb5_generate_random_block(p, et->confoundersize);
2935 p += et->confoundersize;
2936 memcpy (p, data, len);
2937 ret = (*et->encrypt)(context, &crypto->key, tmp, sz, TRUE, usage, ivec);
2938 if (ret) {
2939 memset(tmp, 0, sz);
2940 free(tmp);
2941 return ret;
2942 }
2943 result->data = tmp;
2944 result->length = sz;
2945 return 0;
2946 }
2947
2948 static krb5_error_code
2949 decrypt_internal_derived(krb5_context context,
2950 krb5_crypto crypto,
2951 unsigned usage,
2952 void *data,
2953 size_t len,
2954 krb5_data *result,
2955 void *ivec)
2956 {
2957 size_t checksum_sz;
2958 Checksum cksum;
2959 unsigned char *p;
2960 krb5_error_code ret;
2961 struct key_data *dkey;
2962 struct encryption_type *et = crypto->et;
2963 unsigned long l;
2964
2965 checksum_sz = CHECKSUMSIZE(et->keyed_checksum);
2966 if (len < checksum_sz + et->confoundersize) {
2967 krb5_set_error_message(context, KRB5_BAD_MSIZE,
2968 N_("Encrypted data shorter then "
2969 "checksum + confunder", ""));
2970 return KRB5_BAD_MSIZE;
2971 }
2972
2973 if (((len - checksum_sz) % et->padsize) != 0) {
2974 krb5_clear_error_message(context);
2975 return KRB5_BAD_MSIZE;
2976 }
2977
2978 p = malloc(len);
2979 if(len != 0 && p == NULL) {
2980 krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
2981 return ENOMEM;
2982 }
2983 memcpy(p, data, len);
2984
2985 len -= checksum_sz;
2986
2987 ret = _get_derived_key(context, crypto, ENCRYPTION_USAGE(usage), &dkey);
2988 if(ret) {
2989 free(p);
2990 return ret;
2991 }
2992 ret = _key_schedule(context, dkey);
2993 if(ret) {
2994 free(p);
2995 return ret;
2996 }
2997 ret = (*et->encrypt)(context, dkey, p, len, 0, usage, ivec);
2998 if (ret) {
2999 free(p);
3000 return ret;
3001 }
3002
3003 cksum.checksum.data = p + len;
3004 cksum.checksum.length = checksum_sz;
3005 cksum.cksumtype = CHECKSUMTYPE(et->keyed_checksum);
3006
3007 ret = verify_checksum(context,
3008 crypto,
3009 INTEGRITY_USAGE(usage),
3010 p,
3011 len,
3012 &cksum);
3013 if(ret) {
3014 free(p);
3015 return ret;
3016 }
3017 l = len - et->confoundersize;
3018 memmove(p, p + et->confoundersize, l);
3019 result->data = realloc(p, l);
3020 if(result->data == NULL && l != 0) {
3021 free(p);
3022 krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
3023 return ENOMEM;
3024 }
3025 result->length = l;
3026 return 0;
3027 }
3028
3029 static krb5_error_code
3030 decrypt_internal(krb5_context context,
3031 krb5_crypto crypto,
3032 void *data,
3033 size_t len,
3034 krb5_data *result,
3035 void *ivec)
3036 {
3037 krb5_error_code ret;
3038 unsigned char *p;
3039 Checksum cksum;
3040 size_t checksum_sz, l;
3041 struct encryption_type *et = crypto->et;
3042
3043 if ((len % et->padsize) != 0) {
3044 krb5_clear_error_message(context);
3045 return KRB5_BAD_MSIZE;
3046 }
3047
3048 checksum_sz = CHECKSUMSIZE(et->checksum);
3049 p = malloc(len);
3050 if(len != 0 && p == NULL) {
3051 krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
3052 return ENOMEM;
3053 }
3054 memcpy(p, data, len);
3055
3056 ret = _key_schedule(context, &crypto->key);
3057 if(ret) {
3058 free(p);
3059 return ret;
3060 }
3061 ret = (*et->encrypt)(context, &crypto->key, p, len, 0, 0, ivec);
3062 if (ret) {
3063 free(p);
3064 return ret;
3065 }
3066 ret = krb5_data_copy(&cksum.checksum, p + et->confoundersize, checksum_sz);
3067 if(ret) {
3068 free(p);
3069 return ret;
3070 }
3071 memset(p + et->confoundersize, 0, checksum_sz);
3072 cksum.cksumtype = CHECKSUMTYPE(et->checksum);
3073 ret = verify_checksum(context, NULL, 0, p, len, &cksum);
3074 free_Checksum(&cksum);
3075 if(ret) {
3076 free(p);
3077 return ret;
3078 }
3079 l = len - et->confoundersize - checksum_sz;
3080 memmove(p, p + et->confoundersize + checksum_sz, l);
3081 result->data = realloc(p, l);
3082 if(result->data == NULL && l != 0) {
3083 free(p);
3084 krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
3085 return ENOMEM;
3086 }
3087 result->length = l;
3088 return 0;
3089 }
3090
3091 static krb5_error_code
3092 decrypt_internal_special(krb5_context context,
3093 krb5_crypto crypto,
3094 int usage,
3095 void *data,
3096 size_t len,
3097 krb5_data *result,
3098 void *ivec)
3099 {
3100 struct encryption_type *et = crypto->et;
3101 size_t cksum_sz = CHECKSUMSIZE(et->checksum);
3102 size_t sz = len - cksum_sz - et->confoundersize;
3103 unsigned char *p;
3104 krb5_error_code ret;
3105
3106 if ((len % et->padsize) != 0) {
3107 krb5_clear_error_message(context);
3108 return KRB5_BAD_MSIZE;
3109 }
3110
3111 p = malloc (len);
3112 if (p == NULL) {
3113 krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
3114 return ENOMEM;
3115 }
3116 memcpy(p, data, len);
3117
3118 ret = (*et->encrypt)(context, &crypto->key, p, len, FALSE, usage, ivec);
3119 if (ret) {
3120 free(p);
3121 return ret;
3122 }
3123
3124 memmove (p, p + cksum_sz + et->confoundersize, sz);
3125 result->data = realloc(p, sz);
3126 if(result->data == NULL && sz != 0) {
3127 free(p);
3128 krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
3129 return ENOMEM;
3130 }
3131 result->length = sz;
3132 return 0;
3133 }
3134
3135 static krb5_crypto_iov *
3136 find_iv(krb5_crypto_iov *data, int num_data, int type)
3137 {
3138 int i;
3139 for (i = 0; i < num_data; i++)
3140 if (data[i].flags == type)
3141 return &data[i];
3142 return NULL;
3143 }
3144
3145 /**
3146 * Inline encrypt a kerberos message
3147 *
3148 * @param context Kerberos context
3149 * @param crypto Kerberos crypto context
3150 * @param usage Key usage for this buffer
3151 * @param data array of buffers to process
3152 * @param num_data length of array
3153 * @param ivec initial cbc/cts vector
3154 *
3155 * @return Return an error code or 0.
3156 * @ingroup krb5_crypto
3157 *
3158 * Kerberos encrypted data look like this:
3159 *
3160 * 1. KRB5_CRYPTO_TYPE_HEADER
3161 * 2. array [1,...] KRB5_CRYPTO_TYPE_DATA and array [0,...]
3162 * KRB5_CRYPTO_TYPE_SIGN_ONLY in any order, however the receiver
3163 * have to aware of the order. KRB5_CRYPTO_TYPE_SIGN_ONLY is
3164 * commonly used headers and trailers.
3165 * 3. KRB5_CRYPTO_TYPE_PADDING, at least on padsize long if padsize > 1
3166 * 4. KRB5_CRYPTO_TYPE_TRAILER
3167 */
3168
3169 krb5_error_code KRB5_LIB_FUNCTION
3170 krb5_encrypt_iov_ivec(krb5_context context,
3171 krb5_crypto crypto,
3172 unsigned usage,
3173 krb5_crypto_iov *data,
3174 int num_data,
3175 void *ivec)
3176 {
3177 size_t headersz, trailersz, len;
3178 int i;
3179 size_t sz, block_sz, pad_sz;
3180 Checksum cksum;
3181 unsigned char *p, *q;
3182 krb5_error_code ret;
3183 struct key_data *dkey;
3184 const struct encryption_type *et = crypto->et;
3185 krb5_crypto_iov *tiv, *piv, *hiv;
3186
3187 if (num_data < 0) {
3188 krb5_clear_error_message(context);
3189 return KRB5_CRYPTO_INTERNAL;
3190 }
3191
3192 if(!derived_crypto(context, crypto)) {
3193 krb5_clear_error_message(context);
3194 return KRB5_CRYPTO_INTERNAL;
3195 }
3196
3197 headersz = et->confoundersize;
3198 trailersz = CHECKSUMSIZE(et->keyed_checksum);
3199
3200 for (len = 0, i = 0; i < num_data; i++) {
3201 if (data[i].flags != KRB5_CRYPTO_TYPE_DATA)
3202 continue;
3203 len += data[i].data.length;
3204 }
3205
3206 sz = headersz + len;
3207 block_sz = (sz + et->padsize - 1) &~ (et->padsize - 1); /* pad */
3208
3209 pad_sz = block_sz - sz;
3210
3211 /* header */
3212
3213 hiv = find_iv(data, num_data, KRB5_CRYPTO_TYPE_HEADER);
3214 if (hiv == NULL || hiv->data.length != headersz)
3215 return KRB5_BAD_MSIZE;
3216
3217 krb5_generate_random_block(hiv->data.data, hiv->data.length);
3218
3219 /* padding */
3220 piv = find_iv(data, num_data, KRB5_CRYPTO_TYPE_PADDING);
3221 /* its ok to have no TYPE_PADDING if there is no padding */
3222 if (piv == NULL && pad_sz != 0)
3223 return KRB5_BAD_MSIZE;
3224 if (piv) {
3225 if (piv->data.length < pad_sz)
3226 return KRB5_BAD_MSIZE;
3227 piv->data.length = pad_sz;
3228 if (pad_sz)
3229 memset(piv->data.data, pad_sz, pad_sz);
3230 else
3231 piv = NULL;
3232 }
3233
3234 /* trailer */
3235 tiv = find_iv(data, num_data, KRB5_CRYPTO_TYPE_TRAILER);
3236 if (tiv == NULL || tiv->data.length != trailersz)
3237 return KRB5_BAD_MSIZE;
3238
3239 /*
3240 * XXX replace with EVP_Sign? at least make create_checksum an iov
3241 * function.
3242 * XXX CTS EVP is broken, can't handle multi buffers :(
3243 */
3244
3245 len = block_sz;
3246 for (i = 0; i < num_data; i++) {
3247 if (data[i].flags != KRB5_CRYPTO_TYPE_SIGN_ONLY)
3248 continue;
3249 len += data[i].data.length;
3250 }
3251
3252 p = q = malloc(len);
3253
3254 memcpy(q, hiv->data.data, hiv->data.length);
3255 q += hiv->data.length;
3256 for (i = 0; i < num_data; i++) {
3257 if (data[i].flags != KRB5_CRYPTO_TYPE_DATA &&
3258 data[i].flags != KRB5_CRYPTO_TYPE_SIGN_ONLY)
3259 continue;
3260 memcpy(q, data[i].data.data, data[i].data.length);
3261 q += data[i].data.length;
3262 }
3263 if (piv)
3264 memset(q, 0, piv->data.length);
3265
3266 ret = create_checksum(context,
3267 et->keyed_checksum,
3268 crypto,
3269 INTEGRITY_USAGE(usage),
3270 p,
3271 len,
3272 &cksum);
3273 free(p);
3274 if(ret == 0 && cksum.checksum.length != trailersz) {
3275 free_Checksum (&cksum);
3276 krb5_clear_error_message (context);
3277 ret = KRB5_CRYPTO_INTERNAL;
3278 }
3279 if(ret)
3280 return ret;
3281
3282 /* save cksum at end */
3283 memcpy(tiv->data.data, cksum.checksum.data, cksum.checksum.length);
3284 free_Checksum (&cksum);
3285
3286 /* XXX replace with EVP_Cipher */
3287 p = q = malloc(block_sz);
3288 if(p == NULL)
3289 return ENOMEM;
3290
3291 memcpy(q, hiv->data.data, hiv->data.length);
3292 q += hiv->data.length;
3293
3294 for (i = 0; i < num_data; i++) {
3295 if (data[i].flags != KRB5_CRYPTO_TYPE_DATA)
3296 continue;
3297 memcpy(q, data[i].data.data, data[i].data.length);
3298 q += data[i].data.length;
3299 }
3300 if (piv)
3301 memset(q, 0, piv->data.length);
3302
3303
3304 ret = _get_derived_key(context, crypto, ENCRYPTION_USAGE(usage), &dkey);
3305 if(ret) {
3306 free(p);
3307 return ret;
3308 }
3309 ret = _key_schedule(context, dkey);
3310 if(ret) {
3311 free(p);
3312 return ret;
3313 }
3314
3315 ret = (*et->encrypt)(context, dkey, p, block_sz, 1, usage, ivec);
3316 if (ret) {
3317 free(p);
3318 return ret;
3319 }
3320
3321 /* now copy data back to buffers */
3322 q = p;
3323
3324 memcpy(hiv->data.data, q, hiv->data.length);
3325 q += hiv->data.length;
3326
3327 for (i = 0; i < num_data; i++) {
3328 if (data[i].flags != KRB5_CRYPTO_TYPE_DATA)
3329 continue;
3330 memcpy(data[i].data.data, q, data[i].data.length);
3331 q += data[i].data.length;
3332 }
3333 if (piv)
3334 memcpy(piv->data.data, q, pad_sz);
3335
3336 free(p);
3337
3338 return ret;
3339 }
3340
3341 /**
3342 * Inline decrypt a Kerberos message.
3343 *
3344 * @param context Kerberos context
3345 * @param crypto Kerberos crypto context
3346 * @param usage Key usage for this buffer
3347 * @param data array of buffers to process
3348 * @param num_data length of array
3349 * @param ivec initial cbc/cts vector
3350 *
3351 * @return Return an error code or 0.
3352 * @ingroup krb5_crypto
3353 *
3354 * 1. KRB5_CRYPTO_TYPE_HEADER
3355 * 2. one KRB5_CRYPTO_TYPE_DATA and array [0,...] of KRB5_CRYPTO_TYPE_SIGN_ONLY in
3356 * any order, however the receiver have to aware of the
3357 * order. KRB5_CRYPTO_TYPE_SIGN_ONLY is commonly used unencrypoted
3358 * protocol headers and trailers. The output data will be of same
3359 * size as the input data or shorter.
3360 */
3361
3362 krb5_error_code KRB5_LIB_FUNCTION
3363 krb5_decrypt_iov_ivec(krb5_context context,
3364 krb5_crypto crypto,
3365 unsigned usage,
3366 krb5_crypto_iov *data,
3367 unsigned int num_data,
3368 void *ivec)
3369 {
3370 unsigned int i;
3371 size_t headersz, trailersz, len;
3372 Checksum cksum;
3373 unsigned char *p, *q;
3374 krb5_error_code ret;
3375 struct key_data *dkey;
3376 struct encryption_type *et = crypto->et;
3377 krb5_crypto_iov *tiv, *hiv;
3378
3379 if (num_data < 0) {
3380 krb5_clear_error_message(context);
3381 return KRB5_CRYPTO_INTERNAL;
3382 }
3383
3384 if(!derived_crypto(context, crypto)) {
3385 krb5_clear_error_message(context);
3386 return KRB5_CRYPTO_INTERNAL;
3387 }
3388
3389 headersz = et->confoundersize;
3390
3391 hiv = find_iv(data, num_data, KRB5_CRYPTO_TYPE_HEADER);
3392 if (hiv == NULL || hiv->data.length != headersz)
3393 return KRB5_BAD_MSIZE;
3394
3395 /* trailer */
3396 trailersz = CHECKSUMSIZE(et->keyed_checksum);
3397
3398 tiv = find_iv(data, num_data, KRB5_CRYPTO_TYPE_TRAILER);
3399 if (tiv->data.length != trailersz)
3400 return KRB5_BAD_MSIZE;
3401
3402 /* Find length of data we will decrypt */
3403
3404 len = headersz;
3405 for (i = 0; i < num_data; i++) {
3406 if (data[i].flags != KRB5_CRYPTO_TYPE_DATA)
3407 continue;
3408 len += data[i].data.length;
3409 }
3410
3411 if ((len % et->padsize) != 0) {
3412 krb5_clear_error_message(context);
3413 return KRB5_BAD_MSIZE;
3414 }
3415
3416 /* XXX replace with EVP_Cipher */
3417
3418 p = q = malloc(len);
3419 if (p == NULL)
3420 return ENOMEM;
3421
3422 memcpy(q, hiv->data.data, hiv->data.length);
3423 q += hiv->data.length;
3424
3425 for (i = 0; i < num_data; i++) {
3426 if (data[i].flags != KRB5_CRYPTO_TYPE_DATA)
3427 continue;
3428 memcpy(q, data[i].data.data, data[i].data.length);
3429 q += data[i].data.length;
3430 }
3431
3432 ret = _get_derived_key(context, crypto, ENCRYPTION_USAGE(usage), &dkey);
3433 if(ret) {
3434 free(p);
3435 return ret;
3436 }
3437 ret = _key_schedule(context, dkey);
3438 if(ret) {
3439 free(p);
3440 return ret;
3441 }
3442
3443 ret = (*et->encrypt)(context, dkey, p, len, 0, usage, ivec);
3444 if (ret) {
3445 free(p);
3446 return ret;
3447 }
3448
3449 /* copy data back to buffers */
3450 memcpy(hiv->data.data, p, hiv->data.length);
3451 q = p + hiv->data.length;
3452 for (i = 0; i < num_data; i++) {
3453 if (data[i].flags != KRB5_CRYPTO_TYPE_DATA)
3454 continue;
3455 memcpy(data[i].data.data, q, data[i].data.length);
3456 q += data[i].data.length;
3457 }
3458
3459 free(p);
3460
3461 /* check signature */
3462 for (i = 0; i < num_data; i++) {
3463 if (data[i].flags != KRB5_CRYPTO_TYPE_SIGN_ONLY)
3464 continue;
3465 len += data[i].data.length;
3466 }
3467
3468 p = q = malloc(len);
3469 if (p == NULL)
3470 return ENOMEM;
3471
3472 memcpy(q, hiv->data.data, hiv->data.length);
3473 q += hiv->data.length;
3474 for (i = 0; i < num_data; i++) {
3475 if (data[i].flags != KRB5_CRYPTO_TYPE_DATA &&
3476 data[i].flags != KRB5_CRYPTO_TYPE_SIGN_ONLY)
3477 continue;
3478 memcpy(q, data[i].data.data, data[i].data.length);
3479 q += data[i].data.length;
3480 }
3481
3482 cksum.checksum.data = tiv->data.data;
3483 cksum.checksum.length = tiv->data.length;
3484 cksum.cksumtype = CHECKSUMTYPE(et->keyed_checksum);
3485
3486 ret = verify_checksum(context,
3487 crypto,
3488 INTEGRITY_USAGE(usage),
3489 p,
3490 len,
3491 &cksum);
3492 free(p);
3493 return ret;
3494 }
3495
3496 /**
3497 * Create a Kerberos message checksum.
3498 *
3499 * @param context Kerberos context
3500 * @param crypto Kerberos crypto context
3501 * @param usage Key usage for this buffer
3502 * @param data array of buffers to process
3503 * @param num_data length of array
3504 * @param type output data
3505 *
3506 * @return Return an error code or 0.
3507 * @ingroup krb5_crypto
3508 */
3509
3510 krb5_error_code KRB5_LIB_FUNCTION
3511 krb5_create_checksum_iov(krb5_context context,
3512 krb5_crypto crypto,
3513 unsigned usage,
3514 krb5_crypto_iov *data,
3515 unsigned int num_data,
3516 krb5_cksumtype *type)
3517 {
3518 Checksum cksum;
3519 krb5_crypto_iov *civ;
3520 krb5_error_code ret;
3521 int i;
3522 size_t len;
3523 char *p, *q;
3524
3525 if (num_data < 0) {
3526 krb5_clear_error_message(context);
3527 return KRB5_CRYPTO_INTERNAL;
3528 }
3529
3530 if(!derived_crypto(context, crypto)) {
3531 krb5_clear_error_message(context);
3532 return KRB5_CRYPTO_INTERNAL;
3533 }
3534
3535 civ = find_iv(data, num_data, KRB5_CRYPTO_TYPE_CHECKSUM);
3536 if (civ == NULL)
3537 return KRB5_BAD_MSIZE;
3538
3539 len = 0;
3540 for (i = 0; i < num_data; i++) {
3541 if (data[i].flags != KRB5_CRYPTO_TYPE_DATA &&
3542 data[i].flags != KRB5_CRYPTO_TYPE_SIGN_ONLY)
3543 continue;
3544 len += data[i].data.length;
3545 }
3546
3547 p = q = malloc(len);
3548
3549 for (i = 0; i < num_data; i++) {
3550 if (data[i].flags != KRB5_CRYPTO_TYPE_DATA &&
3551 data[i].flags != KRB5_CRYPTO_TYPE_SIGN_ONLY)
3552 continue;
3553 memcpy(q, data[i].data.data, data[i].data.length);
3554 q += data[i].data.length;
3555 }
3556
3557 ret = krb5_create_checksum(context, crypto, usage, 0, p, len, &cksum);
3558 free(p);
3559 if (ret)
3560 return ret;
3561
3562 if (type)
3563 *type = cksum.cksumtype;
3564
3565 if (cksum.checksum.length > civ->data.length) {
3566 krb5_set_error_message(context, KRB5_BAD_MSIZE,
3567 N_("Checksum larger then input buffer", ""));
3568 free_Checksum(&cksum);
3569 return KRB5_BAD_MSIZE;
3570 }
3571
3572 civ->data.length = cksum.checksum.length;
3573 memcpy(civ->data.data, cksum.checksum.data, civ->data.length);
3574 free_Checksum(&cksum);
3575
3576 return 0;
3577 }
3578
3579 /**
3580 * Verify a Kerberos message checksum.
3581 *
3582 * @param context Kerberos context
3583 * @param crypto Kerberos crypto context
3584 * @param usage Key usage for this buffer
3585 * @param data array of buffers to process
3586 * @param num_data length of array
3587 *
3588 * @return Return an error code or 0.
3589 * @ingroup krb5_crypto
3590 */
3591
3592 krb5_error_code KRB5_LIB_FUNCTION
3593 krb5_verify_checksum_iov(krb5_context context,
3594 krb5_crypto crypto,
3595 unsigned usage,
3596 krb5_crypto_iov *data,
3597 unsigned int num_data,
3598 krb5_cksumtype *type)
3599 {
3600 struct encryption_type *et = crypto->et;
3601 Checksum cksum;
3602 krb5_crypto_iov *civ;
3603 krb5_error_code ret;
3604 int i;
3605 size_t len;
3606 char *p, *q;
3607
3608 if (num_data < 0) {
3609 krb5_clear_error_message(context);
3610 return KRB5_CRYPTO_INTERNAL;
3611 }
3612
3613 if(!derived_crypto(context, crypto)) {
3614 krb5_clear_error_message(context);
3615 return KRB5_CRYPTO_INTERNAL;
3616 }
3617
3618 civ = find_iv(data, num_data, KRB5_CRYPTO_TYPE_CHECKSUM);
3619 if (civ == NULL)
3620 return KRB5_BAD_MSIZE;
3621
3622 len = 0;
3623 for (i = 0; i < num_data; i++) {
3624 if (data[i].flags != KRB5_CRYPTO_TYPE_DATA &&
3625 data[i].flags != KRB5_CRYPTO_TYPE_SIGN_ONLY)
3626 continue;
3627 len += data[i].data.length;
3628 }
3629
3630 p = q = malloc(len);
3631
3632 for (i = 0; i < num_data; i++) {
3633 if (data[i].flags != KRB5_CRYPTO_TYPE_DATA &&
3634 data[i].flags != KRB5_CRYPTO_TYPE_SIGN_ONLY)
3635 continue;
3636 memcpy(q, data[i].data.data, data[i].data.length);
3637 q += data[i].data.length;
3638 }
3639
3640 cksum.cksumtype = CHECKSUMTYPE(et->keyed_checksum);
3641 cksum.checksum.length = civ->data.length;
3642 cksum.checksum.data = civ->data.data;
3643
3644 ret = krb5_verify_checksum(context, crypto, usage, p, len, &cksum);
3645 free(p);
3646
3647 if (ret == 0 && type)
3648 *type = cksum.cksumtype;
3649
3650 return ret;
3651 }
3652
3653
3654 krb5_error_code KRB5_LIB_FUNCTION
3655 krb5_crypto_length(krb5_context context,
3656 krb5_crypto crypto,
3657 int type,
3658 size_t *len)
3659 {
3660 if (!derived_crypto(context, crypto)) {
3661 krb5_set_error_message(context, EINVAL, "not a derived crypto");
3662 return EINVAL;
3663 }
3664
3665 switch(type) {
3666 case KRB5_CRYPTO_TYPE_EMPTY:
3667 *len = 0;
3668 return 0;
3669 case KRB5_CRYPTO_TYPE_HEADER:
3670 *len = crypto->et->blocksize;
3671 return 0;
3672 case KRB5_CRYPTO_TYPE_DATA:
3673 case KRB5_CRYPTO_TYPE_SIGN_ONLY:
3674 /* len must already been filled in */
3675 return 0;
3676 case KRB5_CRYPTO_TYPE_PADDING:
3677 if (crypto->et->padsize > 1)
3678 *len = crypto->et->padsize;
3679 else
3680 *len = 0;
3681 return 0;
3682 case KRB5_CRYPTO_TYPE_TRAILER:
3683 *len = CHECKSUMSIZE(crypto->et->keyed_checksum);
3684 return 0;
3685 case KRB5_CRYPTO_TYPE_CHECKSUM:
3686 if (crypto->et->keyed_checksum)
3687 *len = CHECKSUMSIZE(crypto->et->keyed_checksum);
3688 else
3689 *len = CHECKSUMSIZE(crypto->et->checksum);
3690 return 0;
3691 }
3692 krb5_set_error_message(context, EINVAL,
3693 "%d not a supported type", type);
3694 return EINVAL;
3695 }
3696
3697
3698 krb5_error_code KRB5_LIB_FUNCTION
3699 krb5_crypto_length_iov(krb5_context context,
3700 krb5_crypto crypto,
3701 krb5_crypto_iov *data,
3702 unsigned int num_data)
3703 {
3704 krb5_error_code ret;
3705 int i;
3706
3707 for (i = 0; i < num_data; i++) {
3708 ret = krb5_crypto_length(context, crypto,
3709 data[i].flags,
3710 &data[i].data.length);
3711 if (ret)
3712 return ret;
3713 }
3714 return 0;
3715 }
3716
3717
3718 krb5_error_code KRB5_LIB_FUNCTION
3719 krb5_encrypt_ivec(krb5_context context,
3720 krb5_crypto crypto,
3721 unsigned usage,
3722 const void *data,
3723 size_t len,
3724 krb5_data *result,
3725 void *ivec)
3726 {
3727 if(derived_crypto(context, crypto))
3728 return encrypt_internal_derived(context, crypto, usage,
3729 data, len, result, ivec);
3730 else if (special_crypto(context, crypto))
3731 return encrypt_internal_special (context, crypto, usage,
3732 data, len, result, ivec);
3733 else
3734 return encrypt_internal(context, crypto, data, len, result, ivec);
3735 }
3736
3737 krb5_error_code KRB5_LIB_FUNCTION
3738 krb5_encrypt(krb5_context context,
3739 krb5_crypto crypto,
3740 unsigned usage,
3741 const void *data,
3742 size_t len,
3743 krb5_data *result)
3744 {
3745 return krb5_encrypt_ivec(context, crypto, usage, data, len, result, NULL);
3746 }
3747
3748 krb5_error_code KRB5_LIB_FUNCTION
3749 krb5_encrypt_EncryptedData(krb5_context context,
3750 krb5_crypto crypto,
3751 unsigned usage,
3752 void *data,
3753 size_t len,
3754 int kvno,
3755 EncryptedData *result)
3756 {
3757 result->etype = CRYPTO_ETYPE(crypto);
3758 if(kvno){
3759 ALLOC(result->kvno, 1);
3760 *result->kvno = kvno;
3761 }else
3762 result->kvno = NULL;
3763 return krb5_encrypt(context, crypto, usage, data, len, &result->cipher);
3764 }
3765
3766 krb5_error_code KRB5_LIB_FUNCTION
3767 krb5_decrypt_ivec(krb5_context context,
3768 krb5_crypto crypto,
3769 unsigned usage,
3770 void *data,
3771 size_t len,
3772 krb5_data *result,
3773 void *ivec)
3774 {
3775 if(derived_crypto(context, crypto))
3776 return decrypt_internal_derived(context, crypto, usage,
3777 data, len, result, ivec);
3778 else if (special_crypto (context, crypto))
3779 return decrypt_internal_special(context, crypto, usage,
3780 data, len, result, ivec);
3781 else
3782 return decrypt_internal(context, crypto, data, len, result, ivec);
3783 }
3784
3785 krb5_error_code KRB5_LIB_FUNCTION
3786 krb5_decrypt(krb5_context context,
3787 krb5_crypto crypto,
3788 unsigned usage,
3789 void *data,
3790 size_t len,
3791 krb5_data *result)
3792 {
3793 return krb5_decrypt_ivec (context, crypto, usage, data, len, result,
3794 NULL);
3795 }
3796
3797 krb5_error_code KRB5_LIB_FUNCTION
3798 krb5_decrypt_EncryptedData(krb5_context context,
3799 krb5_crypto crypto,
3800 unsigned usage,
3801 const EncryptedData *e,
3802 krb5_data *result)
3803 {
3804 return krb5_decrypt(context, crypto, usage,
3805 e->cipher.data, e->cipher.length, result);
3806 }
3807
3808 /************************************************************
3809 * *
3810 ************************************************************/
3811
3812 #define ENTROPY_NEEDED 128
3813
3814 static int
3815 seed_something(void)
3816 {
3817 char buf[1024], seedfile[256];
3818
3819 /* If there is a seed file, load it. But such a file cannot be trusted,
3820 so use 0 for the entropy estimate */
3821 if (RAND_file_name(seedfile, sizeof(seedfile))) {
3822 int fd;
3823 fd = open(seedfile, O_RDONLY | O_BINARY | O_CLOEXEC);
3824 if (fd >= 0) {
3825 ssize_t ret;
3826 rk_cloexec(fd);
3827 ret = read(fd, buf, sizeof(buf));
3828 if (ret > 0)
3829 RAND_add(buf, ret, 0.0);
3830 close(fd);
3831 } else
3832 seedfile[0] = '\0';
3833 } else
3834 seedfile[0] = '\0';
3835
3836 /* Calling RAND_status() will try to use /dev/urandom if it exists so
3837 we do not have to deal with it. */
3838 if (RAND_status() != 1) {
3839 krb5_context context;
3840 const char *p;
3841
3842 /* Try using egd */
3843 if (!krb5_init_context(&context)) {
3844 p = krb5_config_get_string(context, NULL, "libdefaults",
3845 "egd_socket", NULL);
3846 if (p != NULL)
3847 RAND_egd_bytes(p, ENTROPY_NEEDED);
3848 krb5_free_context(context);
3849 }
3850 }
3851
3852 if (RAND_status() == 1) {
3853 /* Update the seed file */
3854 if (seedfile[0])
3855 RAND_write_file(seedfile);
3856
3857 return 0;
3858 } else
3859 return -1;
3860 }
3861
3862 void KRB5_LIB_FUNCTION
3863 krb5_generate_random_block(void *buf, size_t len)
3864 {
3865 static int rng_initialized = 0;
3866
3867 HEIMDAL_MUTEX_lock(&crypto_mutex);
3868 if (!rng_initialized) {
3869 if (seed_something())
3870 krb5_abortx(NULL, "Fatal: could not seed the "
3871 "random number generator");
3872
3873 rng_initialized = 1;
3874 }
3875 HEIMDAL_MUTEX_unlock(&crypto_mutex);
3876 if (RAND_bytes(buf, len) != 1)
3877 krb5_abortx(NULL, "Failed to generate random block");
3878 }
3879
3880 static krb5_error_code
3881 derive_key(krb5_context context,
3882 struct encryption_type *et,
3883 struct key_data *key,
3884 const void *constant,
3885 size_t len)
3886 {
3887 unsigned char *k = NULL;
3888 unsigned int nblocks = 0, i;
3889 krb5_error_code ret = 0;
3890 struct key_type *kt = et->keytype;
3891
3892 ret = _key_schedule(context, key);
3893 if(ret)
3894 return ret;
3895 if(et->blocksize * 8 < kt->bits || len != et->blocksize) {
3896 nblocks = (kt->bits + et->blocksize * 8 - 1) / (et->blocksize * 8);
3897 k = malloc(nblocks * et->blocksize);
3898 if(k == NULL) {
3899 ret = ENOMEM;
3900 krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
3901 goto out;
3902 }
3903 ret = _krb5_n_fold(constant, len, k, et->blocksize);
3904 if (ret) {
3905 krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
3906 goto out;
3907 }
3908
3909 for(i = 0; i < nblocks; i++) {
3910 if(i > 0)
3911 memcpy(k + i * et->blocksize,
3912 k + (i - 1) * et->blocksize,
3913 et->blocksize);
3914 (*et->encrypt)(context, key, k + i * et->blocksize, et->blocksize,
3915 1, 0, NULL);
3916 }
3917 } else {
3918 /* this case is probably broken, but won't be run anyway */
3919 void *c = malloc(len);
3920 size_t res_len = (kt->bits + 7) / 8;
3921
3922 if(len != 0 && c == NULL) {
3923 ret = ENOMEM;
3924 krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
3925 goto out;
3926 }
3927 memcpy(c, constant, len);
3928 (*et->encrypt)(context, key, c, len, 1, 0, NULL);
3929 k = malloc(res_len);
3930 if(res_len != 0 && k == NULL) {
3931 free(c);
3932 ret = ENOMEM;
3933 krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
3934 goto out;
3935 }
3936 ret = _krb5_n_fold(c, len, k, res_len);
3937 free(c);
3938 if (ret) {
3939 krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
3940 goto out;
3941 }
3942 }
3943
3944 /* XXX keytype dependent post-processing */
3945 switch(kt->type) {
3946 case KEYTYPE_DES3:
3947 DES3_random_to_key(context, key->key, k, nblocks * et->blocksize);
3948 break;
3949 case KEYTYPE_AES128:
3950 case KEYTYPE_AES256:
3951 memcpy(key->key->keyvalue.data, k, key->key->keyvalue.length);
3952 break;
3953 default:
3954 ret = KRB5_CRYPTO_INTERNAL;
3955 krb5_set_error_message(context, ret,
3956 N_("derive_key() called with unknown keytype (%u)", ""),
3957 kt->type);
3958 break;
3959 }
3960 out:
3961 if (key->schedule) {
3962 free_key_schedule(context, key, et);
3963 key->schedule = NULL;
3964 }
3965 if (k) {
3966 memset(k, 0, nblocks * et->blocksize);
3967 free(k);
3968 }
3969 return ret;
3970 }
3971
3972 static struct key_data *
3973 _new_derived_key(krb5_crypto crypto, unsigned usage)
3974 {
3975 struct key_usage *d = crypto->key_usage;
3976 d = realloc(d, (crypto->num_key_usage + 1) * sizeof(*d));
3977 if(d == NULL)
3978 return NULL;
3979 crypto->key_usage = d;
3980 d += crypto->num_key_usage++;
3981 memset(d, 0, sizeof(*d));
3982 d->usage = usage;
3983 return &d->key;
3984 }
3985
3986 krb5_error_code KRB5_LIB_FUNCTION
3987 krb5_derive_key(krb5_context context,
3988 const krb5_keyblock *key,
3989 krb5_enctype etype,
3990 const void *constant,
3991 size_t constant_len,
3992 krb5_keyblock **derived_key)
3993 {
3994 krb5_error_code ret;
3995 struct encryption_type *et;
3996 struct key_data d;
3997
3998 *derived_key = NULL;
3999
4000 et = _find_enctype (etype);
4001 if (et == NULL) {
4002 krb5_set_error_message(context, KRB5_PROG_ETYPE_NOSUPP,
4003 N_("encryption type %d not supported", ""),
4004 etype);
4005 return KRB5_PROG_ETYPE_NOSUPP;
4006 }
4007
4008 ret = krb5_copy_keyblock(context, key, &d.key);
4009 if (ret)
4010 return ret;
4011
4012 d.schedule = NULL;
4013 ret = derive_key(context, et, &d, constant, constant_len);
4014 if (ret == 0)
4015 ret = krb5_copy_keyblock(context, d.key, derived_key);
4016 free_key_data(context, &d, et);
4017 return ret;
4018 }
4019
4020 static krb5_error_code
4021 _get_derived_key(krb5_context context,
4022 krb5_crypto crypto,
4023 unsigned usage,
4024 struct key_data **key)
4025 {
4026 int i;
4027 struct key_data *d;
4028 unsigned char constant[5];
4029
4030 for(i = 0; i < crypto->num_key_usage; i++)
4031 if(crypto->key_usage[i].usage == usage) {
4032 *key = &crypto->key_usage[i].key;
4033 return 0;
4034 }
4035 d = _new_derived_key(crypto, usage);
4036 if(d == NULL) {
4037 krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
4038 return ENOMEM;
4039 }
4040 krb5_copy_keyblock(context, crypto->key.key, &d->key);
4041 _krb5_put_int(constant, usage, 5);
4042 derive_key(context, crypto->et, d, constant, sizeof(constant));
4043 *key = d;
4044 return 0;
4045 }
4046
4047
4048 krb5_error_code KRB5_LIB_FUNCTION
4049 krb5_crypto_init(krb5_context context,
4050 const krb5_keyblock *key,
4051 krb5_enctype etype,
4052 krb5_crypto *crypto)
4053 {
4054 krb5_error_code ret;
4055 ALLOC(*crypto, 1);
4056 if(*crypto == NULL) {
4057 krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
4058 return ENOMEM;
4059 }
4060 if(etype == ETYPE_NULL)
4061 etype = key->keytype;
4062 (*crypto)->et = _find_enctype(etype);
4063 if((*crypto)->et == NULL || ((*crypto)->et->flags & F_DISABLED)) {
4064 free(*crypto);
4065 *crypto = NULL;
4066 krb5_set_error_message (context, KRB5_PROG_ETYPE_NOSUPP,
4067 N_("encryption type %d not supported", ""),
4068 etype);
4069 return KRB5_PROG_ETYPE_NOSUPP;
4070 }
4071 if((*crypto)->et->keytype->size != key->keyvalue.length) {
4072 free(*crypto);
4073 *crypto = NULL;
4074 krb5_set_error_message (context, KRB5_BAD_KEYSIZE,
4075 "encryption key has bad length");
4076 return KRB5_BAD_KEYSIZE;
4077 }
4078 ret = krb5_copy_keyblock(context, key, &(*crypto)->key.key);
4079 if(ret) {
4080 free(*crypto);
4081 *crypto = NULL;
4082 return ret;
4083 }
4084 (*crypto)->key.schedule = NULL;
4085 (*crypto)->num_key_usage = 0;
4086 (*crypto)->key_usage = NULL;
4087 return 0;
4088 }
4089
4090 static void
4091 free_key_schedule(krb5_context context,
4092 struct key_data *key,
4093 struct encryption_type *et)
4094 {
4095 if (et->keytype->cleanup)
4096 (*et->keytype->cleanup)(context, key);
4097 memset(key->schedule->data, 0, key->schedule->length);
4098 krb5_free_data(context, key->schedule);
4099 }
4100
4101 static void
4102 free_key_data(krb5_context context, struct key_data *key,
4103 struct encryption_type *et)
4104 {
4105 krb5_free_keyblock(context, key->key);
4106 if(key->schedule) {
4107 free_key_schedule(context, key, et);
4108 key->schedule = NULL;
4109 }
4110 }
4111
4112 static void
4113 free_key_usage(krb5_context context, struct key_usage *ku,
4114 struct encryption_type *et)
4115 {
4116 free_key_data(context, &ku->key, et);
4117 }
4118
4119 krb5_error_code KRB5_LIB_FUNCTION
4120 krb5_crypto_destroy(krb5_context context,
4121 krb5_crypto crypto)
4122 {
4123 int i;
4124
4125 for(i = 0; i < crypto->num_key_usage; i++)
4126 free_key_usage(context, &crypto->key_usage[i], crypto->et);
4127 free(crypto->key_usage);
4128 free_key_data(context, &crypto->key, crypto->et);
4129 free (crypto);
4130 return 0;
4131 }
4132
4133 krb5_error_code KRB5_LIB_FUNCTION
4134 krb5_crypto_getblocksize(krb5_context context,
4135 krb5_crypto crypto,
4136 size_t *blocksize)
4137 {
4138 *blocksize = crypto->et->blocksize;
4139 return 0;
4140 }
4141
4142 krb5_error_code KRB5_LIB_FUNCTION
4143 krb5_crypto_getenctype(krb5_context context,
4144 krb5_crypto crypto,
4145 krb5_enctype *enctype)
4146 {
4147 *enctype = crypto->et->type;
4148 return 0;
4149 }
4150
4151 krb5_error_code KRB5_LIB_FUNCTION
4152 krb5_crypto_getpadsize(krb5_context context,
4153 krb5_crypto crypto,
4154 size_t *padsize)
4155 {
4156 *padsize = crypto->et->padsize;
4157 return 0;
4158 }
4159
4160 krb5_error_code KRB5_LIB_FUNCTION
4161 krb5_crypto_getconfoundersize(krb5_context context,
4162 krb5_crypto crypto,
4163 size_t *confoundersize)
4164 {
4165 *confoundersize = crypto->et->confoundersize;
4166 return 0;
4167 }
4168
4169
4170 /**
4171 * Disable encryption type
4172 *
4173 * @param context Kerberos 5 context
4174 * @param enctype encryption type to disable
4175 *
4176 * @return Return an error code or 0.
4177 *
4178 * @ingroup krb5_crypto
4179 */
4180
4181 krb5_error_code KRB5_LIB_FUNCTION
4182 krb5_enctype_disable(krb5_context context,
4183 krb5_enctype enctype)
4184 {
4185 struct encryption_type *et = _find_enctype(enctype);
4186 if(et == NULL) {
4187 if (context)
4188 krb5_set_error_message (context, KRB5_PROG_ETYPE_NOSUPP,
4189 N_("encryption type %d not supported", ""),
4190 enctype);
4191 return KRB5_PROG_ETYPE_NOSUPP;
4192 }
4193 et->flags |= F_DISABLED;
4194 return 0;
4195 }
4196
4197 /**
4198 * Enable encryption type
4199 *
4200 * @param context Kerberos 5 context
4201 * @param enctype encryption type to enable
4202 *
4203 * @return Return an error code or 0.
4204 *
4205 * @ingroup krb5_crypto
4206 */
4207
4208 krb5_error_code KRB5_LIB_FUNCTION
4209 krb5_enctype_enable(krb5_context context,
4210 krb5_enctype enctype)
4211 {
4212 struct encryption_type *et = _find_enctype(enctype);
4213 if(et == NULL) {
4214 if (context)
4215 krb5_set_error_message (context, KRB5_PROG_ETYPE_NOSUPP,
4216 N_("encryption type %d not supported", ""),
4217 enctype);
4218 return KRB5_PROG_ETYPE_NOSUPP;
4219 }
4220 et->flags &= ~F_DISABLED;
4221 return 0;
4222 }
4223
4224
4225 krb5_error_code KRB5_LIB_FUNCTION
4226 krb5_string_to_key_derived(krb5_context context,
4227 const void *str,
4228 size_t len,
4229 krb5_enctype etype,
4230 krb5_keyblock *key)
4231 {
4232 struct encryption_type *et = _find_enctype(etype);
4233 krb5_error_code ret;
4234 struct key_data kd;
4235 size_t keylen;
4236 u_char *tmp;
4237
4238 if(et == NULL) {
4239 krb5_set_error_message (context, KRB5_PROG_ETYPE_NOSUPP,
4240 N_("encryption type %d not supported", ""),
4241 etype);
4242 return KRB5_PROG_ETYPE_NOSUPP;
4243 }
4244 keylen = et->keytype->bits / 8;
4245
4246 ALLOC(kd.key, 1);
4247 if(kd.key == NULL) {
4248 krb5_set_error_message (context, ENOMEM,
4249 N_("malloc: out of memory", ""));
4250 return ENOMEM;
4251 }
4252 ret = krb5_data_alloc(&kd.key->keyvalue, et->keytype->size);
4253 if(ret) {
4254 free(kd.key);
4255 return ret;
4256 }
4257 kd.key->keytype = etype;
4258 tmp = malloc (keylen);
4259 if(tmp == NULL) {
4260 krb5_free_keyblock(context, kd.key);
4261 krb5_set_error_message (context, ENOMEM, N_("malloc: out of memory", ""));
4262 return ENOMEM;
4263 }
4264 ret = _krb5_n_fold(str, len, tmp, keylen);
4265 if (ret) {
4266 free(tmp);
4267 krb5_set_error_message (context, ENOMEM, N_("malloc: out of memory", ""));
4268 return ret;
4269 }
4270 kd.schedule = NULL;
4271 DES3_random_to_key(context, kd.key, tmp, keylen);
4272 memset(tmp, 0, keylen);
4273 free(tmp);
4274 ret = derive_key(context,
4275 et,
4276 &kd,
4277 "kerberos", /* XXX well known constant */
4278 strlen("kerberos"));
4279 if (ret) {
4280 free_key_data(context, &kd, et);
4281 return ret;
4282 }
4283 ret = krb5_copy_keyblock_contents(context, kd.key, key);
4284 free_key_data(context, &kd, et);
4285 return ret;
4286 }
4287
4288 static size_t
4289 wrapped_length (krb5_context context,
4290 krb5_crypto crypto,
4291 size_t data_len)
4292 {
4293 struct encryption_type *et = crypto->et;
4294 size_t padsize = et->padsize;
4295 size_t checksumsize = CHECKSUMSIZE(et->checksum);
4296 size_t res;
4297
4298 res = et->confoundersize + checksumsize + data_len;
4299 res = (res + padsize - 1) / padsize * padsize;
4300 return res;
4301 }
4302
4303 static size_t
4304 wrapped_length_dervied (krb5_context context,
4305 krb5_crypto crypto,
4306 size_t data_len)
4307 {
4308 struct encryption_type *et = crypto->et;
4309 size_t padsize = et->padsize;
4310 size_t res;
4311
4312 res = et->confoundersize + data_len;
4313 res = (res + padsize - 1) / padsize * padsize;
4314 if (et->keyed_checksum)
4315 res += et->keyed_checksum->checksumsize;
4316 else
4317 res += et->checksum->checksumsize;
4318 return res;
4319 }
4320
4321 /*
4322 * Return the size of an encrypted packet of length `data_len'
4323 */
4324
4325 size_t
4326 krb5_get_wrapped_length (krb5_context context,
4327 krb5_crypto crypto,
4328 size_t data_len)
4329 {
4330 if (derived_crypto (context, crypto))
4331 return wrapped_length_dervied (context, crypto, data_len);
4332 else
4333 return wrapped_length (context, crypto, data_len);
4334 }
4335
4336 /*
4337 * Return the size of an encrypted packet of length `data_len'
4338 */
4339
4340 static size_t
4341 crypto_overhead (krb5_context context,
4342 krb5_crypto crypto)
4343 {
4344 struct encryption_type *et = crypto->et;
4345 size_t res;
4346
4347 res = CHECKSUMSIZE(et->checksum);
4348 res += et->confoundersize;
4349 if (et->padsize > 1)
4350 res += et->padsize;
4351 return res;
4352 }
4353
4354 static size_t
4355 crypto_overhead_dervied (krb5_context context,
4356 krb5_crypto crypto)
4357 {
4358 struct encryption_type *et = crypto->et;
4359 size_t res;
4360
4361 if (et->keyed_checksum)
4362 res = CHECKSUMSIZE(et->keyed_checksum);
4363 else
4364 res = CHECKSUMSIZE(et->checksum);
4365 res += et->confoundersize;
4366 if (et->padsize > 1)
4367 res += et->padsize;
4368 return res;
4369 }
4370
4371 size_t
4372 krb5_crypto_overhead (krb5_context context, krb5_crypto crypto)
4373 {
4374 if (derived_crypto (context, crypto))
4375 return crypto_overhead_dervied (context, crypto);
4376 else
4377 return crypto_overhead (context, crypto);
4378 }
4379
4380 /**
4381 * Converts the random bytestring to a protocol key according to
4382 * Kerberos crypto frame work. It may be assumed that all the bits of
4383 * the input string are equally random, even though the entropy
4384 * present in the random source may be limited.
4385 *
4386 * @param context Kerberos 5 context
4387 * @param type the enctype resulting key will be of
4388 * @param data input random data to convert to a key
4389 * @param data size of input random data, at least krb5_enctype_keysize() long
4390 * @param data key, output key, free with krb5_free_keyblock_contents()
4391 *
4392 * @return Return an error code or 0.
4393 *
4394 * @ingroup krb5_crypto
4395 */
4396
4397 krb5_error_code KRB5_LIB_FUNCTION
4398 krb5_random_to_key(krb5_context context,
4399 krb5_enctype type,
4400 const void *data,
4401 size_t size,
4402 krb5_keyblock *key)
4403 {
4404 krb5_error_code ret;
4405 struct encryption_type *et = _find_enctype(type);
4406 if(et == NULL) {
4407 krb5_set_error_message(context, KRB5_PROG_ETYPE_NOSUPP,
4408 N_("encryption type %d not supported", ""),
4409 type);
4410 return KRB5_PROG_ETYPE_NOSUPP;
4411 }
4412 if ((et->keytype->bits + 7) / 8 > size) {
4413 krb5_set_error_message(context, KRB5_PROG_ETYPE_NOSUPP,
4414 N_("encryption key %s needs %d bytes "
4415 "of random to make an encryption key "
4416 "out of it", ""),
4417 et->name, (int)et->keytype->size);
4418 return KRB5_PROG_ETYPE_NOSUPP;
4419 }
4420 ret = krb5_data_alloc(&key->keyvalue, et->keytype->size);
4421 if(ret)
4422 return ret;
4423 key->keytype = type;
4424 if (et->keytype->random_to_key)
4425 (*et->keytype->random_to_key)(context, key, data, size);
4426 else
4427 memcpy(key->keyvalue.data, data, et->keytype->size);
4428
4429 return 0;
4430 }
4431
4432 krb5_error_code
4433 _krb5_pk_octetstring2key(krb5_context context,
4434 krb5_enctype type,
4435 const void *dhdata,
4436 size_t dhsize,
4437 const heim_octet_string *c_n,
4438 const heim_octet_string *k_n,
4439 krb5_keyblock *key)
4440 {
4441 struct encryption_type *et = _find_enctype(type);
4442 krb5_error_code ret;
4443 size_t keylen, offset;
4444 void *keydata;
4445 unsigned char counter;
4446 unsigned char shaoutput[SHA_DIGEST_LENGTH];
4447 EVP_MD_CTX *m;
4448
4449 if(et == NULL) {
4450 krb5_set_error_message(context, KRB5_PROG_ETYPE_NOSUPP,
4451 N_("encryption type %d not supported", ""),
4452 type);
4453 return KRB5_PROG_ETYPE_NOSUPP;
4454 }
4455 keylen = (et->keytype->bits + 7) / 8;
4456
4457 keydata = malloc(keylen);
4458 if (keydata == NULL) {
4459 krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
4460 return ENOMEM;
4461 }
4462
4463 m = EVP_MD_CTX_create();
4464 if (m == NULL) {
4465 free(keydata);
4466 krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
4467 return ENOMEM;
4468 }
4469
4470 counter = 0;
4471 offset = 0;
4472 do {
4473
4474 EVP_DigestInit_ex(m, EVP_sha1(), NULL);
4475 EVP_DigestUpdate(m, &counter, 1);
4476 EVP_DigestUpdate(m, dhdata, dhsize);
4477
4478 if (c_n)
4479 EVP_DigestUpdate(m, c_n->data, c_n->length);
4480 if (k_n)
4481 EVP_DigestUpdate(m, k_n->data, k_n->length);
4482
4483 EVP_DigestFinal_ex(m, shaoutput, NULL);
4484
4485 memcpy((unsigned char *)keydata + offset,
4486 shaoutput,
4487 min(keylen - offset, sizeof(shaoutput)));
4488
4489 offset += sizeof(shaoutput);
4490 counter++;
4491 } while(offset < keylen);
4492 memset(shaoutput, 0, sizeof(shaoutput));
4493
4494 EVP_MD_CTX_destroy(m);
4495
4496 ret = krb5_random_to_key(context, type, keydata, keylen, key);
4497 memset(keydata, 0, sizeof(keylen));
4498 free(keydata);
4499 return ret;
4500 }
4501
4502 static krb5_error_code
4503 encode_uvinfo(krb5_context context, krb5_const_principal p, krb5_data *data)
4504 {
4505 KRB5PrincipalName pn;
4506 krb5_error_code ret;
4507 size_t size;
4508
4509 pn.principalName = p->name;
4510 pn.realm = p->realm;
4511
4512 ASN1_MALLOC_ENCODE(KRB5PrincipalName, data->data, data->length,
4513 &pn, &size, ret);
4514 if (ret) {
4515 krb5_data_zero(data);
4516 krb5_set_error_message(context, ret,
4517 N_("Failed to encode KRB5PrincipalName", ""));
4518 return ret;
4519 }
4520 if (data->length != size)
4521 krb5_abortx(context, "asn1 compiler internal error");
4522 return 0;
4523 }
4524
4525 static krb5_error_code
4526 encode_otherinfo(krb5_context context,
4527 const AlgorithmIdentifier *ai,
4528 krb5_const_principal client,
4529 krb5_const_principal server,
4530 krb5_enctype enctype,
4531 const krb5_data *as_req,
4532 const krb5_data *pk_as_rep,
4533 const Ticket *ticket,
4534 krb5_data *other)
4535 {
4536 PkinitSP80056AOtherInfo otherinfo;
4537 PkinitSuppPubInfo pubinfo;
4538 krb5_error_code ret;
4539 krb5_data pub;
4540 size_t size;
4541
4542 krb5_data_zero(other);
4543 memset(&otherinfo, 0, sizeof(otherinfo));
4544 memset(&pubinfo, 0, sizeof(pubinfo));
4545
4546 pubinfo.enctype = enctype;
4547 pubinfo.as_REQ = *as_req;
4548 pubinfo.pk_as_rep = *pk_as_rep;
4549 pubinfo.ticket = *ticket;
4550 ASN1_MALLOC_ENCODE(PkinitSuppPubInfo, pub.data, pub.length,
4551 &pubinfo, &size, ret);
4552 if (ret) {
4553 krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
4554 return ret;
4555 }
4556 if (pub.length != size)
4557 krb5_abortx(context, "asn1 compiler internal error");
4558
4559 ret = encode_uvinfo(context, client, &otherinfo.partyUInfo);
4560 if (ret) {
4561 free(pub.data);
4562 return ret;
4563 }
4564 ret = encode_uvinfo(context, server, &otherinfo.partyVInfo);
4565 if (ret) {
4566 free(otherinfo.partyUInfo.data);
4567 free(pub.data);
4568 return ret;
4569 }
4570
4571 otherinfo.algorithmID = *ai;
4572 otherinfo.suppPubInfo = &pub;
4573
4574 ASN1_MALLOC_ENCODE(PkinitSP80056AOtherInfo, other->data, other->length,
4575 &otherinfo, &size, ret);
4576 free(otherinfo.partyUInfo.data);
4577 free(otherinfo.partyVInfo.data);
4578 free(pub.data);
4579 if (ret) {
4580 krb5_set_error_message(context, ret, N_("malloc: out of memory", ""));
4581 return ret;
4582 }
4583 if (other->length != size)
4584 krb5_abortx(context, "asn1 compiler internal error");
4585
4586 return 0;
4587 }
4588
4589 krb5_error_code
4590 _krb5_pk_kdf(krb5_context context,
4591 const struct AlgorithmIdentifier *ai,
4592 const void *dhdata,
4593 size_t dhsize,
4594 krb5_const_principal client,
4595 krb5_const_principal server,
4596 krb5_enctype enctype,
4597 const krb5_data *as_req,
4598 const krb5_data *pk_as_rep,
4599 const Ticket *ticket,
4600 krb5_keyblock *key)
4601 {
4602 struct encryption_type *et;
4603 krb5_error_code ret;
4604 krb5_data other;
4605 size_t keylen, offset;
4606 uint32_t counter;
4607 unsigned char *keydata;
4608 unsigned char shaoutput[SHA_DIGEST_LENGTH];
4609
4610 if (der_heim_oid_cmp(&asn1_oid_id_pkinit_kdf_ah_sha1, &ai->algorithm) != 0) {
4611 krb5_set_error_message(context, KRB5_PROG_ETYPE_NOSUPP,
4612 N_("KDF not supported", ""));
4613 return KRB5_PROG_ETYPE_NOSUPP;
4614 }
4615 if (ai->parameters != NULL &&
4616 (ai->parameters->length != 2 ||
4617 memcmp(ai->parameters->data, "\x05\x00", 2) != 0))
4618 {
4619 krb5_set_error_message(context, KRB5_PROG_ETYPE_NOSUPP,
4620 N_("kdf params not NULL or the NULL-type",
4621 ""));
4622 return KRB5_PROG_ETYPE_NOSUPP;
4623 }
4624
4625 et = _find_enctype(enctype);
4626 if(et == NULL) {
4627 krb5_set_error_message(context, KRB5_PROG_ETYPE_NOSUPP,
4628 N_("encryption type %d not supported", ""),
4629 enctype);
4630 return KRB5_PROG_ETYPE_NOSUPP;
4631 }
4632 keylen = (et->keytype->bits + 7) / 8;
4633
4634 keydata = malloc(keylen);
4635 if (keydata == NULL) {
4636 krb5_set_error_message(context, ENOMEM, N_("malloc: out of memory", ""));
4637 return ENOMEM;
4638 }
4639
4640 ret = encode_otherinfo(context, ai, client, server,
4641 enctype, as_req, pk_as_rep, ticket, &other);
4642 if (ret) {
4643 free(keydata);
4644 return ret;
4645 }
4646
4647 offset = 0;
4648 counter = 1;
4649 do {
4650 unsigned char cdata[4];
4651 SHA_CTX m;
4652
4653 SHA1_Init(&m);
4654 _krb5_put_int(cdata, counter, 4);
4655 SHA1_Update(&m, cdata, 4);
4656 SHA1_Update(&m, dhdata, dhsize);
4657 SHA1_Update(&m, other.data, other.length);
4658 SHA1_Final(shaoutput, &m);
4659
4660 memcpy((unsigned char *)keydata + offset,
4661 shaoutput,
4662 min(keylen - offset, sizeof(shaoutput)));
4663
4664 offset += sizeof(shaoutput);
4665 counter++;
4666 } while(offset < keylen);
4667 memset(shaoutput, 0, sizeof(shaoutput));
4668
4669 free(other.data);
4670
4671 ret = krb5_random_to_key(context, enctype, keydata, keylen, key);
4672 memset(keydata, 0, sizeof(keylen));
4673 free(keydata);
4674
4675 return ret;
4676 }
4677
4678
4679 krb5_error_code KRB5_LIB_FUNCTION
4680 krb5_crypto_prf_length(krb5_context context,
4681 krb5_enctype type,
4682 size_t *length)
4683 {
4684 struct encryption_type *et = _find_enctype(type);
4685
4686 if(et == NULL || et->prf_length == 0) {
4687 krb5_set_error_message(context, KRB5_PROG_ETYPE_NOSUPP,
4688 N_("encryption type %d not supported", ""),
4689 type);
4690 return KRB5_PROG_ETYPE_NOSUPP;
4691 }
4692
4693 *length = et->prf_length;
4694 return 0;
4695 }
4696
4697 krb5_error_code KRB5_LIB_FUNCTION
4698 krb5_crypto_prf(krb5_context context,
4699 const krb5_crypto crypto,
4700 const krb5_data *input,
4701 krb5_data *output)
4702 {
4703 struct encryption_type *et = crypto->et;
4704
4705 krb5_data_zero(output);
4706
4707 if(et->prf == NULL) {
4708 krb5_set_error_message(context, KRB5_PROG_ETYPE_NOSUPP,
4709 "kerberos prf for %s not supported",
4710 et->name);
4711 return KRB5_PROG_ETYPE_NOSUPP;
4712 }
4713
4714 return (*et->prf)(context, crypto, input, output);
4715 }
4716
4717 static krb5_error_code
4718 krb5_crypto_prfplus(krb5_context context,
4719 const krb5_crypto crypto,
4720 const krb5_data *input,
4721 size_t length,
4722 krb5_data *output)
4723 {
4724 krb5_error_code ret;
4725 krb5_data input2;
4726 unsigned char i = 1;
4727 unsigned char *p;
4728
4729 krb5_data_zero(&input2);
4730 krb5_data_zero(output);
4731
4732 krb5_clear_error_message(context);
4733
4734 ret = krb5_data_alloc(output, length);
4735 if (ret) goto out;
4736 ret = krb5_data_alloc(&input2, input->length + 1);
4737 if (ret) goto out;
4738
4739 krb5_clear_error_message(context);
4740
4741 memcpy(((unsigned char *)input2.data) + 1, input->data, input->length);
4742
4743 p = output->data;
4744
4745 while (length) {
4746 krb5_data block;
4747
4748 ((unsigned char *)input2.data)[0] = i++;
4749
4750 ret = krb5_crypto_prf(context, crypto, &input2, &block);
4751 if (ret)
4752 goto out;
4753
4754 if (block.length < length) {
4755 memcpy(p, block.data, block.length);
4756 length -= block.length;
4757 } else {
4758 memcpy(p, block.data, length);
4759 length = 0;
4760 }
4761 p += block.length;
4762 krb5_data_free(&block);
4763 }
4764
4765 out:
4766 krb5_data_free(&input2);
4767 if (ret)
4768 krb5_data_free(output);
4769 return 0;
4770 }
4771
4772 /**
4773 * The FX-CF2 key derivation function, used in FAST and preauth framework.
4774 *
4775 * @param context Kerberos 5 context
4776 * @param crypto1 first key to combine
4777 * @param crypto2 second key to combine
4778 * @param pepper1 factor to combine with first key to garante uniqueness
4779 * @param pepper1 factor to combine with second key to garante uniqueness
4780 * @param enctype the encryption type of the resulting key
4781 * @param res allocated key, free with krb5_free_keyblock_contents()
4782 *
4783 * @return Return an error code or 0.
4784 *
4785 * @ingroup krb5_crypto
4786 */
4787
4788 krb5_error_code KRB5_LIB_FUNCTION
4789 krb5_crypto_fx_cf2(krb5_context context,
4790 const krb5_crypto crypto1,
4791 const krb5_crypto crypto2,
4792 krb5_data *pepper1,
4793 krb5_data *pepper2,
4794 krb5_enctype enctype,
4795 krb5_keyblock *res)
4796 {
4797 krb5_error_code ret;
4798 krb5_data os1, os2;
4799 size_t i, keysize;
4800
4801 memset(res, 0, sizeof(*res));
4802
4803 ret = krb5_enctype_keysize(context, enctype, &keysize);
4804 if (ret)
4805 return ret;
4806
4807 ret = krb5_data_alloc(&res->keyvalue, keysize);
4808 if (ret)
4809 goto out;
4810 ret = krb5_crypto_prfplus(context, crypto1, pepper1, keysize, &os1);
4811 if (ret)
4812 goto out;
4813 ret = krb5_crypto_prfplus(context, crypto2, pepper2, keysize, &os2);
4814 if (ret)
4815 goto out;
4816
4817 res->keytype = enctype;
4818 {
4819 unsigned char *p1 = os1.data, *p2 = os2.data, *p3 = res->keyvalue.data;
4820 for (i = 0; i < keysize; i++)
4821 p3[i] = p1[i] ^ p2[i];
4822 }
4823 out:
4824 if (ret)
4825 krb5_data_free(&res->keyvalue);
4826 krb5_data_free(&os1);
4827 krb5_data_free(&os2);
4828
4829 return ret;
4830 }
4831
4832
4833
4834 #ifndef HEIMDAL_SMALLER
4835
4836 krb5_error_code KRB5_LIB_FUNCTION
4837 krb5_keytype_to_enctypes (krb5_context context,
4838 krb5_keytype keytype,
4839 unsigned *len,
4840 krb5_enctype **val)
4841 KRB5_DEPRECATED
4842 {
4843 int i;
4844 unsigned n = 0;
4845 krb5_enctype *ret;
4846
4847 for (i = num_etypes - 1; i >= 0; --i) {
4848 if (etypes[i]->keytype->type == keytype
4849 && !(etypes[i]->flags & F_PSEUDO)
4850 && krb5_enctype_valid(context, etypes[i]->type) == 0)
4851 ++n;
4852 }
4853 if (n == 0) {
4854 krb5_set_error_message(context, KRB5_PROG_KEYTYPE_NOSUPP,
4855 "Keytype have no mapping");
4856 return KRB5_PROG_KEYTYPE_NOSUPP;
4857 }
4858
4859 ret = malloc(n * sizeof(*ret));
4860 if (ret == NULL && n != 0) {
4861 krb5_set_error_message(context, ENOMEM, "malloc: out of memory");
4862 return ENOMEM;
4863 }
4864 n = 0;
4865 for (i = num_etypes - 1; i >= 0; --i) {
4866 if (etypes[i]->keytype->type == keytype
4867 && !(etypes[i]->flags & F_PSEUDO)
4868 && krb5_enctype_valid(context, etypes[i]->type) == 0)
4869 ret[n++] = etypes[i]->type;
4870 }
4871 *len = n;
4872 *val = ret;
4873 return 0;
4874 }
4875
4876 /* if two enctypes have compatible keys */
4877 krb5_boolean KRB5_LIB_FUNCTION
4878 krb5_enctypes_compatible_keys(krb5_context context,
4879 krb5_enctype etype1,
4880 krb5_enctype etype2)
4881 KRB5_DEPRECATED
4882 {
4883 struct encryption_type *e1 = _find_enctype(etype1);
4884 struct encryption_type *e2 = _find_enctype(etype2);
4885 return e1 != NULL && e2 != NULL && e1->keytype == e2->keytype;
4886 }
4887
4888 #endif /* HEIMDAL_SMALLER */
Heimdal